WMF SETABORTPROC issue - does it affect WineX?

Bryan Kadzban <[email protected]> Sat, 14 Jan 2006 09:24:04 -0500
Newsgroups gmane.comp.emulators.winex.devel
Message-ID <[email protected]>
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig05BCBDCA87BD70E4532B0EE3
Content-Type: multipart/mixed; boundary="------------000105070007080809010509"

This is a multi-part message in MIME format.
--------------000105070007080809010509
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

As I understand it, the attached patch is basically how Microsoft fixed
the recent WMF issue (MS06-001) [1].  It doesn't appear to be fixed in
WineX CVS, although some distros have updated Wine to fix a similar
issue [2].

I assume WineX is vulnerable to something similar, since the Escape()
handler in graphics/escape.c does in fact call SetAbortProc() when it
sees a SETABORTPROC escape.  Should the attached patch be applied?

[1] http://isc.sans.org/diary.php?storyid=1020
[2] http://secunia.com/advisories/18323/

--------------000105070007080809010509
Content-Type: text/plain;
 name="winex-abortproc.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="winex-abortproc.patch"

Index: graphics/escape.c
===================================================================
RCS file: /cvsroot/winex/graphics/escape.c,v
retrieving revision 1.3
diff -u -r1.3 escape.c
--- graphics/escape.c	18 Feb 2004 22:27:48 -0000	1.3
+++ graphics/escape.c	14 Jan 2006 13:13:41 -0000
@@ -102,8 +102,8 @@
     }
 
     /* Escape(hdc,SETABORTPROC,ABORTPROC,NULL); */
-    case SETABORTPROC:
-        return SetAbortProc16( hdc, (ABORTPROC16)in_data );
+/*    case SETABORTPROC:
+        return SetAbortProc16( hdc, (ABORTPROC16)in_data );*/
 
     /* Escape(hdc,STARTDOC,LPSTR,LPDOCINFO16);
      * lpvOutData is actually a pointer to the DocInfo structure and used as
@@ -252,8 +252,8 @@
     case NEWFRAME:
         return EndPage( hdc );
 
-    case SETABORTPROC:
-        return SetAbortProc( hdc, (ABORTPROC)in_data );
+/*    case SETABORTPROC:
+        return SetAbortProc( hdc, (ABORTPROC)in_data );*/
 
     case STARTDOC:
         {

--------------000105070007080809010509--

--------------enig05BCBDCA87BD70E4532B0EE3
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDyQmOi5mq6LtIi44RA4ivAJ4xhHr7LCdLOgxoK+DX/O4tx0U3+gCfcTag
CB/DqKSldqYWlVJyqKBH2UE=
=ovJb
-----END PGP SIGNATURE-----

--------------enig05BCBDCA87BD70E4532B0EE3--