[Bug 37129] New: Clang Static Analyzer: Buffer overflow

https://bugs.winehq.org/show_bug.cgi?id=37129

            Bug ID: 37129
           Summary: Clang Static Analyzer: Buffer overflow
           Product: Wine
           Version: 1.7.22
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
          Assignee: wine-bugs(a)winehq.org
          Reporter: lukebenes(a)hotmail.com

Clang Static Analyzer identifies a possible buffer overflow

File: tools/widl/typegen.c

Location: line 1158, column 28

Description: String copy function overflows destination buffer

static unsigned int write_new_procformatstring_type(...)
{
  char buffer[64];
  ...
  strcpy( buffer, "/* flags:" );
  if (flags & MustSize) strcat( buffer, " must size," );
  if (flags & MustFree) strcat( buffer, " must free," );
  if (flags & IsPipe) strcat( buffer, " pipe," );
  if (flags & IsIn) strcat( buffer, " in," );
  if (flags & IsOut) strcat( buffer, " out," );
  if (flags & IsReturn) strcat( buffer, " return," );
  if (flags & IsBasetype) strcat( buffer, " base type," );
  if (flags & IsByValue) strcat( buffer, " by value," );
  if (flags & IsSimpleRef) strcat( buffer, " simple ref," );
  ...
}

Even if not all the conditions are true, you still risk getting a too lengthy
string that won't suit the buffer.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 37129] Clang Static Analyzer: Buffer overflow

https://bugs.winehq.org/show_bug.cgi?id=37129

Nikolay Sivov <bunglehead(a)gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|-unknown                    |tools

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 37129] Clang Static Analyzer: Buffer overflow

https://bugs.winehq.org/show_bug.cgi?id=37129

Sebastian Lackner <sebastian(a)fds-team.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|                            |abf4d5910fc69fe193e541aa016
                   |                            |3dc76eb5a9def
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |sebastian(a)fds-team.de
         Resolution|---                         |FIXED

--- Comment #1 from Sebastian Lackner <sebastian(a)fds-team.de> ---
This should be fixed by
http://source.winehq.org/git/wine.git/commit/abf4d5910fc69fe193e541aa0163dc7...

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 37129] Clang Static Analyzer: Buffer overflow

https://bugs.winehq.org/show_bug.cgi?id=37129

Alexandre Julliard <julliard(a)winehq.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #2 from Alexandre Julliard <julliard(a)winehq.org> ---
Closing bugs fixed in 1.7.48.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.