From 9e5c4027332d0f604473babc7992ff0740899eb2 Mon Sep 17 00:00:00 2001 From: Carlos Zamora Date: Fri, 17 Apr 2020 14:46:40 -0700 Subject: [PATCH 1/2] UIA: prevent crash from invalid UTR endpoint comparison --- src/types/UiaTextRangeBase.cpp | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/src/types/UiaTextRangeBase.cpp b/src/types/UiaTextRangeBase.cpp index 0752567fb34..1d1588fb0d9 100644 --- a/src/types/UiaTextRangeBase.cpp +++ b/src/types/UiaTextRangeBase.cpp @@ -227,8 +227,17 @@ try // get the values of our endpoint const auto mine = GetEndpoint(endpoint); + // TODO GH#XXXX: associate UTRs with TextBuffers + // This is a temporary solution to comparing two UTRs from different TextBuffers + // Ensure both endpoints fit in the current buffer. + const auto bufferSize = _pData->GetTextBuffer().GetSize(); + if (!bufferSize.IsInBounds(mine, true) || !bufferSize.IsInBounds(other, true)) + { + return E_FAIL; + } + // compare them - *pRetVal = _pData->GetTextBuffer().GetSize().CompareInBounds(mine, other, true); + *pRetVal = bufferSize.CompareInBounds(mine, other, true); UiaTracing::TextRange::CompareEndpoints(*this, endpoint, *range, targetEndpoint, *pRetVal); return S_OK; @@ -652,6 +661,17 @@ try return E_INVALIDARG; } + // TODO GH#XXXX: associate UTRs with TextBuffers + // This is a temporary solution to comparing two UTRs from different TextBuffers + // Ensure both endpoints fit in the current buffer. + const auto bufferSize = _pData->GetTextBuffer().GetSize(); + const auto mine = GetEndpoint(endpoint); + const auto other = range->GetEndpoint(targetEndpoint); + if (!bufferSize.IsInBounds(mine, true) || !bufferSize.IsInBounds(other, true)) + { + return E_FAIL; + } + SetEndpoint(endpoint, range->GetEndpoint(targetEndpoint)); UiaTracing::TextRange::MoveEndpointByRange(endpoint, *range, targetEndpoint, *this); @@ -768,9 +788,6 @@ CATCH_RETURN(); IFACEMETHODIMP UiaTextRangeBase::GetChildren(_Outptr_result_maybenull_ SAFEARRAY** ppRetVal) noexcept { - // TODO GitHub #1914: Re-attach Tracing to UIA Tree - //Tracing::s_TraceUia(this, ApiCall::GetChildren, nullptr); - RETURN_HR_IF(E_INVALIDARG, ppRetVal == nullptr); // we don't have any children From a239c6980aac793c7d3197487a4af77e3546d863 Mon Sep 17 00:00:00 2001 From: Carlos Zamora Date: Mon, 20 Apr 2020 16:20:42 -0700 Subject: [PATCH 2/2] Apply @codeofdusk's suggestions from code review Co-Authored-By: Bill Dengler --- src/types/UiaTextRangeBase.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/types/UiaTextRangeBase.cpp b/src/types/UiaTextRangeBase.cpp index 1d1588fb0d9..b887abb8e68 100644 --- a/src/types/UiaTextRangeBase.cpp +++ b/src/types/UiaTextRangeBase.cpp @@ -227,7 +227,7 @@ try // get the values of our endpoint const auto mine = GetEndpoint(endpoint); - // TODO GH#XXXX: associate UTRs with TextBuffers + // TODO GH#5406: create a different UIA parent object for each TextBuffer // This is a temporary solution to comparing two UTRs from different TextBuffers // Ensure both endpoints fit in the current buffer. const auto bufferSize = _pData->GetTextBuffer().GetSize(); @@ -661,7 +661,7 @@ try return E_INVALIDARG; } - // TODO GH#XXXX: associate UTRs with TextBuffers + // TODO GH#5406: create a different UIA parent object for each TextBuffer // This is a temporary solution to comparing two UTRs from different TextBuffers // Ensure both endpoints fit in the current buffer. const auto bufferSize = _pData->GetTextBuffer().GetSize();