From 6c0659ceacb066a9bedfe1559cc10efdb99ead43 Mon Sep 17 00:00:00 2001 From: Thomas Faber Date: Wed, 16 Nov 2011 21:17:38 +0000 Subject: [PATCH] [ATL] - Fix buffer overflow in CComDynamicUnkArray::Add. Found by Coverity (CID 2474) [NDK] - Remove meaningless const attribute from pointer rvalues to make Coverity's life easier svn path=/trunk/; revision=54401 --- reactos/include/ndk/i386/ketypes.h | 4 ++-- reactos/include/ndk/ketypes.h | 2 +- reactos/lib/atl/atlcom.h | 5 +++-- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/reactos/include/ndk/i386/ketypes.h b/reactos/include/ndk/i386/ketypes.h index 7f6205ed7bd..5845a73ffe2 100644 --- a/reactos/include/ndk/i386/ketypes.h +++ b/reactos/include/ndk/i386/ketypes.h @@ -27,10 +27,10 @@ Author: // KPCR Access for non-IA64 builds // #define K0IPCR ((ULONG_PTR)(KIP0PCRADDRESS)) -#define PCR ((KPCR * const)K0IPCR) +#define PCR ((KPCR *)K0IPCR) #if defined(CONFIG_SMP) || defined(NT_BUILD) #undef KeGetPcr -#define KeGetPcr() ((KPCR * const)__readfsdword(FIELD_OFFSET(KPCR, SelfPcr))) +#define KeGetPcr() ((KPCR *)__readfsdword(FIELD_OFFSET(KPCR, SelfPcr))) #endif // diff --git a/reactos/include/ndk/ketypes.h b/reactos/include/ndk/ketypes.h index 213943db31f..cae815b6d2d 100644 --- a/reactos/include/ndk/ketypes.h +++ b/reactos/include/ndk/ketypes.h @@ -128,7 +128,7 @@ typedef CCHAR KPROCESSOR_MODE; // // Dereferencable pointer to KUSER_SHARED_DATA in User-Mode // -#define SharedUserData ((KUSER_SHARED_DATA *CONST)USER_SHARED_DATA) +#define SharedUserData ((KUSER_SHARED_DATA *)USER_SHARED_DATA) // // Maximum WOW64 Entries in KUSER_SHARED_DATA diff --git a/reactos/lib/atl/atlcom.h b/reactos/lib/atl/atlcom.h index f4a13e5540c..b787ec6d8a7 100644 --- a/reactos/lib/atl/atlcom.h +++ b/reactos/lib/atl/atlcom.h @@ -849,9 +849,10 @@ public: return 0; m_ppUnk = newArray; memset(&m_ppUnk[m_nSize], 0, (newSize - m_nSize) * sizeof(IUnknown *)); + curCookie = m_nSize + 1; m_nSize = newSize; - m_ppUnk[m_nSize] = pUnk; - return m_nSize + 1; + m_ppUnk[curCookie - 1] = pUnk; + return curCookie; } BOOL Remove(DWORD dwCookie)