[Bug 28628] New: advapi32/security.ok: GetTokenInformation(Token, TokenGroups, ...) returns partial garbage leading to uninitialized memory accesses?
http://bugs.winehq.org/show_bug.cgi?id=28628 Bug #: 28628 Summary: advapi32/security.ok: GetTokenInformation(Token, TokenGroups,...) returns partial garbage leading to uninitialized memory accesses? Product: Wine Version: 1.3.29 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: advapi32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com Classification: Unclassified "wine advapi32_test.exe.so security.c" says in part security.c:1475: TokenGroups: security.c:1489: S-1-1-0, \Everyone use: 5 attr: 0x00000007 security.c:1489: S-1-2-0, \LOCAL use: 5 attr: 0x00000007 security.c:1489: S-1-5-4, NT AUTHORITY\INTERACTIVE use: 5 attr: 0x00000007 security.c:1489: S-1-5-11, NT AUTHORITY\Authenticated Users use: 5 attr: 0x00000007 security.c:1489: S-1-5-32-544, BUILTIN\Administrators use: 4 attr: 0x0000000f security.c:1492: attr: 0x00000007 LookupAccountSid failed with error 1332 security.c:1492: attr: 0xc0000007 LookupAccountSid failed with error 1332 Those two LookupAccountSid() errors appear to be because the last two SIDs from GetTokenInformation() are garbage. This causes the valgrind warning Conditional jump or move depends on uninitialised value(s) at RtlEqualSid (sec.c:210) by EqualSid (security.c:1027) by IsWellKnownSid (security.c:961) by LookupAccountSidW (security.c:2098) by LookupAccountSidA (security.c:2024) by test_token_attr (security.c:1485) by func_security (security.c:4000) by run_test (test.h:556) by main (test.h:624) Uninitialised value was created by a client request at RtlAllocateHeap (heap.c:208) by test_token_attr (security.c:1468) by func_security (security.c:4000) by run_test (test.h:556) by main (test.h:624) I dumped the SIDs that are being compared in test_token_attr, and it looks like the first six are ok, but the last two aren't: ... security.c:1487: Dumping SIDs security.c:1489: i = 4, j = 0, val = 1 security.c:1489: i = 4, j = 1, val = 2 security.c:1489: i = 4, j = 2, val = 0 security.c:1489: i = 4, j = 3, val = 0 security.c:1489: i = 4, j = 4, val = 0 security.c:1489: i = 4, j = 5, val = 0 security.c:1489: i = 4, j = 6, val = 0 security.c:1489: i = 4, j = 7, val = 5 security.c:1489: i = 4, j = 8, val = 20 security.c:1489: i = 4, j = 9, val = 0 security.c:1489: i = 4, j = 10, val = 0 security.c:1489: i = 4, j = 11, val = 0 security.c:1496: S-1-5-32-544, BUILTIN\Administrators use: 4 attr: 0x0000000f security.c:1487: Dumping SIDs security.c:1489: i = 5, j = 0, val = 1 security.c:1489: i = 5, j = 1, val = 2 security.c:1489: i = 5, j = 2, val = 0 security.c:1489: i = 5, j = 3, val = 0 security.c:1489: i = 5, j = 4, val = cc security.c:1489: i = 5, j = 5, val = cc security.c:1489: i = 5, j = 6, val = cc security.c:1489: i = 5, j = 7, val = cc security.c:1489: i = 5, j = 8, val = cc security.c:1489: i = 5, j = 9, val = cc security.c:1489: i = 5, j = 10, val = cc security.c:1489: i = 5, j = 11, val = cc security.c:1499: attr: 0x00000007 LookupAccountSid failed with error 1332 security.c:1487: Dumping SIDs security.c:1489: i = 6, j = 0, val = cc security.c:1489: i = 6, j = 1, val = cc security.c:1489: i = 6, j = 2, val = cc security.c:1489: i = 6, j = 3, val = cc security.c:1489: i = 6, j = 4, val = cc security.c:1489: i = 6, j = 5, val = cc security.c:1489: i = 6, j = 6, val = cc security.c:1489: i = 6, j = 7, val = cc security.c:1489: i = 6, j = 8, val = cc security.c:1489: i = 6, j = 9, val = cc security.c:1489: i = 6, j = 10, val = cc security.c:1489: i = 6, j = 11, val = cc security.c:1499: attr: 0xc0000007 LookupAccountSid failed with error 1332 Is some buffer length wrong somewhere? The responsible code seems to be from: commit 573db9ef639f65385f1efab5593b52c72b4b4108 Author: Nikolay Sivov <nsivov(a)codeweavers.com> Date: Tue Aug 23 11:16:27 2011 +0400 ntdll: While requesting TokenGroups calculate required user buffer size in server. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=28628 --- Comment #1 from Nikolay Sivov <bunglehead(a)gmail.com> 2011-10-10 11:52:05 CDT --- Created attachment 36805 --> http://bugs.winehq.org/attachment.cgi?id=36805 patch Try this one please. It fixes one of the failures and another one still appears for me with reverted patch so regression is about a single failure it seems. Could you confirm? -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=28628 --- Comment #2 from Dan Kegel <dank(a)kegel.com> 2011-10-11 08:20:52 CDT --- I now see one valgrind error there instead of two, so presumably now only the last of the eight SIDs is undefined. The patch does seem like an improvement offhand, but the issue is still not fully fixed. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=28628 Ken Sharp <kennybobs(a)o2.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kennybobs(a)o2.co.uk -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=28628 Austin English <austinenglish(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |erik(a)defiant.homedns.org --- Comment #3 from Austin English <austinenglish(a)gmail.com> 2011-10-11 19:19:41 CDT --- *** Bug 28497 has been marked as a duplicate of this bug. *** -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=28628 --- Comment #4 from Nikolay Sivov <bunglehead(a)gmail.com> 2011-10-12 09:55:21 CDT --- (In reply to comment #2)
I now see one valgrind error there instead of two, so presumably now only the last of the eight SIDs is undefined. The patch does seem like an improvement offhand, but the issue is still not fully fixed.
Yes, what I mean is with reverted patch I still get one single failure so I assume it was already there before a patch. If you can confirm that I'll send attached patch today. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=28628 --- Comment #5 from Dan Kegel <dank(a)kegel.com> 2011-10-12 09:58:47 CDT --- Let's make 28497 its own bug, say the patch fixes that, and leave this one for the older problem. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=28628 Ken Sharp <kennybobs(a)o2.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |28497 -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=28628 --- Comment #6 from Nikolay Sivov <bunglehead(a)gmail.com> 2013-04-29 01:12:05 CDT --- I'm unable to reproduce that with current git wine and valgrind from svn. Can anyone confirm? P.S. it's still possible I'm using some valgrind flags wrong but it shows no warnings here. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=28628 Austin English <austinenglish(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #7 from Austin English <austinenglish(a)gmail.com> --- (In reply to Nikolay Sivov from comment #6)
I'm unable to reproduce that with current git wine and valgrind from svn. Can anyone confirm?
P.S. it's still possible I'm using some valgrind flags wrong but it shows no warnings here.
I can't either, marking fixed. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=28628 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #8 from Alexandre Julliard <julliard(a)winehq.org> --- Closing bugs fixed in 1.7.18. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
wine-bugs＠winehq.org