March 2025 - Wine-GitLab - list.winehq.org

[PATCH 0/1] MR7574: advapi32: Avoid buffer underrun in split_domain_account (ASan).
by Bernhard Übelacker March 14, 2025

March 14, 2025

When `split_domain_account` receives a `str->Buffer=L""` with `str->Length=0` the pointer `p` gets already set in the initial assignment two bytes before the allocated memory in line 1209. Therefore the `if (*p == '\\')` accesses invalid memory. ``` ================================================================= ==advapi32_test.exe==1208==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7e89077e01ee at pc 0x6fffff6bb20f bp 0x7ffffe1ff3e0 sp 0x7ffffe1ff428 READ of size 2 at 0x7e89077e01ee thread T0 #0 0x6fffff6bb20e in split_domain_account .../wine/dlls/advapi32/security.c:1212:9 #1 0x6fffff6babe5 in lookup_local_wellknown_name .../wine/dlls/advapi32/security.c:1271:5 #2 0x6fffff6affe0 in lookup_name .../wine/dlls/advapi32/lsa.c:404:11 #3 0x6fffff6b0bbf in LsaLookupSids .../wine/dlls/advapi32/lsa.c:644:17 #4 0x00014002688e in test_LsaLookupSids .../wine/dlls/advapi32/tests/lsa.c:379:14 #5 0x000140024b17 in func_lsa .../wine/dlls/advapi32/tests/lsa.c:514:5 #6 0x00014009f9ee in run_test .../wine/include/wine/test.h:765:5 #7 0x00014009f531 in main .../wine/include/wine/test.h:884:12 #8 0x0001400a0ea3 in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:58:11 #9 0x6fffffc3565e in BaseThreadInitThunk .../wine/dlls/kernel32/thread.c:61:24 #10 0x6fffffdbbb1a in call_seh_handlers .../wine/dlls/ntdll/signal_x86_64.c:223:28 0x7e89077e01ee is located 2 bytes before 2-byte region [0x7e89077e01f0,0x7e89077e01f2) allocated by thread T0 here: #0 0x6ffffe84aa83 in HeapAlloc /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt\lib/asan/asan_malloc_win.cpp:230:3 #1 0x6ffffe44016b in msvcrt_heap_alloc .../wine/dlls/msvcrt/heap.c:71:12 #2 0x6ffffe440739 in malloc .../wine/dlls/msvcrt/heap.c:436:15 #3 0x6fffff6b0afa in LsaLookupSids .../wine/dlls/advapi32/lsa.c:636:24 #4 0x00014002688e in test_LsaLookupSids .../wine/dlls/advapi32/tests/lsa.c:379:14 #5 0x000140024b17 in func_lsa .../wine/dlls/advapi32/tests/lsa.c:514:5 #6 0x00014009f9ee in run_test .../wine/include/wine/test.h:765:5 #7 0x00014009f531 in main .../wine/include/wine/test.h:884:12 #8 0x0001400a0ea3 in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:58:11 #9 0x6fffffc3565e in BaseThreadInitThunk .../wine/dlls/kernel32/thread.c:61:24 #10 0x6fffffdbbb1a in call_seh_handlers .../wine/dlls/ntdll/signal_x86_64.c:223:28 SUMMARY: AddressSanitizer: heap-buffer-overflow .../wine/dlls/advapi32/security.c:1212:9 in split_domain_account Shadow bytes around the buggy address: 0x7e89077dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7e89077dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7e89077e0000: fa fa 00 00 fa fa 02 fa fa fa 04 fa fa fa 02 fa 0x7e89077e0080: fa fa 04 fa fa fa 02 fa fa fa 04 fa fa fa 02 fa 0x7e89077e0100: fa fa 04 fa fa fa 02 fa fa fa 04 fa fa fa 00 00 =>0x7e89077e0180: fa fa fd fd fa fa fd fd fa fa fd fd fa[fa]02 fa 0x7e89077e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7e89077e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7e89077e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7e89077e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7e89077e0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==advapi32_test.exe==1208==ABORTING ``` -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7574

1 1

[PATCH 0/5] MR7573: PDB rewrite #1
by eric pouech (＠epo) March 14, 2025

March 14, 2025

This serie is the first of a long serie for rewriting the PDB debug format support in dbnghelp. For historical reasons, builtin dbghelp always fully loads every debug information (type, symbol...) for a given module, and transforms it into an internal representation (common to all debug formats: stabs, dwarf*, PDB...). This turns out to be slow and memory hungry. For example, using a chromium based DLL, where PDB file breaks the 4G size barrier, load time of debug info is ~80s, and requires ~20GB of virtual memory. Target of rewrite: - break monolothic approach in dbghelp to allow finer granularity in what's loaded (moving to a per compilation unit approach instead of full module) - reduce memory usage (for above example, current rewrite state is 20MB of virtual memory, and <4s of load time) - (potential) degradation of performance for some requests + may need to load/peruse additional information (not loaded at once) + request code hasn't been optimized for performance (on purpose), so that we can balance performance vs in-process memory (caching some more bits) We start with some series about cleanup, fixes, optimisation in dbghelp (that will favor all debug formats, not only PDB). This serie: - fixes a crash for .DBG file - fixes >4G PDB loading (so that we can measure improvements ;-) - introduces a new approach for internal vector representation (reduces memory usage), - some cleanup, -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7573

