[Bug 25691] New: ImageList_Duplicate doesn't correctly duplicate full length of has_alpha byte array
http://bugs.winehq.org/show_bug.cgi?id=25691 Summary: ImageList_Duplicate doesn't correctly duplicate full length of has_alpha byte array Product: Wine Version: unspecified Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: comctl32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: rmcdonald(a)bittorrent.com In the case where an image list is created, then expanded enough so that the byte array pointed at by the has_alpha member has been reallocated to a larger size (and cMaxImage is larger), if that image list is duplicated, the duplicate will have a has_alpha member that is shorter than the expected length. Where ImageList_Create assigns: himl->cMaxImage = cInitial + 1; and then ensures the length of the has_alpha byte array is at least cMaxImage bytes long, ImageList_Duplicate assigns to the duplicate: himlDst->cMaxImage = himlSrc->cMaxImage; which throws off the internal checks that assume the length of the has_alpha member is at least as long as cMaxImage says. This results in heap corruption when the following line in add_with_alpha() is executed under the right conditions: himl->has_alpha[pos + n] = 1; I worked around the bug by making the following changes to dlls/comctl32/imagelist.c: *** 1519,1524 **** --- 1519,1537 ---- himlSrc->hdcMask, 0, 0, SRCCOPY); himlDst->cCurImage = himlSrc->cCurImage; + if (himlSrc->has_alpha && himlDst->has_alpha + && himlSrc->cMaxImage > himlDst->cMaxImage) + { + /* ImageList_Create didn't create a long enough new_alpha */ + char *new_alpha = HeapReAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, + himlDst->has_alpha, himlSrc->cMaxImage ); + if (new_alpha) himlDst->has_alpha = new_alpha; + else + { + HeapFree( GetProcessHeap(), 0, himlDst->has_alpha ); + himlDst->has_alpha = NULL; + } + } himlDst->cMaxImage = himlSrc->cMaxImage; if (himlSrc->has_alpha && himlDst->has_alpha) memcpy( himlDst->has_alpha, himlSrc->has_alpha, himlDst->cCurImage ); I built Wine 1.2.2 from source (./configure; make; sudo make install), and then applied the changes the same way and retested. Looks like the 1.3 and development lines have the same issue. I don't know if this patch is efficient enough for me to submit it (nicer if ImageList_Create would accept cMaxImage as a parameter so it could create the byte array with the correct length to save an allocation, but that's a bigger change). -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=25691 Dan Kegel <dank(a)kegel.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dank(a)kegel.com --- Comment #1 from Dan Kegel <dank(a)kegel.com> 2011-01-07 19:11:23 CST --- It would be nice to have a test case for this in dlls/comctl32/tests/imagelist.c. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=25691 --- Comment #2 from Nikolay Sivov <bunglehead(a)gmail.com> 2011-01-26 17:30:25 CST --- I think this is fixed, right? See http://source.winehq.org/git/wine.git/?a=commit;h=cca319d5943ca01a564335473a... -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=25691 --- Comment #3 from Robert McDonald <rmcdonald(a)bittorrent.com> 2011-01-26 18:44:51 CST --- (In reply to comment #2)
I think this is fixed, right?
See http://source.winehq.org/git/wine.git/?a=commit;h=cca319d5943ca01a564335473a...
I applied that change made on 20110110 in place of my change in my development tree, rebuilt and reinstalled, and the program behaved correctly. Its resolution got reported in the announcement for 1.3.12 at http://www.winehq.org/announce/1.3.12: ... Alexandre Julliard (72): ... comctl32/imagelist: Don't change destination size in ImageList_Duplicate without corresponding allocation. ... Now for the fix to show up in Wine 1.2.3. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=25691 Austin English <austinenglish(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution| |FIXED Target Milestone|--- |1.2.x --- Comment #4 from Austin English <austinenglish(a)gmail.com> 2011-01-26 18:56:24 CST --- Fixed then. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=25691 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #5 from Alexandre Julliard <julliard(a)winehq.org> 2011-02-04 13:21:08 CST --- Closing bugs fixed in 1.3.13. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=25691 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|1.2.x |--- -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=25691 Nikolay Sivov <bunglehead(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |cca319d5943ca01a564335473a9 | |ac3ee949d342d -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
wine-bugs＠winehq.org