Uploaded image for project: 'Core ReactOS'
  1. Core ReactOS
  2. CORE-13408

Use after free during user32_winetest:clipboard

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Critical
    • 0.4.6
    • Win32SS
    • None

    Description

      Running Wine Test, Module: user32, Test: clipboard
      [...]
      clipboard.c:1006: multi-threaded test
      clipboard.c:1069: Test failed: OpenClipboard failed: 5
      clipboard.c:1088: Test failed: EmptyClipboard failed: 1418
      clipboard.c:1091: Test failed: sequence diff 0
      clipboard.c:1110: Test failed: EmptyClipboard failed: 1418
      clipboard.c:1113: Test failed: sequence diff 0
      clipboard.c:1127: Test failed: WM_DESTROYCLIPBOARD not received
      clipboard.c:1134: Test failed: SetClipboardData failed: 1418
      clipboard.c:1137: Test failed: sequence diff 0
      clipboard.c:1156: Test failed: sequence diff 0
      clipboard.c:1175: Test failed: sequence diff 0
      clipboard.c:1191: Test failed: CF_TEXT available
      clipboard.c:1192: Test failed: CF_UNICODETEXT available
      (..\win32ss\user\ntuser\clipboard.c:484) err: Access denied!
      (..\win32ss\user\ntuser\clipboard.c:484) err: Access denied!
      (..\win32ss\user\ntuser\clipboard.c:484) err: Access denied!
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(12, 0013A480) failed
      clipboard.c:1197: Test failed: CloseClipboard failed: 1418
      clipboard.c:1201: Test failed: sequence diff 0
      clipboard.c:1211: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1218: Test failed: OpenClipboard failed: 5
      clipboard.c:1235: Test failed: CF_TEXT available
      clipboard.c:1236: Test failed: CF_UNICODETEXT available
      clipboard.c:1237: Test failed: CF_OEMTEXT available
      clipboard.c:1239: Test failed: wrong owner 00020022
      clipboard.c:1243: Test failed: WM_RENDERFORMAT received 0000
      clipboard.c:1247: Test failed: didn't get data for CF_OEMTEXT
      clipboard.c:1249: Test failed: WM_RENDERFORMAT received 0000
      clipboard.c:1254: Test failed: sequence diff 0
      clipboard.c:1271: Test failed: CloseClipboard failed: 1418
      clipboard.c:1284: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1291: Test failed: OpenClipboard failed: 5
      clipboard.c:1293: Test failed: CloseClipboard failed: 1418
      clipboard.c:1315: Test failed: OpenClipboard failed: 5
      (..\win32ss\user\ntuser\clipboard.c:484) err: Access denied!
      (..\win32ss\user\ntuser\clipboard.c:484) err: Access denied!
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(12, 0013A490) failed
      (..\win32ss\user\ntuser\clipboard.c:484) err: Access denied!
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(12, 001351F8) failed
      (..\win32ss\user\ntuser\clipboard.c:484) err: Access denied!
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(12, 0013A4A0) failed
      clipboard.c:1317: Test failed: EmptyClipboard failed: 1418
      clipboard.c:1319: Test failed: CloseClipboard failed: 1418
      clipboard.c:1329: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1333: Test failed: WM_DESTROYCLIPBOARD not received
      clipboard.c:1340: Test failed: OpenClipboard failed: 5
      clipboard.c:1343: Test failed: sequence diff 0
      clipboard.c:1363: Test failed: CloseClipboard failed: 1418
      clipboard.c:1377: Test failed: WM_DRAWCLIPBOARD not received
      clipboard: 2 failures in child process
      clipboard.c:1386: Test failed: sequence diff 0
      clipboard.c:1399: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1406: Test failed: OpenClipboard failed: 5
      clipboard.c:1409: Test failed: sequence diff 0
      clipboard.c:1427: Test failed: CloseClipboard failed: 1418
      clipboard.c:1441: Test failed: WM_DRAWCLIPBOARD not received
      clipboard: 3 failures in child process
      clipboard.c:1450: Test failed: sequence diff 0
      clipboard.c:1463: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1470: Test failed: OpenClipboard failed: 5
      clipboard.c:1473: Test failed: sequence diff 0
      clipboard.c:1491: Test failed: CloseClipboard failed: 1418
      clipboard.c:1505: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1514: Test failed: OpenClipboard failed: 5
      clipboard.c:1516: Test failed: EmptyClipboard failed: 1418
      clipboard.c:1519: Test failed: CloseClipboard failed: 1418
      clipboard: 3 failures in child process
      clipboard.c:1529: Test failed: WM_DRAWCLIPBOARD not received
