October 2025 - Wine-GitLab - list.winehq.org

[PATCH 0/2] MR9215: iphlpapi/tests: Give GetBestRoute2 a SOCKETADDR_INET. (ASan)
by Bernhard Übelacker Oct. 21, 2025

Oct. 21, 2025

The test also calls GetBestRoute2 with only the smaller sockaddr_in but reads inside the whole SOCKADDR_INET type. Therefore I recived this ASan report, reading 28 bytes from variable with only 16 bytes. The second patch removes a few unneeded casts to SOCKADDR_INET. But there are more which ASan does not complain about here, should they also be changed to a SOCKADDR_INET type? CC: @yshui , @gofman Followup to 93a3d8bf9f (!9085) / ada093a6d2 (!8991). <details> <summary>ASan details:</summary> ``` ================================================================= ==iphlpapi_test.exe==560==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffe1ff440 at pc 0x6ffffe86c02b bp 0x7ffffe1fe630 sp 0x7ffffe1fe678 READ of size 28 at 0x7ffffe1ff440 thread T0 #0 0x6ffffe86c02a in __asan_memcpy /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:65:3 #1 0x6ffffb1b869a in GetBestRoute2 .../wine/dlls/iphlpapi/iphlpapi_main.c:4851:20 #2 0x00014000e0b2 in test_best_routes .../wine/dlls/iphlpapi/tests/iphlpapi.c:3908:11 #3 0x00014000123f in func_iphlpapi .../wine/dlls/iphlpapi/tests/iphlpapi.c:4017:5 #4 0x000140022bb2 in run_test .../wine/include/wine/test.h:765:5 #5 0x00014002262c in main .../wine/include/wine/test.h #6 0x0001400247ba in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:62:11 #7 0x6fffffc377b0 in BaseThreadInitThunk .../wine/dlls/kernel32/thread.c:61:24 #8 0x6fffffdc05b6 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x1700505b6) Address 0x7ffffe1ff440 is located in stack of thread T0 at offset 384 in frame #0 0x00014000b3cf in test_best_routes .../wine/dlls/iphlpapi/tests/iphlpapi.c:3503 This frame has 17 object(s): [32, 36) 'index' (line 3506) [48, 76) 'dst6' (line 3507) [112, 140) 'src6' (line 3507) [176, 204) 'best6' (line 3507) [240, 268) 'link_local_addr6' (line 3507) [304, 332) 'global_addr6' (line 3507) [368, 384) 'dst4' (line 3508) [400, 416) 'src4' (line 3508) <== Memory access at offset 384 partially underflows this variable [432, 448) 'global_addr4' (line 3508) [464, 472) 'link_local_luid' (line 3509) [496, 504) 'luid' (line 3509) [528, 608) 'uni_row' (line 3510) [640, 744) 'fwd_row' (line 3511) [784, 792) 'table' (line 3512) [816, 1072) 's' (line 3513) [1136, 1392) 's2' (line 3513) [1456, 1484) 'best4' (line 3514) HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp, SEH and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow .../wine/dlls/iphlpapi/iphlpapi_main.c:4851:20 in GetBestRoute2 Shadow bytes around the buggy address: 0x7ffffe1ff180: f2 f2 f2 f2 04 f3 f3 f3 00 00 00 00 00 00 00 00 0x7ffffe1ff200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ff280: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 00 00 0x7ffffe1ff300: 00 04 f2 f2 f2 f2 00 00 00 04 f2 f2 f2 f2 00 00 0x7ffffe1ff380: 00 04 f2 f2 f2 f2 00 00 00 04 f2 f2 f2 f2 00 00 =>0x7ffffe1ff400: 00 04 f2 f2 f2 f2 00 00[f2]f2 00 00 f2 f2 00 00 0x7ffffe1ff480: f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 00 0x7ffffe1ff500: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00 0x7ffffe1ff580: 00 00 00 00 00 f2 f2 f2 f2 f2 00 f2 f2 f2 00 00 0x7ffffe1ff600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ff680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Thread 1 "0204" hit Breakpoint 5, GetBestRoute2 (luid=<optimized out>, luid(a)entry=0x0, index=index(a)entry=2, src=src(a)entry=0x0, dst=dst(a)entry=0x7ffffe2ff7b0, options=<optimized out>, options(a)entry=0, bestroute=<optimized out>, bestroute(a)entry=0x7ffffe2ff8f0, bestaddress=<optimized out>, bestaddress(a)entry=0x7ffffe2ff880) at .../wine/dlls/iphlpapi/iphlpapi_main.c:4851 4851 dst_addr = *dst; Wine-gdb> bt #0 GetBestRoute2 (luid=<optimized out>, luid(a)entry=0x0, index=index(a)entry=2, src=src(a)entry=0x0, dst=dst(a)entry=0x7ffffe2ff7b0, options=<optimized out>, options(a)entry=0, bestroute=<optimized out>, bestroute(a)entry=0x7ffffe2ff8f0, bestaddress=<optimized out>, bestaddress(a)entry=0x7ffffe2ff880) at .../wine/dlls/iphlpapi/iphlpapi_main.c:4851 #1 0x0000000140004e57 in test_best_routes () at .../wine/dlls/iphlpapi/tests/iphlpapi.c:3908 #2 func_iphlpapi () at .../wine/dlls/iphlpapi/tests/iphlpapi.c:4017 #3 0x00000001400061dd in run_test (name=name(a)entry=0x14001b21b <winetest_color_reset+189> "iphlpapi") at .../wine/include/wine/test.h:765 #4 0x0000000140005ec4 in main (argc=<optimized out>, argv=<optimized out>) at .../wine/include/wine/test.h:877 Wine-gdb> print dst $1 = (const SOCKADDR_INET *) 0x7ffffe2ff7b0 Wine-gdb> print sizeof(*dst) $2 = 28 Wine-gdb> up #1 0x0000000140004e57 in test_best_routes () at .../wine/dlls/iphlpapi/tests/iphlpapi.c:3908 3908 ret = GetBestRoute2( NULL, default_route_index, NULL, (SOCKADDR_INET *)&dst4, 0, &fwd_row, (SOCKADDR_INET *)&best4 ); Wine-gdb> print &dst4 $3 = (struct sockaddr_in *) 0x7ffffe2ff7b0 Wine-gdb> print sizeof(dst4) $4 = 16 Wine-gdb> ``` </details> -- https://gitlab.winehq.org/wine/wine/-/merge_requests/9215

