[PATCH 0/2] MR2180: winetest: Avoid an infinite loop in vstrfmtmake() when the format is NULL.

[Francois Gouget (＠fgouget)]

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/2180

[PATCH 1/2] winetest: Don't use plain strings as format specifiers.

[Francois Gouget]

From: Francois Gouget <fgouget(a)codeweavers.com>

When they contain a percent character they would, at best, not be
printed correctly, and at worst cause a crash.
---
Or maybe even cause an exploitable buffer overflow but that's not much
of a concern in this case.
---
 programs/winetest/main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/programs/winetest/main.c b/programs/winetest/main.c
index 74b596b237b..2fbeda572dd 100644
--- a/programs/winetest/main.c
+++ b/programs/winetest/main.c
@@ -1122,7 +1122,7 @@ run_tests (char *logname, char *outdir)
         logfile = create_temp_file( tmpname );
         logname = tmpname;
     }
-    report (R_OUT, logname);
+    report (R_OUT, "%s",logname);
 
     if (logfile == INVALID_HANDLE_VALUE)
         report (R_FATAL, "Could not open logfile: %u", GetLastError());
@@ -1148,7 +1148,7 @@ run_tests (char *logname, char *outdir)
     if (!newdir && (!outdir || GetLastError() != ERROR_ALREADY_EXISTS))
         report (R_FATAL, "Could not create directory %s (%d)", tempdir, GetLastError());
 
-    report (R_DIR, tempdir);
+    report (R_DIR, "%s", tempdir);
 
     xprintf ("Version 4\n");
     xprintf ("Tests from build %s\n", build_id[0] ? build_id : "-" );
-- 
GitLab


https://gitlab.winehq.org/wine/wine/-/merge_requests/2180

[PATCH 2/2] winetest: Avoid an infinite loop in vstrfmtmake() when the format is NULL.

[Francois Gouget]

From: Francois Gouget <fgouget(a)codeweavers.com>

When the format is NULL vsnprintf() always returns -1 so we keep
doubling the allocated memory until running out of memory.
---
For a while I could reproduce this out of memory condition in about 20%
of the runs and determined it probably came from a textOut() call. My
main suspects were:
    report (R_OUT, logname);
    report (R_DIR, tempdir);
These are wrong anyway but for other reasonis. But this issue stopped
happening before I could confirm my suspicions or identify the actual
caller :-(

Anyway printf(NULL) does not crash (with the glibc it's the same as
print("")) so I figure vstrfmtmake() should not either.
---
 programs/winetest/util.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/programs/winetest/util.c b/programs/winetest/util.c
index a1320005841..589810c8fcc 100644
--- a/programs/winetest/util.c
+++ b/programs/winetest/util.c
@@ -56,6 +56,7 @@ static char *vstrfmtmake (size_t *lenp, const char *fmt, va_list ap)
     char *p;
     int n;
 
+    if (!fmt) fmt = "(noformat)";
     p = xalloc(size);
     while (1) {
         n = vsnprintf (p, size, fmt, ap);
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/2180