Stop crashing hh.exe when passing strings to MSHTML - #9052
Merged
Conversation
… sure to pass in the attribute name as a bstr as the COM method expects, otherwise the document host process can crash.
feerrenrut
approved these changes
Dec 12, 2018
| // #8976: the string in the following macro must be passed to the COM method as a BSTR | ||
| // otherwise the COM marshaller will try and read the BSTR length and hit either inaccessible memory or get back junk. | ||
| // This is seen in optimized builds of NVDA when accessing some CHM files in hh.exe. | ||
| #define macro_addHTMLAttributeToMap(attribName,allowEmpty,attribsObj,attribsMap,tempVar,tempAttrObj) {\ |
Contributor
There was a problem hiding this comment.
I guess this has probably been a macro for a while. I'd be quite tempted to turn it into a regular function, the benefits of doing so is to make them more easy to debug, and to get rid of the backslashes.
| // This is seen in optimized builds of NVDA when accessing some CHM files in hh.exe. | ||
| #define macro_addHTMLAttributeToMap(attribName,allowEmpty,attribsObj,attribsMap,tempVar,tempAttrObj) {\ | ||
| attribsObj->getNamedItem(attribName,&tempAttrObj);\ | ||
| attribsObj->getNamedItem(CComBSTR(attribName),&tempAttrObj);\ |
Contributor
There was a problem hiding this comment.
Is there anything we can do to look for other places this bug might exist?
Collaborator
|
This pr is filed against master. I also found out that the rc branch still seems to be at 2018.3.2. I think that the rc branch has to be updated based on the 2018.4-rc1 tag, and then we can switch branches for this pr. |
Member
Author
|
Ah yes, now it is rc :)
And rc is now pointing at rc1.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aiming for 2018.4rc2 as this is a crash.
Link to issue number:
Closes #8976
Summary of the issue:
Similar to issue #8759 where Firefox was crashing when passing a string literal to a COM method, hh.exe when opening particular chm files would also crash.
Again, we are passing a string literal to a COM method, this time in the MSHTML vbufBackend.
Passing a string literal in place of a bstr is bad as the COM marshaller tries to look for the bstr prefix containing the length, and either causes a memory violation or finds junk.
This only however seems to cause a crash in optimized builds of NVDA, and only with very recent versions of Visual Studio 2017, as this particular crash has not been seen before beta1 of 2018.4.
Description of how this pull request fixes the issue:
Similar to pr #8767, the string literal is first converted to a BSTR before passing to the COM method.
This PR also adds a rule to the appveyor config that allows us us to build optimized try builds when a branch name starts with try-release-. This change made it easier to test this fix.
Testing performed:
While running an optimized try build for this pr, opened the chm in issue #8759 and it did not crash.
Also opened several pages in Internet Explorer to ensure that generally NVDA was still getting all required information from MSHTML.
Try build has been provided on the issue, awaiting testing by original reporter.
Known issues with pull request:
None.
Change log entry:
None.