      (..\win32ss\user\ntuser\clipboard.c:484) err: Access denied!
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(1, 00790084) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(49265, 0079008C) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(2, 7B050225) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(2, E3050237) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(130, A705021E) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(9, A208014C) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(771, 00790094) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(519, 007900A4) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(49267, 007900B4) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(49267, 0013A4B0) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(3735928559, 00139FA8) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(3735927486, 007900AC) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(3735943902, 0013A110) failed
      clipboard.c:1533: Test failed: WM_RENDERFORMAT received
      clipboard.c:1006: single-threaded test
      clipboard.c:1069: Test failed: OpenClipboard failed: 5
      clipboard.c:1088: Test failed: EmptyClipboard failed: 1418
      clipboard.c:1091: Test failed: sequence diff 0
      clipboard.c:1110: Test failed: EmptyClipboard failed: 1418
      clipboard.c:1113: Test failed: sequence diff 0
      clipboard.c:1127: Test failed: WM_DESTROYCLIPBOARD not received
      clipboard.c:1134: Test failed: SetClipboardData failed: 1418
      clipboard.c:1137: Test failed: sequence diff 0
      clipboard.c:1156: Test failed: sequence diff 0
      clipboard.c:1175: Test failed: sequence diff 0
      clipboard.c:1191: Test failed: CF_TEXT available
      clipboard.c:1192: Test failed: CF_UNICODETEXT available
      clipboard.c:1197: Test failed: CloseClipboard failed: 1418
      clipboard.c:1201: Test failed: sequence diff 0
      clipboard.c:1205: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1211: Test failed: WM_DRAWCLIPBOARD not received
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(519, 0079009C) failed
      (..\win32ss\user\ntuser\clipboard.c:988) err: Access denied!
      err:(..\win32ss\user\user32\windows\clipboard.c:356) SetClipboardData(3735928559, 00139F88) failed
      (..\win32ss\user\ntuser\clipboard.c:484) err: Access denied!
      clipboard.c:1218: Test failed: OpenClipboard failed: 5
      clipboard.c:1235: Test failed: CF_TEXT available
      clipboard.c:1236: Test failed: CF_UNICODETEXT available
      clipboard.c:1237: Test failed: CF_OEMTEXT available
      clipboard.c:1239: Test failed: wrong owner 00020022
      clipboard.c:1243: Test failed: WM_RENDERFORMAT received 0000
      clipboard.c:1247: Test failed: didn't get data for CF_OEMTEXT
      clipboard.c:1249: Test failed: WM_RENDERFORMAT received 0000
      clipboard.c:1254: Test failed: sequence diff 0
      clipboard.c:1271: Test failed: CloseClipboard failed: 1418
      clipboard.c:1278: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1284: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1291: Test failed: OpenClipboard failed: 5
      clipboard.c:1293: Test failed: CloseClipboard failed: 1418
      clipboard.c:1315: Test failed: OpenClipboard failed: 5
      clipboard.c:1317: Test failed: EmptyClipboard failed: 1418
      clipboard.c:1319: Test failed: CloseClipboard failed: 1418
      clipboard.c:1323: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1329: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1333: Test failed: WM_DESTROYCLIPBOARD not received
      clipboard.c:1340: Test failed: OpenClipboard failed: 5
      clipboard.c:1343: Test failed: sequence diff 0
      clipboard.c:1363: Test failed: CloseClipboard failed: 1418
      clipboard.c:1371: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1377: Test failed: WM_DRAWCLIPBOARD not received
      clipboard: 2 failures in child process
      clipboard.c:1386: Test failed: sequence diff 0
      clipboard.c:1399: Test failed: WM_DRAWCLIPBOARD not received
      clipboard.c:1406: Test failed: OpenClipboard failed: 5
      clipboard.c:1409: Test failed: sequence diff 0
      clipboard.c:1427: Test failed: CloseClipboard failed: 1418
      clipboard.c:1435: Test failed: WM_DRAWCLIPBOARD received
      clipboard.c:1441: Test failed: WM_DRAWCLIPBOARD not received
      clipboard: 3 failures in child process
      clipboard.c:1450: Test failed: sequence diff 0
       
