[Mono-bugs] [Bug 417256] New: [Win32] PrintingServicesWin32 accesses free'd memory ( GetPrintDialogInfo)

[bugzilla_noreply at novell.com]

https://bugzilla.novell.com/show_bug.cgi?id=417256


           Summary: [Win32] PrintingServicesWin32 accesses free'd memory
                    (GetPrintDialogInfo)
           Product: Mono: Class Libraries
           Version: 1.9
          Platform: Other
        OS/Version: Windows
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Sys.Drawing.
        AssignedTo: mono-bugs at lists.ximian.com
        ReportedBy: andyhume32 at yahoo.co.uk
         QAContact: mono-bugs at lists.ximian.com
          Found By: ---


Code does
   Win32GetPrinter (hPrn, 2, IntPtr.Zero, 0, ref needed);
   ptr = Marshal.AllocHGlobal (needed);
   Win32GetPrinter (hPrn, 2, ptr, needed, ref needed);
   printer_info = (PRINTER_INFO) Marshal.PtrToStructure (ptr, typeof
(PRINTER_INFO));
   Marshal.FreeHGlobal (ptr);

   port = Marshal.PtrToStringUni (printer_info.pPortName);
   comment  = Marshal.PtrToStringUni (printer_info.pComment);
   ...

The strings are stored in the memory block and therefore aren't accessible
after the free.  The FreeHGlobal call needs to be moved to the end.



Running under a debugger or with strict heap checking makes the fault apparent.
 With Windows full page-heap enabled, the program below terminates as follows.

[[
Stacktrace:

  at (wrapper managed-to-native)
System.Runtime.InteropServices.Marshal.PtrToStringUni (intptr) <0x00004>
  at (wrapper managed-to-native)
System.Runtime.InteropServices.Marshal.PtrToStringUni (intptr) <0xffffffff>
  at System.Drawing.Printing.PrintingServicesWin32.GetPrintDialogInfo
(string,string&,string&,string&,string&) [0x00068] in
C:\cygwin\tmp\monobuild\build\BUILD\mono-1.9\mcs\class\System.Drawing\System.Drawing.Printing\PrintingServicesWin32.cs:377
  at System.Drawing.Printing.SysPrn.GetPrintDialogInfo
(string,string&,string&,string&,string&) [0x00000] in
C:\cygwin\tmp\monobuild\build\BUILD\mono-1.9\mcs\class\System.Drawing\System.Drawing.Printing\PrintingServices.cs:113
  at (wrapper runtime-invoke)
System.Drawing.Printing.SysPrn.runtime_invoke_void_string_string&_string&_string&_string&
(object,intptr,intptr,intptr) <0xffffffff>
  at (wrapper managed-to-native) System.Reflection.MonoMethod.InternalInvoke
(object,object[]) <0x00004>
  at (wrapper managed-to-native) System.Reflection.MonoMethod.InternalInvoke
(object,object[]) <0xffffffff>
  at System.Reflection.MonoMethod.Invoke
(object,System.Reflection.BindingFlags,System.Reflection.Binder,object[],System.Globalization.CultureInfo)
[0x00055] in
C:\cygwin\tmp\monobuild\build\BUILD\mono-1.9\mcs\class\corlib\System.Reflection\MonoMethod.cs:149
  at System.Reflection.MethodBase.Invoke (object,object[]) [0x00000] in
C:\cygwin\tmp\monobuild\build\BUILD\mono-1.9\mcs\class\corlib\System.Reflection\MethodBase.cs:90
  at System.Windows.Forms.PrintDialog.SetPrinterDetails () [0x0006e] in
C:\cygwin\tmp\monobuild\build\BUILD\mono-1.9\mcs\class\Managed.Windows.Forms\System.Windows.Forms\PrintDialog.cs:626
  at System.Windows.Forms.PrintDialog.OnPrinterSelectedIndexChanged
(object,System.EventArgs) [0x00000] in
C:\cygwin\tmp\monobuild\build\BUILD\mono-1.9\mcs\class\Managed.Windows.Forms\System.Windows.Forms\PrintDialog.cs:605
  at System.Windows.Forms.ComboBox.OnSelectedIndexChanged (System.EventArgs)
[0x00023] in
C:\cygwin\tmp\monobuild\build\BUILD\mono-1.9\mcs\class\Managed.Windows.Forms\System.Windows.Forms\ComboBox.cs:1142
  at System.Windows.Forms.ComboBox.set_SelectedIndex (int) [0x000a7] in
C:\cygwin\tmp\monobuild\build\BUILD\mono-1.9\mcs\class\Managed.Windows.Forms\System.Windows.Forms\ComboBox.cs:649
  at System.Windows.Forms.ComboBox.set_SelectedItem (object) [0x0002c] in
C:\cygwin\tmp\monobuild\build\BUILD\mono-1.9\mcs\class\Managed.Windows.Forms\System.Windows.Forms\ComboBox.cs:663
  at (wrapper remoting-invoke-with-check)
System.Windows.Forms.ComboBox.set_SelectedItem (object) <0xffffffff>
  at System.Windows.Forms.PrintDialog.CreateFormControls () [0x008e7] in
C:\cygwin\tmp\monobuild\build\BUILD\mono-1.9\mcs\class\Managed.Windows.Forms\System.Windows.Forms\PrintDialog.cs:575
  at System.Windows.Forms.PrintDialog..ctor () [0x00034] in
C:\cygwin\tmp\monobuild\build\BUILD\mono-1.9\mcs\class\Managed.Windows.Forms\System.Windows.Forms\PrintDialog.cs:90
  at (wrapper remoting-invoke-with-check)
System.Windows.Forms.PrintDialog..ctor () <0xffffffff>
  at PrintDialog1.Main () <0x0001b>
  at (wrapper runtime-invoke) PrintDialog1.runtime_invoke_void
(object,intptr,intptr,intptr) <0xffffffff>

This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
]]

[[
using System;
using System.Windows.Forms;


class PrintDialog1 {
    [STAThread]
    static void Main()
    {
        PrintDialog dlg = new PrintDialog();
    }
}
]]


-- 
Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.