New subject: [Bug 60403] gdiplus: GdipWidenPath reads past the dash pattern of a DashStyleCustom pen without dashes

Sept. 29, 2026

      http://bugs.winehq.org/show_bug.cgi?id=60403

            Bug ID: 60403
           Summary: gdiplus: GdipWidenPath reads past the dash pattern of
                    a DashStyleCustom pen without dashes
           Product: Wine
           Version: 11.18
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: gdiplus
          Assignee: wine-bugs@list.winehq.org
          Reporter: rittert@outlook.de
  Target Milestone: ---
      Distribution: ---

Created attachment 82199
  --> http://bugs.winehq.org/attachment.cgi?id=82199
test program

A pen that has DashStyleCustom set but no dash array (GdipSetPenDashStyle(pen,
DashStyleCustom)
without GdipSetPenDashArray) makes GdipWidenPath, and with it GdipDrawPath and
GdipDrawLine, read out
of bounds.

GdipDrawPath goes through SOFTWARE_GdipDrawPath -> GdipWidenPath ->
widen_dashed_figure(). There
dash_count is pen->numdashes, i.e. 0, dash_pattern_scaled comes from malloc(0),
and
"++dash_index == dash_count" never becomes true, so the loop reads
dash_pattern_scaled[] past its end
(graphicspath.c:2512 in 11.18). Depending on what follows in memory, this

- ends in a page fault; inside a window procedure it shows up only as
  "err:seh:user_callback_handler ignoring exception c0000005" and the paint is
lost, or
- keeps producing dashes: the stack then sits in widen_dashed_figure ->
widen_open_figure ->
  add_path_list_node and memory grows by about 60 MB/s until the process is
killed for running out of
  memory.

On Windows such a pen draws a solid line. The attached gdipdash.c shows it
(x86_64-w64-mingw32-gcc -O2 -o gdipdash.exe gdipdash.c -lgdiplus):

Windows 11 (10.0.26200):

    GdipSetPenDashStyle(DashStyleCustom) = 0, dash style 5, dash count 0
    solid pen:  widened line has 4 points, 180 of 180 pixels drawn
    custom pen: widened line has 4 points, 180 of 180 pixels drawn
    custom pen, 1000 more widenings: 4 to 4 points

Wine 11.18:

    GdipSetPenDashStyle(DashStyleCustom) = 0, dash style 5, dash count 0
    solid pen:  widened line has 4 points, 180 of 180 pixels drawn
    wine: Unhandled page fault on read access to 00007FFFFEA68000 at address
00006FFFFBADCE1D (thread 0154), starting debugger...

The attached patch treats a custom dash style without dashes as solid in
GdipWidenPath and adds a test
to test_widen: the widened path is the same as for a solid pen, as on Windows.
With the patch,
gdipdash.exe gives the Windows results, and the graphicspath tests pass on Wine
11.18 and on
Windows 11 (1179 tests, 0 failures). The new test can also pass on unpatched
Wine, when the
out-of-bounds read happens to find a large value.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 60403] New: gdiplus: GdipWidenPath reads past the dash pattern of a DashStyleCustom pen without dashes

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

tags

participants (1)