2 3

[PATCH v3 0/1] MR9196: win32u: Set the process idle event from the client side.
by Rémi Bernon Oct. 21, 2025

Oct. 21, 2025

This should fix winemenubuilder timing out on startup with ntsync. -- v3: win32u: Set the process idle event from the client side. https://gitlab.winehq.org/wine/wine/-/merge_requests/9196

1 2

[PATCH 0/1] MR9237: kernelbase: Remove an unused NtQueryInformationFile() from MoveFileWithProgress().
by Elizabeth Figura (＠zfigura) Oct. 20, 2025

Oct. 20, 2025

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/9237

2 1

[PATCH 0/4] MR9183: win32u: Use float intermediate values for dpi and monitor scaling.
by Conor McCarthy (＠cmccarthy) Oct. 20, 2025

Oct. 20, 2025

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/9183

2 5

[PATCH 0/1] MR9236: kernel32: Avoid RBP-based frame in BaseThreadInitThunk() on x64.
by Paul Gofman (＠gofman) Oct. 20, 2025

Oct. 20, 2025

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/9236

2 2

[PATCH 0/1] MR9064: wineboot: Ensure that the ProxyEnable value is created.
by Elizabeth Figura (＠zfigura) Oct. 20, 2025

Oct. 20, 2025

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/9064

2 3

[PATCH v3 0/1] MR9234: ntdll: Call cache_inproc_sync() inside the lock.
by Elizabeth Figura (＠zfigura) Oct. 20, 2025

Oct. 20, 2025

-- v3: ntdll: Call cache_inproc_sync() inside the lock. https://gitlab.winehq.org/wine/wine/-/merge_requests/9234

2 1

[PATCH v2 0/2] MR9190: win32u: Add stub and basic tests for D3DKMT keyed mutexes.
by Rémi Bernon Oct. 20, 2025

Oct. 20, 2025

-- v2: win32u/tests: Test acquire / release of D3DKMT keyed mutexes. win32u: Stub NtGdiDdDDI(Acquire|Release)KeyedMutex(2) syscalls. https://gitlab.winehq.org/wine/wine/-/merge_requests/9190

3 5

[PATCH v3 0/1] MR9141: include: Pass a PROCESS_INFORMATION to winetest_wait_child_process().
by Elizabeth Figura (＠zfigura) Oct. 20, 2025

Oct. 20, 2025

-- v3: include: Pass a PROCESS_INFORMATION to winetest_wait_child_process(). https://gitlab.winehq.org/wine/wine/-/merge_requests/9141

2 3

Re: [PATCH v2 0/1] MR9233: user32: Move GetWindowDisplayAffinity() stub to win32u. - approved
by Alexandre Julliard (＠julliard) Oct. 20, 2025

Oct. 20, 2025

This merge request was approved by Alexandre Julliard. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/9233

1 0