[PATCH 0/1] MR6787: wineeps.drv: Store locale in own buffer. (ASan)
The pointer in tmplocale gets freed in the second setlocale call. Therefore ASan triggers when trying to restore the locale the the already freed pointer in tmplocale in the third call to setlocale. This appeared with a notepad.exe built with (a yet patched) llvm-mingw with ASan enabled, when opening the Printer Setup dialog. The stack traces seem to have utilized an in the wineprefix installed LLVM/llvm-symbolizer.exe. ``` wine64 notepad_asan.exe ================================================================= ==300==ERROR: AddressSanitizer: heap-use-after-free on address 0x7eeab5c60290 at pc 0x6ffffa80279f bp 0x7ffffe1fb570 sp 0x7ffffe1fb5b0 READ of size 2 at 0x7eeab5c60290 thread T0 0130:fixme:dbghelp:elf_search_auxv can't find symbol in module #0 0x6ffffa80279e in strchr+0x28e (C:\x86_64\libclang_rt.asan_dynamic-x86_64.dll+0x18004279e) #1 0x6ffffeb1666c in locale_to_sname Z:\home\bernhard\wine\dlls\msvcrt\locale.c:351 #2 0x6ffffeb16ce5 in create_locinfo Z:\home\bernhard\wine\dlls\msvcrt\locale.c:1357 #3 0x6ffffeb1a170 in setlocale Z:\home\bernhard\wine\dlls\msvcrt\locale.c:2054 #4 0x6ffffa1bf8c9 in PSDRV_ParsePPD Z:\home\bernhard\wine\dlls\wineps.drv\ppd.c:890 #5 0x6ffffa1bc0b7 in PSDRV_FindPrinterInfo Z:\home\bernhard\wine\dlls\wineps.drv\init.c:575 #6 0x6ffffa1b66b1 in DrvDocumentPropertySheets Z:\home\bernhard\wine\dlls\wineps.drv\driver.c:491 #7 0x6ffffc60b314 in DocumentPropertiesW Z:\home\bernhard\wine\dlls\winspool.drv\info.c:1854 #8 0x6ffffc611f97 in OpenPrinter2W Z:\home\bernhard\wine\dlls\winspool.drv\info.c:2057 #9 0x6ffffd666153 in PRINTDLG_ChangePrinterW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:1298 #10 0x6ffffd66786d in PRINTDLG_WMInitDialogW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:1660 #11 0x6ffffd667987 in PrintDlgProcW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:2126 #12 0x6ffffdc08d48 in call_dialog_proc Z:\home\bernhard\wine\dlls\user32\winproc.c:129 #13 0x6ffffdc0b13b in WINPROC_CallDlgProcW Z:\home\bernhard\wine\dlls\user32\winproc.c:948 #14 0x6ffffdbcf528 in USER_DefDlgProc Z:\home\bernhard\wine\dlls\user32\defdlg.c:372 #15 0x6ffffdbcf7b4 in DefDlgProcW Z:\home\bernhard\wine\dlls\user32\defdlg.c:438 #16 0x6ffffdc08c2a in call_window_proc Z:\home\bernhard\wine\dlls\user32\winproc.c:108 #17 0x6ffffdc0ac43 in dispatch_win_proc_params Z:\home\bernhard\wine\dlls\user32\winproc.c:725 #18 0x6ffffdbf179c in dispatch_send_message Z:\home\bernhard\wine\dlls\user32\message.c:580 #19 0x6ffffdbf32ee in SendMessageW Z:\home\bernhard\wine\dlls\user32\message.c:599 #20 0x6ffffdbd2d1a in DIALOG_CreateIndirect Z:\home\bernhard\wine\dlls\user32\dialog.c:676 #21 0x6ffffdbd4d1c in DialogBoxIndirectParamW Z:\home\bernhard\wine\dlls\user32\dialog.c:899 #22 0x6ffffd6692a7 in PrintDlgW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:2546 #23 0x000140007f9b in DIALOG_FilePrinterSetup Z:\home\bernhard\wine\programs\notepad\dialog.c:1019 #24 0x00014000e118 in NOTEPAD_WndProc Z:\home\bernhard\wine\programs\notepad\main.c:640 #25 0x6ffffdc08c2a in call_window_proc Z:\home\bernhard\wine\dlls\user32\winproc.c:108 #26 0x6ffffdc0ac43 in dispatch_win_proc_params Z:\home\bernhard\wine\dlls\user32\winproc.c:725 #27 0x6ffffdbf1850 in dispatch_message Z:\home\bernhard\wine\dlls\user32\message.c:854 #28 0x6ffffdbf3afc in DispatchMessageW Z:\home\bernhard\wine\dlls\user32\message.c:940 #29 0x00014000c4ef in WinMain Z:\home\bernhard\wine\programs\notepad\main.c:888 #30 0x00014000ea3e in main+0x20e (C:\x86_64\notepad.exe_asan.exe+0x14000ea3e) #31 0x00014000e75a in mainCRTStartup Z:\home\bernhard\wine\dlls\msvcrt\crt_main.c:58 #32 0x6fffffa98d58 in BaseThreadInitThunk