WMF SETABORTPROC issue - does it affect WineX?
Bryan Kadzban <[email protected]> Sat, 14 Jan 2006 09:24:04 -0500
| Newsgroups | gmane.comp.emulators.winex.devel |
|---|---|
| Message-ID | <[email protected]> |
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig05BCBDCA87BD70E4532B0EE3
Content-Type: multipart/mixed; boundary="------------000105070007080809010509"
This is a multi-part message in MIME format.
--------------000105070007080809010509
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
As I understand it, the attached patch is basically how Microsoft fixed
the recent WMF issue (MS06-001) [1]. It doesn't appear to be fixed in
WineX CVS, although some distros have updated Wine to fix a similar
issue [2].
I assume WineX is vulnerable to something similar, since the Escape()
handler in graphics/escape.c does in fact call SetAbortProc() when it
sees a SETABORTPROC escape. Should the attached patch be applied?
[1] http://isc.sans.org/diary.php?storyid=1020
[2] http://secunia.com/advisories/18323/
--------------000105070007080809010509
Content-Type: text/plain;
name="winex-abortproc.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="winex-abortproc.patch"
Index: graphics/escape.c
===================================================================
RCS file: /cvsroot/winex/graphics/escape.c,v
retrieving revision 1.3
diff -u -r1.3 escape.c
--- graphics/escape.c 18 Feb 2004 22:27:48 -0000 1.3
+++ graphics/escape.c 14 Jan 2006 13:13:41 -0000
@@ -102,8 +102,8 @@
}
/* Escape(hdc,SETABORTPROC,ABORTPROC,NULL); */
- case SETABORTPROC:
- return SetAbortProc16( hdc, (ABORTPROC16)in_data );
+/* case SETABORTPROC:
+ return SetAbortProc16( hdc, (ABORTPROC16)in_data );*/
/* Escape(hdc,STARTDOC,LPSTR,LPDOCINFO16);
* lpvOutData is actually a pointer to the DocInfo structure and used as
@@ -252,8 +252,8 @@
case NEWFRAME:
return EndPage( hdc );
- case SETABORTPROC:
- return SetAbortProc( hdc, (ABORTPROC)in_data );
+/* case SETABORTPROC:
+ return SetAbortProc( hdc, (ABORTPROC)in_data );*/
case STARTDOC:
{
--------------000105070007080809010509--
--------------enig05BCBDCA87BD70E4532B0EE3
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFDyQmOi5mq6LtIi44RA4ivAJ4xhHr7LCdLOgxoK+DX/O4tx0U3+gCfcTag
CB/DqKSldqYWlVJyqKBH2UE=
=ovJb
-----END PGP SIGNATURE-----
--------------enig05BCBDCA87BD70E4532B0EE3--