      *** Fatal System Error: 0x000000d5
                             (0xF69A8F8C,0x00000000,0xF25757CF,0x00000000)
       
      Driver at fault: 
      ***    win32k.sys - Address F25757CF base at F2536000, DateStamp 593bba37
      .
      Break instruction exception - code 80000003 (first chance)
       
      A fatal system error has occurred.
      Debugger entered on first try; Bugcheck callbacks have not been invoked.
       
      A fatal system error has occurred.
       
      Connected to Windows Server 2003 3790 x86 compatible target at (Sat Jun 10 11:25:47.921 2017 (UTC + 2:00)), ptr64 FALSE
      Loading Kernel Symbols
      ......................................................
      Loading User Symbols
      ..............
      *******************************************************************************
      *                                                                             *
      *                        Bugcheck Analysis                                    *
      *                                                                             *
      *******************************************************************************
       
      Use !analyze -v to get detailed debugging information.
       
      BugCheck D5, {f69a8f8c, 0, f25757cf, 0}
       
      Probably caused by : win32k.sys ( win32k!IntAddSynthesizedFormats+16f )
       
      Followup: MachineOwner
      ---------
       
      nt!RtlpBreakWithStatusInstruction:
      8055d2c8 cc              int     3
      kd> !analyze -v
      *******************************************************************************
      *                                                                             *
      *                        Bugcheck Analysis                                    *
      *                                                                             *
      *******************************************************************************
       
      DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)
      Memory was referenced after it was freed.
      This cannot be protected by try-except.
      When possible, the guilty driver's name (Unicode string) is printed on
      the bugcheck screen and saved in KiBugCheckDriver.
      Arguments:
      Arg1: f69a8f8c, memory referenced
      Arg2: 00000000, value 0 = read operation, 1 = write operation
      Arg3: f25757cf, if non-zero, the address which referenced memory.
      Arg4: 00000000, (reserved)
       
      Debugging Details:
      ------------------
       
       
      READ_ADDRESS:  f69a8f8c 
       
      FAULTING_IP: 
      win32k!IntAddSynthesizedFormats+16f [c:\ros\reactos\reactos\win32ss\user\ntuser\clipboard.c @ 327]
      f25757cf 8b5104          mov     edx,dword ptr [ecx+4]
       
      MM_INTERNAL_CODE:  0
       
      IMAGE_NAME:  win32k.sys
       
      DEBUG_FLR_IMAGE_TIMESTAMP:  593bba37
       
      MODULE_NAME: win32k
       
      FAULTING_MODULE: f2536000 win32k
       
      DEFAULT_BUCKET_ID:  DRIVER_FAULT
       
      BUGCHECK_STR:  0xD5
       
      PROCESS_NAME:  user32_winetest
       
      CURRENT_IRQL:  1
       
      TRAP_FRAME:  00000010 -- (.trap 0x10)
      Unable to read trap frame at 00000010
       