Z:\home\bernhard\wine\dlls\kernel32\thread.c:61 #33 0x6fffffc95afa (C:\windows\system32\ntdll.dll+0x170055afa) 0x7eeab5c60290 is located 0 bytes inside of 2-byte region [0x7eeab5c60290,0x7eeab5c60292) freed by thread T0 here: #0 0x6ffffa809ff1 in free+0x81 (C:\x86_64\libclang_rt.asan_dynamic-x86_64.dll+0x180049ff1) #1 0x6ffffeb1563c in free_locinfo Z:\home\bernhard\wine\dlls\msvcrt\locale.c:1071 #2 0x6ffffeb1591a in update_thread_locale Z:\home\bernhard\wine\dlls\msvcrt\locale.c:611 #3 0x6ffffeb1a301 in setlocale Z:\home\bernhard\wine\dlls\msvcrt\locale.c:2085 #4 0x6ffffa1bf890 in PSDRV_ParsePPD Z:\home\bernhard\wine\dlls\wineps.drv\ppd.c:887 #5 0x6ffffa1bc0b7 in PSDRV_FindPrinterInfo Z:\home\bernhard\wine\dlls\wineps.drv\init.c:575 #6 0x6ffffa1b66b1 in DrvDocumentPropertySheets Z:\home\bernhard\wine\dlls\wineps.drv\driver.c:491 #7 0x6ffffc60b314 in DocumentPropertiesW Z:\home\bernhard\wine\dlls\winspool.drv\info.c:1854 #8 0x6ffffc611f97 in OpenPrinter2W Z:\home\bernhard\wine\dlls\winspool.drv\info.c:2057 #9 0x6ffffd666153 in PRINTDLG_ChangePrinterW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:1298 #10 0x6ffffd66786d in PRINTDLG_WMInitDialogW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:1660 #11 0x6ffffd667987 in PrintDlgProcW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:2126 #12 0x6ffffdc08d48 in call_dialog_proc Z:\home\bernhard\wine\dlls\user32\winproc.c:129 #13 0x6ffffdc0b13b in WINPROC_CallDlgProcW Z:\home\bernhard\wine\dlls\user32\winproc.c:948 #14 0x6ffffdbcf528 in USER_DefDlgProc Z:\home\bernhard\wine\dlls\user32\defdlg.c:372 #15 0x6ffffdbcf7b4 in DefDlgProcW Z:\home\bernhard\wine\dlls\user32\defdlg.c:438 #16 0x6ffffdc08c2a in call_window_proc Z:\home\bernhard\wine\dlls\user32\winproc.c:108 #17 0x6ffffdc0ac43 in dispatch_win_proc_params Z:\home\bernhard\wine\dlls\user32\winproc.c:725 #18 0x6ffffdbf179c in dispatch_send_message Z:\home\bernhard\wine\dlls\user32\message.c:580 #19 0x6ffffdbf32ee in SendMessageW Z:\home\bernhard\wine\dlls\user32\message.c:599 #20 0x6ffffdbd2d1a in DIALOG_CreateIndirect Z:\home\bernhard\wine\dlls\user32\dialog.c:676 #21 0x6ffffdbd4d1c in DialogBoxIndirectParamW Z:\home\bernhard\wine\dlls\user32\dialog.c:899 #22 0x6ffffd6692a7 in PrintDlgW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:2546 #23 0x000140007f9b in DIALOG_FilePrinterSetup Z:\home\bernhard\wine\programs\notepad\dialog.c:1019 #24 0x00014000e118 in NOTEPAD_WndProc Z:\home\bernhard\wine\programs\notepad\main.c:640 #25 0x6ffffdc08c2a in call_window_proc Z:\home\bernhard\wine\dlls\user32\winproc.c:108 #26 0x6ffffdc0ac43 in dispatch_win_proc_params Z:\home\bernhard\wine\dlls\user32\winproc.c:725 #27 0x6ffffdbf1850 in dispatch_message Z:\home\bernhard\wine\dlls\user32\message.c:854 previously allocated by thread T0 here: #0 0x6ffffa80a111 in malloc+0x81 (C:\x86_64\libclang_rt.asan_dynamic-x86_64.dll+0x18004a111) #1 0x6ffffeb154f9 in init_category_name Z:\home\bernhard\wine\dlls\msvcrt\locale.c:474 #2 0x6ffffeb18ad9 in create_locinfo Z:\home\bernhard\wine\dlls\msvcrt\locale.c:1930 #3 0x6ffffeb1a170 in setlocale Z:\home\bernhard\wine\dlls\msvcrt\locale.c:2054 #4 0x6ffffa1bf8c9 in PSDRV_ParsePPD Z:\home\bernhard\wine\dlls\wineps.drv\ppd.c:890 #5 0x6ffffa1bc0b7 in PSDRV_FindPrinterInfo Z:\home\bernhard\wine\dlls\wineps.drv\init.c:575 #6 0x6ffffa1b66b1 in DrvDocumentPropertySheets Z:\home\bernhard\wine\dlls\wineps.drv\driver.c:491 #7 0x6ffffc60b314 in DocumentPropertiesW Z:\home\bernhard\wine\dlls\winspool.drv\info.c:1854 #8 0x6ffffc611f97 in OpenPrinter2W Z:\home\bernhard\wine\dlls\winspool.drv\info.c:2057 #9 0x6ffffd666153 in PRINTDLG_ChangePrinterW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:1298 #10 0x6ffffd66786d in PRINTDLG_WMInitDialogW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:1660 #11 0x6ffffd667987 in PrintDlgProcW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:2126 #12 0x6ffffdc08d48 in call_dialog_proc Z:\home\bernhard\wine\dlls\user32\winproc.c:129 #13 0x6ffffdc0b13b in WINPROC_CallDlgProcW Z:\home\bernhard\wine\dlls\user32\winproc.c:948 #14 0x6ffffdbcf528 in USER_DefDlgProc Z:\home\bernhard\wine\dlls\user32\defdlg.c:372 #15 0x6ffffdbcf7b4 in DefDlgProcW Z:\home\bernhard\wine\dlls\user32\defdlg.c:438 #16 0x6ffffdc08c2a in call_window_proc Z:\home\bernhard\wine\dlls\user32\winproc.c:108 #17 0x6ffffdc0ac43 in dispatch_win_proc_params Z:\home\bernhard\wine\dlls\user32\winproc.c:725 #18 0x6ffffdbf179c in dispatch_send_message Z:\home\bernhard\wine\dlls\user32\message.c:580 #19 0x6ffffdbf32ee in SendMessageW Z:\home\bernhard\wine\dlls\user32\message.c:599 #20 0x6ffffdbd2d1a in DIALOG_CreateIndirect Z:\home\bernhard\wine\dlls\user32\dialog.c:676 #21 0x6ffffdbd4d1c in DialogBoxIndirectParamW Z:\home\bernhard\wine\dlls\user32\dialog.c:899 #22 0x6ffffd6692a7 in PrintDlgW Z:\home\bernhard\wine\dlls\comdlg32\printdlg.c:2546 #23 0x000140007f9b in DIALOG_FilePrinterSetup Z:\home\bernhard\wine\programs\notepad\dialog.c:1019 #24 0x00014000e118 in NOTEPAD_WndProc Z:\home\bernhard\wine\programs\notepad\main.c:640 #25 0x6ffffdc08c2a in call_window_proc Z:\home\bernhard\wine\dlls\user32\winproc.c:108 #26 0x6ffffdc0ac43 in dispatch_win_proc_params Z:\home\bernhard\wine\dlls\user32\winproc.c:725 #27 0x6ffffdbf1850 in dispatch_message Z:\home\bernhard\wine\dlls\user32\message.c:854 SUMMARY: AddressSanitizer: heap-use-after-free Z:\home\bernhard\wine\dlls\msvcrt\locale.c:351 in locale_to_sname Shadow bytes around the buggy address: 0x7eeab5c60000: fa fa 00 00 fa fa 00 06 fa fa 00 fa fa fa 00 00 0x7eeab5c60080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa 0x7eeab5c60100: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa 0x7eeab5c60180: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa 0x7eeab5c60200: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa =>0x7eeab5c60280: fa fa[fd]fa fa fa fd fa fa fa fd fa fa fa fd fa 0x7eeab5c60300: fa fa 02 fa fa fa 04 fa fa fa 02 fa fa fa 04 fa 0x7eeab5c60380: fa fa 02 fa fa fa 04 fa fa fa 02 fa fa fa 04 fa 0x7eeab5c60400: fa fa 02 fa fa fa 04 fa fa fa 00 fa fa fa fd fd 0x7eeab5c60480: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x7eeab5c60500: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==300==ABORTING ``` -- https://gitlab.winehq.org/wine/wine/-/merge_requests/6787
From: Bernhard Übelacker <bernhardu(a)mailbox.org> The pointer in tmplocale gets freed in the second setlocale call. Therefore ASan triggers when trying to restore the locale the the already freed pointer in tmplocale in the third call to setlocale. --- dlls/wineps.drv/psdrv.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dlls/wineps.drv/psdrv.h b/dlls/wineps.drv/psdrv.h index 2c4703de942..69cb1cfc0f0 100644 --- a/dlls/wineps.drv/psdrv.h +++ b/dlls/wineps.drv/psdrv.h @@ -546,10 +546,12 @@ extern void passthrough_leave(print_ctx *ctx); #define push_lc_numeric(x) do { \ const char *tmplocale = setlocale(LC_NUMERIC,NULL); \ + tmplocale = tmplocale ? strdup(tmplocale) : NULL; \ setlocale(LC_NUMERIC,x); #define pop_lc_numeric() \ setlocale(LC_NUMERIC,tmplocale); \ + free(tmplocale); \ } while (0) static inline WCHAR *strdupW( const WCHAR *str ) -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/6787
Did you try using `_create_locale()`/`*_l()`/`_free_locale()` instead? It seems safer if per-process locale is used. It also allows us to reuse created locale object. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/6787#note_86846
participants (2)
-
Bernhard Übelacker -
Piotr Caban (＠piotr)