[vlc-commits] [Git][videolan/vlc][master] qt: fix NULL-pointer write on posted WM_APPCOMMAND

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch master at VideoLAN / VLC


Commits:
b385ae43 by Karel Polak at 2026-10-04T05:47:16+00:00
qt: fix NULL-pointer write on posted WM_APPCOMMAND

nativeEventFilter() dereferenced result unconditionally in the
WM_APPCOMMAND case. Qt does not guarantee that result is non-NULL:
QEventDispatcherWin32::processEvents() invokes native event filters with
result == 0 for messages taken off the thread message queue, whereas
qt_internal_proc() passes a valid pointer.

Any application delivering WM_APPCOMMAND with PostMessage() instead of
SendMessage() therefore caused a write to address 0x0. Reproduced 6/6 on
3.0.23 (win32 and win64) and 5/5 on 4.0.0-dev; the identical message
delivered with SendMessage pauses correctly.

Keep the handled state in a local and only write through result when it
is non-NULL, since the trailing check read *result as well.

Fixes #30070

Co-Authored-By: Claude Opus 5 <noreply at anthropic.com>

- - - - -


1 changed file:

- modules/gui/qt/maininterface/mainctx_win32.cpp


Changes:

=====================================
modules/gui/qt/maininterface/mainctx_win32.cpp
=====================================
@@ -1013,6 +1013,7 @@ bool InterfaceWindowHandlerWin32::eventFilter(QObject* obj, QEvent* ev)
     MSG* msg = static_cast<MSG*>( message );
 
     short cmd;
+    bool handled = false;
     switch( msg->message )
     {
         case WM_APPCOMMAND:
@@ -1026,7 +1027,7 @@ bool InterfaceWindowHandlerWin32::eventFilter(QObject* obj, QEvent* ev)
                 break;
             }
 
-            *result = TRUE;
+            handled = true;
 
             switch(cmd)
             {
@@ -1076,10 +1077,13 @@ bool InterfaceWindowHandlerWin32::eventFilter(QObject* obj, QEvent* ev)
                     break;
                 default:
                      msg_Dbg( p_intf, "unknown APPCOMMAND = %d", cmd);
-                     *result = FALSE;
+                     handled = false;
                      break;
             }
-            if (*result) return true;
+            if( result )
+                *result = handled ? TRUE : FALSE;
+            if( handled )
+                return true;
             break;
     }
     return false;



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/b385ae43047e06164ed1afc59ce705f2efe38786

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/b385ae43047e06164ed1afc59ce705f2efe38786
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help