[Bug 45254] New: Buffer overflow, X file children MAX_CHILDREN limit too small, crashes BIONICLE: The Legend of Mata Nui
https://bugs.winehq.org/show_bug.cgi?id=45254 Bug ID: 45254 Summary: Buffer overflow, X file children MAX_CHILDREN limit too small, crashes BIONICLE: The Legend of Mata Nui Product: Wine Version: unspecified Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: directx-d3dxof Assignee: wine-bugs(a)winehq.org Reporter: legojrmastermodelbuilder(a)gmail.com Distribution: --- In dlls/d3dxof/d3dxof_private.h MAX_CHILDREN is defined as 200, which is too small a buffer for some existing DirectX model .X files: https://github.com/wine-mirror/wine/blob/4102d8a0dc1b02d37d834f17d1925f3b0de... In dlls/d3dxof/parsing.c there is actually a warning if that number is exceeded, but the bounds checking happens after the buffer would be overflown, so it may read the wrong value or simply crash instead: https://github.com/wine-mirror/wine/blob/99a5afc09b1e8928a2b3270ce67784083d2... Native Windows does not appear to impose a hard limit, or if there is one it is larger than 0xFFFF (the highest size I tested). This limitation impacts at least one Windows application, namely the game BIONICLE: The Legend of Mata Nui. This would impact Wine on all platforms. GitHub issue for reference: https://github.com/TheLegendOfMataNui/game-issues/issues/110 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45254 Ken Sharp <imwellcushtymelike(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download Version|unspecified |3.9 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45254 tokktokk <fdsfgs(a)krutt.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fdsfgs(a)krutt.org -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45254 Matteo Bruni <matteo.mystral(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Ever confirmed|0 |1 URL| |http://biomediaproject.com/ | |bmp/the-legend-of-mata-nui/ Status|UNCONFIRMED |NEW --- Comment #1 from Matteo Bruni <matteo.mystral(a)gmail.com> --- Thanks for the bug report, I'm afraid that's probably not the only shortcoming of Wine's d3dxof... -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45254 joaopa <jeremielapuree(a)yahoo.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jeremielapuree(a)yahoo.fr --- Comment #2 from joaopa <jeremielapuree(a)yahoo.fr> --- Bug still occurs with wine-6.20. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (2)
-
wine-bugs＠winehq.org -
WineHQ Bugzilla