Bug 513075 - [Win32][DND] Clear some private event fields to hinder

misuse

Some clients may stash away the event object to later request the
dropped data. Such attempt is likely to crash the JVM since the pointer
used to access the data are invalid after the drop is finished.

Change-Id: I1d007b772a8178dfdf19dd54c6bbb2ba2259d25d
Signed-off-by: Paul Pazderski <paul-eclipse@ppazderski.de>

1 files changed, 27 insertions, 1 deletions

diff --git a/bundles/org.eclipse.swt/Eclipse SWT Drag and Drop/win32/org/eclipse/swt/dnd/DropTarget.java b/bundles/org.eclipse.swt/Eclipse SWT Drag and Drop/win32/org/eclipse/swt/dnd/DropTarget.java
index 38fae8ec95..023ea36699 100644
--- a/bundles/org.eclipse.swt/Eclipse SWT Drag and Drop/win32/org/eclipse/swt/dnd/DropTarget.java
+++ b/bundles/org.eclipse.swt/Eclipse SWT Drag and Drop/win32/org/eclipse/swt/dnd/DropTarget.java
@@ -320,6 +320,8 @@ int DragEnter(long pDataObject, int grfKeyState, int pt_x, int pt_y, long pdwEff
 		selectedOperation = event.detail;
 	}
 
+	clearEventData(event);
+
 	OS.MoveMemory(pdwEffect, new int[] {opToOs(selectedOperation)}, 4);
 	return COM.S_OK;
 }
@@ -391,6 +393,8 @@ int DragOver(int grfKeyState, int pt_x, int pt_y, long pdwEffect) {
 		selectedOperation = event.detail;
 	}
 
+	clearEventData(event);
+
 	OS.MoveMemory(pdwEffect, new int[] {opToOs(selectedOperation)}, 4);
 	return COM.S_OK;
 }
@@ -402,10 +406,10 @@ int Drop_64(long pDataObject, int grfKeyState, long pt, long pdwEffect) {
 }
 
 int Drop(long pDataObject, int grfKeyState, int pt_x, int pt_y, long pdwEffect) {
+	DNDEvent event = new DNDEvent();
 	try {
 		pt_x = DPIUtil.autoScaleDown(pt_x);// To Points
 		pt_y = DPIUtil.autoScaleDown(pt_y);// To Points
-		DNDEvent event = new DNDEvent();
 		event.widget = this;
 		event.time = OS.GetMessageTime();
 		if (dropEffect != null) {
@@ -481,6 +485,7 @@ int Drop(long pDataObject, int grfKeyState, int pt_x, int pt_y, long pdwEffect)
 			iDataObject.Release();
 			iDataObject = null;
 		}
+		clearEventData(event);
 	}
 }
 
@@ -786,6 +791,27 @@ boolean setEventData(DNDEvent event, long pDataObject, int grfKeyState, int pt_x
 }
 
 /**
+ * Null some of the event fields. This is done to hinder misuse as in Bug 513075.
+ *
+ * @param event the event to clear
+ */
+private void clearEventData(DNDEvent event) {
+	if (event == null) return;
+	if (event.dataType != null) {
+		event.dataType.pIDataObject = 0;
+		event.dataType.stgmedium = null;
+	}
+	if (event.dataTypes != null) {
+		for (TransferData dataType : event.dataTypes) {
+			if (dataType != null) {
+				dataType.pIDataObject = 0;
+				dataType.stgmedium = null;
+			}
+		}
+	}
+}
+
+/**
  * Specifies the data types that can be transferred to this DropTarget.  If data is
  * being dragged that does not match one of these types, the drop target will be notified of
  * the drag and drop operation but the currentDataType will be null and the operation