      LAST_CONTROL_TRANSFER:  from 8049ae58 to 8055d2c8
       
      STACK_TEXT:  
      f20175e4 8049ae58 00000003 f20179d4 ffdff408 nt!RtlpBreakWithStatusInstruction
      f2017614 8049a0da 00000003 f2017b9c f2017a18 nt!KiBugCheckDebugBreak+0x38 [c:\ros\reactos\reactos\ntoskrnl\ke\bug.c @ 538]
      f20179dc 80499970 00000050 f69a8f8c 00000000 nt!KeBugCheckWithTf+0x6aa [c:\ros\reactos\reactos\ntoskrnl\ke\bug.c @ 1101]
      f20179fc 804c34bf 00000050 f69a8f8c 00000000 nt!KeBugCheckEx+0x20 [c:\ros\reactos\reactos\ntoskrnl\ke\bug.c @ 1462]
      f2017b9c 804eb762 00000000 f69a8f8c 00000000 nt!MmArmAccessFault+0x85f [c:\ros\reactos\reactos\ntoskrnl\mm\arm3\pagfault.c @ 2001]
      f2017bc0 8053b5db 00000000 f69a8f8c 00000000 nt!MmAccessFault+0xf2 [c:\ros\reactos\reactos\ntoskrnl\mm\mmfault.c @ 251]
      f2017c38 804036ff f2017ce0 f25757cf badb0d00 nt!KiTrap0EHandler+0x31b [c:\ros\reactos\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1342]
      f2017c38 f25757cf f2017ce0 f25757cf badb0d00 nt!KiTrap0E+0x8f
      f2017ce0 f2576d94 b4b15688 0012fc00 b4b15688 win32k!IntAddSynthesizedFormats+0x16f [c:\ros\reactos\reactos\win32ss\user\ntuser\clipboard.c @ 327]
      f2017cf8 f2575d17 cccccccc f2017d14 8053c5bb win32k!UserCloseClipboard+0x84 [c:\ros\reactos\reactos\win32ss\user\ntuser\clipboard.c @ 541]
      f2017d04 8053c5bb f2017d5c 0012fe1c f2017d5c win32k!NtUserCloseClipboard+0x17 [c:\ros\reactos\reactos\win32ss\user\ntuser\clipboard.c @ 563]
      f2017d14 8053a4db f2575d00 0012fc00 00000000 nt!KiSystemCallTrampoline+0x1b [c:\ros\reactos\reactos\ntoskrnl\include\internal\i386\ke.h @ 748]
      f2017d5c 80403e23 0012fd68 7c92f93e badb0d00 nt!KiSystemServiceHandler+0x24b [c:\ros\reactos\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1815]
      f2017d5c 7c92f93e 0012fd68 7c92f93e badb0d00 nt!KiFastCallEntry+0x8c
      0012fbf4 7c564a68 00414d4b 0012fdf8 cccccccc ntdll!KiFastSystemCallRet
      0012fbf8 00414d4b 0012fdf8 cccccccc cccccccc user32!ZwUserCloseClipboard+0xc
      0012fd68 00412ef4 00020022 0012fecc cccccccc user32_winetest!test_handles+0x11cb [c:\ros\reactos\reactos\modules\rostests\winetests\user32\clipboard.c @ 1769]
      0012fdf8 0040ef88 7c4f0000 00000002 cccccccc user32_winetest!test_data_handles+0xa4 [c:\ros\reactos\reactos\modules\rostests\winetests\user32\clipboard.c @ 2083]
      0012fe14 0052265b 0012fe3c cccccccc cccccccc user32_winetest!func_clipboard+0x268 [c:\ros\reactos\reactos\modules\rostests\winetests\user32\clipboard.c @ 2481]
      0012fe30 0052252a 00133830 0012ffb4 0012fee0 user32_winetest!run_test+0xab [c:\ros\reactos\reactos\sdk\include\reactos\wine\test.h @ 692]
      0012fecc 00524e7a 00000002 001337e8 00131640 user32_winetest!main+0x1ca [c:\ros\reactos\reactos\sdk\include\reactos\wine\test.h @ 748]
      0012ffb4 00524af8 000000ff 0012fff0 7c773a44 user32_winetest!__tmainCRTStartup+0x2ba [c:\ros\reactos\reactos\sdk\lib\crt\startup\crtexe.c @ 311]
      0012ffc0 7c773a44 00000000 00000000 7ffd6000 user32_winetest!WinMainCRTStartup+0x28 [c:\ros\reactos\reactos\sdk\lib\crt\startup\crtexe.c @ 168]
      0012fff0 00000000 00524ad0 00000000 ec0100ed kernel32!BaseProcessStartup+0x54 [c:\ros\reactos\reactos\dll\win32\kernel32\client\proc.c @ 478]
       
