[PATCH 0/1] MR9561: ntdll/tests: Avoid out-of-bounds read in call_virtual_unwind_x86 (ASan).

[Bernhard Übelacker]

In `call_virtual_unwind_x86` in `unwind_size` a size to read 16 bytes is determined.

This patch simply allocates that much bytes in the source variable.

[Testbot run with this patch](https://testbot.winehq.org/JobDetails.pl?Key=161010)

[ASan report in gitlab CI](https://gitlab.winehq.org/bernhardu/wine/-/jobs/210659/viewer#L14266)

<details>
<summary>ASan details</summary>

```
$ wine dlls/ntdll/tests/x86_64-windows/ntdll_test.exe unwind 
=================================================================
==392==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0001402cdf86 at pc 0x6ffffe8cc0eb bp 0x7ffffe1fdbb0 sp 0x7ffffe1fdbf8
READ of size 16 at 0x0001402cdf86 thread T0
    #0 0x6ffffe8cc0ea in __asan_memcpy /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt\lib/asan/asan_interceptors_memintrinsics.cpp:65:3
    #1 0x0001401b02d0 in call_virtual_unwind_x86 .../wine/dlls/ntdll/tests/unwind.c:2730
    #2 0x0001401ad7ab in test_virtual_unwind_x86 .../wine/dlls/ntdll/tests/unwind.c:3371
    #3 0x0001401ad602 in func_unwind .../wine/dlls/ntdll/tests/unwind.c:3767
    #4 0x0001401e4242 in run_test .../wine/include/wine/test.h:780
    #5 0x0001401e3c4b in main .../wine/include/wine/test.h:900
    #6 0x0001401e5eda in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:62
    #7 0x6fffffc67a54 in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x178027a54)
    #8 0x6fffffde06d6 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x1700506d6)

0x0001402cdf86 is located 26 bytes before global variable 'test_virtual_unwind_x86.results_6_epilogue' defined in '.../wine/dlls/ntdll/tests/unwind.c:3166' (0x0001402cdfa0) of size 336
0x0001402cdf86 is located 0 bytes after global variable 'test_virtual_unwind_x86.unwind_info_6' defined in '.../wine/dlls/ntdll/tests/unwind.c:3156' (0x0001402cdf80) of size 6
SUMMARY: AddressSanitizer: global-buffer-overflow .../wine/dlls/ntdll/tests/unwind.c:2730 in call_virtual_unwind_x86
```

</details>

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9561

[PATCH 1/1] ntdll/tests: Avoid out-of-bounds read in call_virtual_unwind_x86 (ASan).

[Bernhard Übelacker]

From: Bernhard Übelacker <bernhardu(a)mailbox.org>

---
 dlls/ntdll/tests/unwind.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dlls/ntdll/tests/unwind.c b/dlls/ntdll/tests/unwind.c
index a60db1bc70f..517673c5a42 100644
--- a/dlls/ntdll/tests/unwind.c
+++ b/dlls/ntdll/tests/unwind.c
@@ -3161,6 +3161,8 @@ static void test_virtual_unwind_x86(void)
         0,                             /* frame reg */
 
         0x01, UWOP(PUSH_NONVOL, rbp),  /* 02: push %rbp */
+
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,  /* make it the size expected by call_virtual_unwind_x86 */
     };
 
     static const struct results_x86 results_6_epilogue[] =
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/9561