[PATCH 0/1] MR11733: wbemdisp: Avoid out-of-bounds read in objectpath_get_DisplayName.

[Bernhard Übelacker (＠bernhardu)]

Followup of 929b2a19cb.

Found by ASan.

In the call to `SysAllocStringLen` the copy does not stop at a terminating \0, therefore it reads beyond the end of the string constant.

[ASan 32-bit report](https://gitlab.winehq.org/bernhardu/wine/-/jobs/297496#L2785)

[ASan 64-bit report](https://gitlab.winehq.org/bernhardu/wine/-/jobs/297497#L2927)

<details>
<summary>ASan details</summary>

```
==wbemdisp_test.exe==1468==ERROR: AddressSanitizer: global-buffer-overflow on address 0x784dbb14 at pc 0x78595252 bp 0x0022f630 sp 0x0022f1fc
READ of size 138 at 0x784dbb14 thread T0
    #0 0x78595251 in __asan_memcpy /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:65:3
    #1 0x799a9867 in SysAllocStringLen dlls/oleaut32/oleaut.c:358:9
    #2 0x784ca369 in objectpath_get_DisplayName dlls/wbemdisp/locator.c:3717:17
    #3 0x0040588f in ISWbemObjectPath_get_DisplayName /builds/bernhardu/wine/build64/include/wbemdisp.h:2170:12
    #4 0x0040272f in test_ParseDisplayName dlls/wbemdisp/tests/wbemdisp.c:275:30
    #5 0x00401021 in func_wbemdisp dlls/wbemdisp/tests/wbemdisp.c:663:5
    #6 0x00408dd1 in run_test include/wine/test.h:780:5
    #7 0x004088eb in main include/wine/test.h
    #8 0x0040a5c5 in mainCRTStartup dlls/msvcrt/crt_main.c:70:11
    #9 0x7bcc381f in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x7b82381f)
    #10 0x7be36c2a in call_thread_func_wrapper (C:\windows\system32\ntdll.dll+0x7bc46c2a)
    #11 0x7be3759a in call_thread_func dlls/ntdll/signal_i386.c:502:9
0x784dbb14 is located 44 bytes before global variable '"objectpath_put_DisplayName"' defined in 'dlls/wbemdisp/locator.c:3733' (0x784dbb40) of size 27
  '"objectpath_put_DisplayName"' is ascii string 'objectpath_put_DisplayName'
0x784dbb14 is located 0 bytes after global variable 'L"winmgmts:"' defined in 'dlls/wbemdisp/locator.c:3717' (0x784dbb00) of size 20
SUMMARY: AddressSanitizer: global-buffer-overflow dlls/oleaut32/oleaut.c:358:9 in SysAllocStringLen
```

</details>

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11733

[PATCH 1/1] wbemdisp: Avoid out-of-bounds read in objectpath_get_DisplayName.

[Bernhard Übelacker]

From: Bernhard Übelacker <[e-mail]>

Followup of 929b2a19cb.

Found by ASan.
---
 dlls/wbemdisp/locator.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dlls/wbemdisp/locator.c b/dlls/wbemdisp/locator.c
index c3ad6fa50a2..ab58c5c2b0a 100644
--- a/dlls/wbemdisp/locator.c
+++ b/dlls/wbemdisp/locator.c
@@ -3714,7 +3714,8 @@ static HRESULT WINAPI objectpath_get_DisplayName( ISWbemObjectPath *iface, BSTR
     FIXME( "%p, %p semi-stub\n", objectpath, strDisplayName );
 
     if (FAILED( hr = IWbemPath_GetText( objectpath->path, WBEMPATH_GET_SERVER_TOO, &len, NULL ) )) return hr;
-    if (!(buf = SysAllocStringLen( L"winmgmts:", len + ARRAY_SIZE( L"winmgmts:" ) - 2 ) )) return E_OUTOFMEMORY;
+    if (!(buf = SysAllocStringLen( NULL, len + ARRAY_SIZE( L"winmgmts:" ) - 2 ) )) return E_OUTOFMEMORY;
+    lstrcpyW( buf, L"winmgmts:" );
     /* TODO: add 'authenticationLevel' and 'impersonationLevel' from the security object. Native also
      * includes 'Name', 'SoftwareElementID', 'SoftwareElementState' and 'TargetOperatingSystem' values.
      * The last three are currently missing from the properties. */
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/11733

[Bernhard Übelacker (＠bernhardu)]

CC: @cmccarthy

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11733#note_149612