[Bug 59973] New: wininet: InternetCrackUrlW reads out of bounds for empty file URL path before fragment
http://bugs.winehq.org/show_bug.cgi?id=59973 Bug ID: 59973 Summary: wininet: InternetCrackUrlW reads out of bounds for empty file URL path before fragment Product: Wine Version: 11.10 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: wininet Assignee: wine-bugs@list.winehq.org Reporter: forkthus@gmail.com Target Milestone: --- Distribution: --- Created attachment 81367 --> http://bugs.winehq.org/attachment.cgi?id=81367 Bug reproducer InternetCrackUrlW/InternetCrackUrlA crashes with an out-of-bounds read when parsing a file: URL whose path is empty and whose fragment starts immediately after file://. (e.g. file://#). The parse ends in a segmentation fault. Instead, the function should treat the URL as malformed and return failure. A reproducer is attached. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59973 Ken Sharp <imwellcushtymelike@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, source, testcase --- Comment #1 from Ken Sharp <imwellcushtymelike@gmail.com> --- Please attach the console output. https://gitlab.winehq.org/wine/wine/-/wikis/Bugs -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59973 Kyle Yang <kyle.chaoxin.yang@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle.chaoxin.yang@gmail.com --- Comment #2 from Kyle Yang <kyle.chaoxin.yang@gmail.com> --- Created attachment 81380 --> http://bugs.winehq.org/attachment.cgi?id=81380 GDB backtrace and session log for the InternetCrackUrlW crash. I have reproduced the crash with Wine-11.11 (current git). The crash occurs in InternetCrackUrlW when parsing a file: URL with an empty path and a fragment starting immediately after "file://" (e.g., "file://#"). GDB shows that the function reaches line 2338 of internet.c with len = 0: - URL: L"file://\\\\#:]/" - dwUrlLength: 13 - len: 0 The code at line 2338 ( if (tmppath[len - 1] == '.' && ) attempts to access tmppath[len - 1] without checking that len > 0 first, causing an out-of-bounds read when len is zero. Full GDB session log and backtrace attached. I have submitted a fix for this issue: https://gitlab.winehq.org/wine/wine/-/merge_requests/11347 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla