[Bug 60241] New: Claude Core review report(a lot of copy paste and logic bugs uncovered)

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60241

            Bug ID: 60241
           Summary: Claude Core review report(a lot of copy paste and
                    logic bugs uncovered)
           Product: Wine
           Version: 11.15
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
          Assignee: [e-mail]
          Reporter: [e-mail]
  Target Milestone: ---
      Distribution: ---

Created attachment 81942
  --> http://bugs.winehq.org/attachment.cgi?id=81942
Html report, with ~1900 possible bugs in various modules

Over the past month, whenever I had some free tokens available, I used Claude
Code to review the Wine(and also other open source projects) codebase step by
step

I have attached an HTML file containing the graphical report, which contains
info about ~1900 problematic places(copy-paste bugs, use-after-free, logic
problems, etc.). I know that reporting multiple problems in a single bug report
is usually not encouraged, but otherwise I would have flooded the entire
Bugzilla tracker.

Html report can also be found here:
https://github.com/qarmin/ClaudeReports/blob/master/wine_20260823.html

I have created reports using the same html template for many other open-source
projects, like Box64, FEX, image-rs, lofty, Strawberry, and many others. These
projects have already fixed bugs that were found through these reports(there
were also some false positives).

The report contains direct links to the Wine GitLab repository, the exact
commit on which the report was created, a description of each bug, and a
possible fix. I can regenerate the report if needed.

Here are some examples of bugs that I'm sure are actual bugs:

////////////////////////////////////////////////////

### CPY_3 `HIGH`

**Description:** In `ImmGetImeMenuItemsA` and `ImmGetImeMenuItemsW`, the
per-item conversion loop copies from a fixed index `1` instead of the loop
variable `i`: `memcpy( &menuA[i], &menuW[1], sizeof(IMEMENUITEMINFOA) )` and,
symmetrically, `memcpy( &menuW[i], &menuA[1], sizeof(IMEMENUITEMINFOA) )`.
Every output element ends up filled with data copied from source index `1`
(wrong data for all `i != 1`), and when `ret` is `1` this also reads
`menuW[1]`/`menuA[1]`, one element past what was populated/allocated for a
single-item result - an out-of-bounds read.

**Locations:**
```c
memcpy( &menuA[i], &menuW[1], sizeof(IMEMENUITEMINFOA) );
```
**Fix:** Use the loop index instead of the literal `1` in both functions:
```c
memcpy( &menuA[i], &menuW[i], sizeof(IMEMENUITEMINFOA) );
```

////////////////////////////////////////////////////

### LOGIC_66 `MEDIUM`

**Description:** In `EMFDC_PlgBlt()`, the bounding-box computation loop updates
`x_min`, `y_min`, `x_max` correctly with `min()`/`max()` against their own
running value, but `y_max` is computed with `max( y_min, points[i].y )` instead
of `max( y_max, points[i].y )`. This is a copy-paste typo that makes the
computed `emr->rclBounds.bottom` wrong whenever `y_max` and `y_min` diverge.

**Locations:**
dlls/gdi32/emfdc.c:1875
```
        x_min = min( x_min, points[i].x );
        y_min = min( y_min, points[i].y );
        x_max = max( x_max, points[i].x );
        y_max = max( y_min, points[i].y );
```

**Fix:**

```c
// before
        y_max = max( y_min, points[i].y );

// after
        y_max = max( y_max, points[i].y );
```

////////////////////////////////////////////////////
### CPY_52 `MEDIUM`

**Description:** In `ace_flags_to_samba()` the branch for
`CONTAINER_INHERIT_ACE` sets `SEC_ACE_FLAG_NO_PROPAGATE_INHERIT` instead of
`SEC_ACE_FLAG_CONTAINER_INHERIT`. This is a copy-paste from the next line
(`NO_PROPAGATE_INHERIT_ACE`), so `CONTAINER_INHERIT_ACE` is silently dropped
and duplicated as `NO_PROPAGATE_INHERIT_ACE` whenever a share's DACL/SACL ACE
flags are converted for Samba, corrupting ACL inheritance semantics passed to
`NetShareAdd`/`NetShareGetInfo`.

**Locations:**
dlls/netapi32/unixlib.c:427
```
    if (flags & OBJECT_INHERIT_ACE)         ret |= SEC_ACE_FLAG_OBJECT_INHERIT;
    if (flags & CONTAINER_INHERIT_ACE)      ret |=
SEC_ACE_FLAG_NO_PROPAGATE_INHERIT;
    if (flags & NO_PROPAGATE_INHERIT_ACE)   ret |=
SEC_ACE_FLAG_NO_PROPAGATE_INHERIT;
```

**Fix:** Change the `CONTAINER_INHERIT_ACE` mapping to use the correct
destination flag:
```c
if (flags & OBJECT_INHERIT_ACE)         ret |= SEC_ACE_FLAG_OBJECT_INHERIT;
if (flags & CONTAINER_INHERIT_ACE)      ret |= SEC_ACE_FLAG_CONTAINER_INHERIT;
if (flags & NO_PROPAGATE_INHERIT_ACE)   ret |=
SEC_ACE_FLAG_NO_PROPAGATE_INHERIT;
```

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.