257627 - GetPrintDriverSize () returns pointer to stack variable and causes Laserjet trap

Status: RESOLVED FIXED

(Core Graveyard :: GFX: OS/2, defect)

Description

[Dainis Jonitis]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040614 Firefox/0.9
Build Identifier: 

nsDeviceContextSpecOS2::PrnDlg.GetPrintDriverSize returns pointer to automatic
stack variable which after return is already undefined. That garbage is passed
to GreEscape that causes the LaserJet driver to crash.

Reproducible: Always
Steps to Reproduce:
Open printer properties dialog
Actual Results:  
Debug version of Laserjet traps, because instead of buffer size it receives some
random garbage.

Expected Results:  
No traps.

The patch changes the GetPrintDriverSize () to return the ULONG. Caller assigns
the result to local variable and passes the address of this variable to
GreEscape ().

Comment 1

[Dainis Jonitis]

Attachment: diff -d -u -8

Comment 2

[Mike Kaply [:mkaply]]

Comment on attachment 157601 [details] [diff] [review]
diff -d -u -8

Wow. This might be a source of some of our other random traps too. 

Nice find.

Comment 3

[Mike Kaply [:mkaply]]

Fixed in all.