Re: [ros-dev] [ros-diffs] [jgardou] 54179: [WinMM] - avoid buffer overrun. - do not try to unload uninitialized driver. See issue #6343 for more details.

[Timo Kreuzer]

I think that will not unload the last driver.
Looking at MMDRV_Install, MMDrvsHi is the index of the first free array 
field and its incremented each time MMDRV_Install is called. The assert 
in line 465 is wrong. It should be "<". The for () loop in line 432 is 
also wrong
Your change starts with MMDrvsHi - 1, the last used index, then 
decrements i by one before doing anything else.



Am 17.10.2011 18:35, schrieb jgardou(a)svn.reactos.org:
>   Author: jgardou
>  Date: Mon Oct 17 16:35:10 2011
>  New Revision: 54179
>
>  URL: http://svn.reactos.org/svn/reactos?rev=54179&view=rev
>  Log:
>  [WinMM]
>  - avoid buffer overrun.
>  - do not try to unload uninitialized driver.
>  See issue #6343 for more details.
>
>  Modified:
>       trunk/reactos/dll/win32/winmm/lolvldrv.c
>
>  Modified: trunk/reactos/dll/win32/winmm/lolvldrv.c
>  URL:
> http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/winmm/lolvldrv.c…
>  ==============================================================================
>  --- trunk/reactos/dll/win32/winmm/lolvldrv.c [iso-8859-1] (original)
>  +++ trunk/reactos/dll/win32/winmm/lolvldrv.c [iso-8859-1] Mon Oct 17 16:35:10 2011
>  @@ -634,7 +634,7 @@
>        }
>
>        /* unload driver, in reverse order of loading */
>  -    i = sizeof(MMDrvs) / sizeof(MMDrvs[0]);
>  +    i = MMDrvsHi - 1;
>        while (i-->  0)
>        {
>            MMDRV_ExitPerType(&MMDrvs[i], MMDRV_AUX);
>
>
>