[Libreoffice-commits] core.git: extensions/source

[Mike Kaganski]

 extensions/source/scanner/scanwin.cxx |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

New commits:
commit 7ea805eb81ce865198cdb0fe418a73f6c353310e
Author: Mike Kaganski <mike.kaganski at collabora.com>
Date:   Fri Dec 22 02:50:50 2017 +0300

    tdf#114635: fix TWAIN on Windows 64 bit
    
    DG_IMAGE / DAT_IMAGENATIVEXFER / MSG_GET is documented [1] to take
    a handle as its pData parameter, but said to be TW_UINT32. The latter
    is false, because it returns a Windows handle to DIB to that parameter,
    and it has 64 bits on 64-bit Windows systems. A crash resulted when
    wrong value attempted to be GlobalLock'd, pBIH was nullptr, and was
    dereferenced.
    
    Also, in some circumstances, duplicate MSG_XFERREADY might arrive
    sequentially; the second one arrives when current state has already
    changed value, and thus TWAIN_EVENT_QUIT used to be sent, resulting
    in mpImpTwain destroyed before TWAIN_EVENT_XFER processed. This had
    lead to absent result of scan.
    
    [1] http://www.twain.org/wp-content/uploads/2016/03/TWAIN-2-Spec.pdf
    
    Change-Id: Ic03fe7681f6003e5fda0c071be181696f9bc866a
    Reviewed-on: https://gerrit.libreoffice.org/46944
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Mike Kaganski <mike.kaganski at collabora.com>

diff --git a/extensions/source/scanner/scanwin.cxx b/extensions/source/scanner/scanwin.cxx
index ef70a9b5adbf..56a45b2dcf73 100644
--- a/extensions/source/scanner/scanwin.cxx
+++ b/extensions/source/scanner/scanwin.cxx
@@ -401,6 +401,12 @@ bool ImpTwain::ImplHandleMsg( void* pMsg )
                     if( mrMgr.GetData() )
                         nEvent = TWAIN_EVENT_XFER;
                 }
+                else if( 7 == nCurState && mrMgr.GetData() )
+                {
+                    // Already sent TWAIN_EVENT_XFER; not processed yet;
+                    // duplicate event - avoid deleting mpImpTwain
+                    nEvent = TWAIN_EVENT_NONE;
+                }
 
                 ImplFallback( nEvent );
             }
@@ -425,7 +431,7 @@ void ImpTwain::ImplXfer()
     if( nCurState == 6 )
     {
         TW_IMAGEINFO    aInfo;
-        TW_UINT32       hDIB = 0;
+        HANDLE          hDIB = 0;
         long            nWidth, nHeight, nXRes, nYRes;
 
         if( PFUNC( &aAppIdent, &aSrcIdent, DG_IMAGE, DAT_IMAGEINFO, MSG_GET, &aInfo ) == TWRC_SUCCESS )
@@ -451,7 +457,7 @@ void ImpTwain::ImplXfer()
                     if( ( nXRes != -1 ) && ( nYRes != - 1 ) && ( nWidth != - 1 ) && ( nHeight != - 1 ) )
                     {
                         // set resolution of bitmap
-                        BITMAPINFOHEADER*   pBIH = static_cast<BITMAPINFOHEADER*>(GlobalLock( reinterpret_cast<HGLOBAL>((sal_IntPtr) hDIB) ));
+                        BITMAPINFOHEADER*   pBIH = static_cast<BITMAPINFOHEADER*>(GlobalLock( static_cast<HGLOBAL>(hDIB) ));
                         static const double fFactor = 100.0 / 2.54;
 
                         pBIH->biXPelsPerMeter = FRound( fFactor * nXRes );