According to msdn, the size of the MIXERCONTROLDETAILS.paDetails buffer should be:
_For MIXERCONTROL_CONTROLF_MULTIPLE controls, the size of this buffer should be the product of the __cChannels, cMultipleItems and cbDetails__ members of the MIXERCONTROLDETAILS structure. For controls other than MIXERCONTROL_CONTROLF_MULTIPLE types, the size of this buffer is the product of the cChannels and cbDetails members of the MIXERCONTROLDETAILS structure._
But the buffer size is now calculated as: __mixerControlDetails.cbDetails * mixerControlDetails.cChannels__
This will make the mixerGetControlDetails method to write beyond the allocated memory, and thereby corrupting the heap.
Attached is a patch file that will calculate the buffer size correctly.
_For MIXERCONTROL_CONTROLF_MULTIPLE controls, the size of this buffer should be the product of the __cChannels, cMultipleItems and cbDetails__ members of the MIXERCONTROLDETAILS structure. For controls other than MIXERCONTROL_CONTROLF_MULTIPLE types, the size of this buffer is the product of the cChannels and cbDetails members of the MIXERCONTROLDETAILS structure._
But the buffer size is now calculated as: __mixerControlDetails.cbDetails * mixerControlDetails.cChannels__
This will make the mixerGetControlDetails method to write beyond the allocated memory, and thereby corrupting the heap.
Attached is a patch file that will calculate the buffer size correctly.