       
      STACK_COMMAND:  kb
       
      FOLLOWUP_IP: 
      win32k!IntAddSynthesizedFormats+16f [c:\ros\reactos\reactos\win32ss\user\ntuser\clipboard.c @ 327]
      f25757cf 8b5104          mov     edx,dword ptr [ecx+4]
       
      FAULTING_SOURCE_CODE:  
         323: 
         324:     /* Note: We need to render the DIB or DIBV5 format as soon as possible
         325:        because pallette information may change */
         326:     if (!pDibEl && pBmEl)
      >  327:         IntSynthesizeDib(pWinStaObj, pBmEl->hData);
         328: }
         329: 
         330: VOID NTAPI
         331: UserEmptyClipboardData(PWINSTATION_OBJECT pWinSta)
         332: {
       
       
      SYMBOL_STACK_INDEX:  8
       
      SYMBOL_NAME:  win32k!IntAddSynthesizedFormats+16f
       
      FOLLOWUP_NAME:  MachineOwner
       
      FAILURE_BUCKET_ID:  0xD5_win32k!IntAddSynthesizedFormats+16f
       
      BUCKET_ID:  0xD5_win32k!IntAddSynthesizedFormats+16f
       
      Followup: MachineOwner
      ---------
       
      kd> kp
      ChildEBP RetAddr  
      f20175e4 8049ae58 nt!RtlpBreakWithStatusInstruction
      f2017614 8049a0da nt!KiBugCheckDebugBreak(unsigned long StatusCode = 3)+0x38 [c:\ros\reactos\reactos\ntoskrnl\ke\bug.c @ 538]
      f20179dc 80499970 nt!KeBugCheckWithTf(unsigned long BugCheckCode = 0x50, unsigned long BugCheckParameter1 = 0xf69a8f8c, unsigned long BugCheckParameter2 = 0, unsigned long BugCheckParameter3 = 0xf2017c40, unsigned long BugCheckParameter4 = 0, struct _KTRAP_FRAME * TrapFrame = 0xf2017c40)+0x6aa [c:\ros\reactos\reactos\ntoskrnl\ke\bug.c @ 1101]
      f20179fc 804c34bf nt!KeBugCheckEx(unsigned long BugCheckCode = 0x50, unsigned long BugCheckParameter1 = 0xf69a8f8c, unsigned long BugCheckParameter2 = 0, unsigned long BugCheckParameter3 = 0xf2017c40, unsigned long BugCheckParameter4 = 0)+0x20 [c:\ros\reactos\reactos\ntoskrnl\ke\bug.c @ 1462]
      f2017b9c 804eb762 nt!MmArmAccessFault(unsigned char StoreInstruction = 0x00 '', void * Address = 0xf69a8f8c, char Mode = 0n0 '', void * TrapInformation = 0xf2017c40)+0x85f [c:\ros\reactos\reactos\ntoskrnl\mm\arm3\pagfault.c @ 2001]
      f2017bc0 8053b5db nt!MmAccessFault(unsigned char StoreInstruction = 0x00 '', void * Address = 0xf69a8f8c, char Mode = 0n0 '', void * TrapInformation = 0xf2017c40)+0xf2 [c:\ros\reactos\reactos\ntoskrnl\mm\mmfault.c @ 251]
      f2017c38 804036ff nt!KiTrap0EHandler(struct _KTRAP_FRAME * TrapFrame = 0xf2017c40)+0x31b [c:\ros\reactos\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1342]
      f2017c38 f25757cf nt!KiTrap0E+0x8f
      f2017ce0 f2576d94 win32k!IntAddSynthesizedFormats(struct _WINSTATION_OBJECT * pWinStaObj = 0xb4b15688)+0x16f [c:\ros\reactos\reactos\win32ss\user\ntuser\clipboard.c @ 327]
