[Bug 10095] New: buffer overflow in RtlGetFullPathName_U

http://bugs.winehq.org/show_bug.cgi?id=10095

           Summary: buffer overflow in RtlGetFullPathName_U
           Product: Wine
           Version: 0.9.47.
          Platform: PC
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P1
         Component: wine-loader
        AssignedTo: wine-bugs(a)winehq.org
        ReportedBy: mbuilov(a)gmail.com


Please review wine/dlls/ntdll/path.c, RtlGetFullPathName_U():


/******************************************************************
 *              RtlGetFullPathName_U  (NTDLL.@)
 *
 * Returns the number of bytes written to buffer (not including the
 * terminating NULL) if the function succeeds, or the required number of bytes
 * (including the terminating NULL) if the buffer is too small.
 *
 * file_part will point to the filename part inside buffer (except if we use
 * DOS device name, in which case file_in_buf is NULL)
 *
 */
DWORD WINAPI RtlGetFullPathName_U(const WCHAR* name, ULONG size, WCHAR* buffer,
                                  WCHAR** file_part)
{
....skipped......
    reqsize = get_full_path_helper(name, buffer, size);
    if (!reqsize) return 0;
    if (reqsize > size)
    {
        LPWSTR tmp = RtlAllocateHeap(GetProcessHeap(), 0, reqsize);
        reqsize = get_full_path_helper(name, tmp, reqsize);
        if (reqsize > size)  /* it may have worked the second time */
        {
            RtlFreeHeap(GetProcessHeap(), 0, tmp);
            return reqsize + sizeof(WCHAR);
        }
        memcpy( buffer, tmp, reqsize + sizeof(WCHAR) );
        RtlFreeHeap(GetProcessHeap(), 0, tmp);
    }


last memcpy() will try to copy (reqsize + sizeof(WCHAR)) bytes into the buffer
of (size) bytes, but here (reqsize) may be equal to (size).


-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

[Bug 10095] buffer overflow in RtlGetFullPathName_U

http://bugs.winehq.org/show_bug.cgi?id=10095





--- Comment #1 from Michael Builov <mbuilov(a)gmail.com>  2007-10-19 05:19:13 ---
Created an attachment (id=8658)
 --> (http://bugs.winehq.org/attachment.cgi?id=8658)
call stack

Here backtrace to failed RtlGetFullPathName_U()


-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

[Bug 10095] buffer overflow in RtlGetFullPathName_U

http://bugs.winehq.org/show_bug.cgi?id=10095


Lei Zhang <thestig(a)google.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |FIXED




--- Comment #2 from Lei Zhang <thestig(a)google.com>  2007-10-19 12:22:39 ---
Fixed in wine-git:

http://source.winehq.org/git/wine.git/?a=commit;h=7475ecac530f81bf66338fa49f...


-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

[Bug 10095] buffer overflow in RtlGetFullPathName_U

http://bugs.winehq.org/show_bug.cgi?id=10095


Dan Kegel <dank(a)kegel.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED




--- Comment #3 from Dan Kegel <dank(a)kegel.com>  2008-01-28 05:40:25 ---
Closing all RESOLVED FIXED bugs older than four weeks.


-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.