2 5

[PATCH v9 0/3] MR7542: ws2_32: Implement WSALookupService for Bluetooth device discovery.
by Vibhav Pant (＠vibhavp) March 14, 2025

March 14, 2025

This MR adds an initial implementation of the winsock `WSALookupsService*` methods for performing Bluetooth device discovery (`LUP_CONTAINERS`). Pending !7472, the code will also eventually support performing device inquiry scans. -- v9: ws2_32: Implement WSALookupServiceNext for Bluetooth device discovery. https://gitlab.winehq.org/wine/wine/-/merge_requests/7542

3 5

[PATCH 0/1] MR7572: imm32: Add a stub for CtfImmHideToolbarWnd.
by Tim Clem (＠tclem) March 14, 2025

March 14, 2025

Needed by the Guild Wars 2 installer. -- The installer fetches this with GetProcAddress. It was fine when the function was missing, but now tries to call the .spec stub added in 7a92a33b. See also !5479. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7572

3 2

[PATCH v9 0/6] MR7569: Draft: mfplat/tests: Add tests for Byte Stream Timestamps.
by Brendan McGrath (＠redmcg) March 14, 2025

March 14, 2025

This MR adds tests to `mfplat` to illustrate the timestamp values output on the samples for the respective Byte Stream handlers. I have also included a fix for a bug in `winegstreamer` (and copied to `mfsrcsnk`) where a `NULL` value for the `pguidTimeFormat` parameter in `IMFMediaSource::Start` causes a segmentation fault. On Windows this is allowed. It is included in this MR as the `mfplat` tests pass NULL (so without this fix, the tests crash). -- v9: mfplat/tests: Add tests for Byte Stream Timestamps. mfsrcsnk: Allow NULL for time_format. winegstreamer: Allow NULL for time_format. mfplat/tests: Fix leak of media source. mfplat/tests: Fix leak of media events. mfplat/tests: Fix crash in MFShutdown on Windows. https://gitlab.winehq.org/wine/wine/-/merge_requests/7569

2 6

[PATCH v8 0/7] MR7472: winebth.sys part 6: Add support for device inquiry/scanning.
by Vibhav Pant (＠vibhavp) March 14, 2025

March 14, 2025

-- v8: bluetoothapis/tests: Add tests for BluetoothFindNextDevice. bluetoothapis: Implement BluetoothFindNextDevice. bluetoothapis/tests: Add tests for BluetoothFindFirstDevice, BluetoothFindDeviceClose. bluetoothapis: Implement BluetoothFindFirstDevice and BluetoothFindDeviceClose. https://gitlab.winehq.org/wine/wine/-/merge_requests/7472

3 16

[PATCH v8 0/5] MR7569: Draft: mfplat/tests: Add tests for Byte Stream Timestamps.
by Brendan McGrath (＠redmcg) March 14, 2025

March 14, 2025

This MR adds tests to `mfplat` to illustrate the timestamp values output on the samples for the respective Byte Stream handlers. I have also included a fix for a bug in `winegstreamer` (and copied to `mfsrcsnk`) where a `NULL` value for the `pguidTimeFormat` parameter in `IMFMediaSource::Start` causes a segmentation fault. On Windows this is allowed. It is included in this MR as the `mfplat` tests pass NULL (so without this fix, the tests crash). -- v8: mfplat/tests: Add tests for Byte Stream Timestamps. mfsrcsnk: Allow NULL for time_format. winegstreamer: Allow NULL for time_format. mfplat/tests: Fix leak of media source. mfplat/tests: Fix leak of media events. https://gitlab.winehq.org/wine/wine/-/merge_requests/7569

2 5

[PATCH v7 0/3] MR7569: Draft: mfplat/tests: Add tests for Byte Stream Timestamps.
by Brendan McGrath (＠redmcg) March 13, 2025

March 13, 2025

This MR adds tests to `mfplat` to illustrate the timestamp values output on the samples for the respective Byte Stream handlers. I have also included a fix for a bug in `winegstreamer` (and copied to `mfsrcsnk`) where a `NULL` value for the `pguidTimeFormat` parameter in `IMFMediaSource::Start` causes a segmentation fault. On Windows this is allowed. It is included in this MR as the `mfplat` tests pass NULL (so without this fix, the tests crash). -- v7: mfplat/tests: Add tests for Byte Stream Timestamps. https://gitlab.winehq.org/wine/wine/-/merge_requests/7569

3 5

Re: [PATCH v4 0/1] MR7544: ieframe: Enter reallocation path one position earlier (ASan). - approved
by Alexandre Julliard (＠julliard) March 13, 2025

March 13, 2025

This merge request was approved by Alexandre Julliard. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7544

1 0

Re: [PATCH v3 0/4] MR7541: comctl32/tests: Run LVM_GETORIGIN tests on v6. - approved
by Alexandre Julliard (＠julliard) March 13, 2025

March 13, 2025

This merge request was approved by Alexandre Julliard. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7541

1 0