      f2017cf8 f2575d17 win32k!UserCloseClipboard(void)+0x84 [c:\ros\reactos\reactos\win32ss\user\ntuser\clipboard.c @ 541]
      f2017d04 8053c5bb win32k!NtUserCloseClipboard(void)+0x17 [c:\ros\reactos\reactos\win32ss\user\ntuser\clipboard.c @ 563]
      f2017d14 8053a4db nt!KiSystemCallTrampoline(void * Handler = 0xf2575d00, void * Arguments = 0x0012fc00, unsigned long StackBytes = 0)+0x1b [c:\ros\reactos\reactos\ntoskrnl\include\internal\i386\ke.h @ 748]
      f2017d5c 80403e23 nt!KiSystemServiceHandler(struct _KTRAP_FRAME * TrapFrame = 0xf2017d64, void * Arguments = 0x0012fc00)+0x24b [c:\ros\reactos\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1815]
      f2017d5c 7c92f93e nt!KiFastCallEntry+0x8c
      0012fbf4 7c564a68 ntdll!KiFastSystemCallRet
      0012fbf8 00414d4b user32!ZwUserCloseClipboard+0xc
      0012fd68 00412ef4 user32_winetest!test_handles(struct HWND__ * hwnd = 0x00020022)+0x11cb [c:\ros\reactos\reactos\modules\rostests\winetests\user32\clipboard.c @ 1769]
      0012fdf8 0040ef88 user32_winetest!test_data_handles(void)+0xa4 [c:\ros\reactos\reactos\modules\rostests\winetests\user32\clipboard.c @ 2083]
      0012fe14 0052265b user32_winetest!func_clipboard(void)+0x268 [c:\ros\reactos\reactos\modules\rostests\winetests\user32\clipboard.c @ 2481]
      0012fe30 0052252a user32_winetest!run_test(char * name = 0x00133830 "clipboard")+0xab [c:\ros\reactos\reactos\sdk\include\reactos\wine\test.h @ 692]
      0012fecc 00524e7a user32_winetest!main(int argc = 0n2, char ** argv = 0x001337e8)+0x1ca [c:\ros\reactos\reactos\sdk\include\reactos\wine\test.h @ 748]
      0012ffb4 00524af8 user32_winetest!__tmainCRTStartup(void)+0x2ba [c:\ros\reactos\reactos\sdk\lib\crt\startup\crtexe.c @ 311]
      0012ffc0 7c773a44 user32_winetest!WinMainCRTStartup(void)+0x28 [c:\ros\reactos\reactos\sdk\lib\crt\startup\crtexe.c @ 168]
      0012fff0 00000000 kernel32!BaseProcessStartup(<function> * lpStartAddress = 0x00524ad0)+0x54 [c:\ros\reactos\reactos\dll\win32\kernel32\client\proc.c @ 478]

      preston has already analyzed this in CORE-10380 and provided kamil-clipboard.c.patch

      Attachments

        1. kamil-clipboard.c.patch
          5 kB
          ThFabba
        2. ntuser-clipboard-useafterfree.patch
          8 kB
          ThFabba
        3. ntuser-clipboard-useafterfree.patch
          13 kB
          ThFabba
        4. ntuser-clipboard-useafterfree.patch
          13 kB
          ThFabba
        5. ntuser-clipboard-useafterfree.patch
          7 kB
          ThFabba
        6. ntuser-clipboard-useafterfree.patch
          6 kB
          ThFabba

        Issue Links

          Activity

            People

              ThFabba ThFabba
              ThFabba ThFabba
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: