[PATCH 0/1] MR11282: regedit: Avoid heap-buffer-overflow in regedit with REG_MULTI_SZ (ASan).
Happened when watching a leftover from winetest: ``` $WINEPREFIX/user.reg: [WineTest] 1735348650 #time=1db58c643eafd1e "CapitalsOfEurope"=str(7):"Brussels\0Paris\0%PATH%" ``` <details> <summary>ASan details</summary> ``` ASAN_OPTIONS="halt_on_error=0:allocator_may_return_null=1:strict_memcmp=0:windows_hook_rtl_allocators=1:detect_leaks=0:log_path=\"C:\\asan_\"" wine regedit gdb-multiarch -q --pid $(pidof 'C:\windows\system32\regedit.exe') set width 0 set pagination off set backtrace past-main handle SIGSEGV nostop noprint handle SIGUSR1 nostop noprint source tools/gdbunwind.py #b ReportError b Die cont set osabi Windows bt (gdb) cont Continuing. [Detaching after fork from child process 2539724] Breakpoint 2, __sanitizer::Die() () at /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_termination.cpp:51 warning: 51 /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_termination.cpp: Datei oder Verzeichnis nicht gefunden (gdb) bt #0 __sanitizer::Die() () at /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_termination.cpp:51 #1 0x00006ffffe616e73 in ~ScopedInErrorReport () at /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_report.cpp:221 #2 0x00006ffffe615980 in ReportGenericError () at /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_report.cpp:534 #3 0x00006ffffe617297 in __asan_report_load2 () at /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_rtl.cpp:129 #4 0x00000001400107f6 in MakeMULTISZDisplayable (multi=0x7ec8f2a04c2e L"%PATH%") at programs/regedit/listview.c:88 #5 0x00000001400104ca in format_value_data (hwndLV=<optimized out>, index=<optimized out>, type=<optimized out>, data=<optimized out>, size=<optimized out>) at programs/regedit/listview.c:127 #6 0x0000000140010afe in AddEntryToList (hwndLV=<optimized out>, Name=<optimized out>, dwValType=<optimized out>, ValBuf=<optimized out>, dwCount=<optimized out>, pos=<optimized out>) at programs/regedit/listview.c:185 #7 0x0000000140011a11 in RefreshListView (hwndLV=0x40136, hKeyRoot=<optimized out>, keyPath=<optimized out>, highlightValue=<optimized out>) at programs/regedit/listview.c:420 #8 0x0000000140004277 in OnTreeSelectionChanged (hwndTV=<optimized out>, hwndLV=<optimized out>, hItem=0x7ffffe7e8b20, bRefreshLV=1) at programs/regedit/childwnd.c:155 #9 0x0000000140003175 in treeview_notify (hWnd=<optimized out>, message=<optimized out>, wParam=<optimized out>, lParam=<optimized out>) at programs/regedit/childwnd.c:319 #10 0x0000000140001f70 in ChildWndProc (hWnd=<optimized out>, message=78, wParam=<optimized out>, lParam=<optimized out>) at programs/regedit/childwnd.c:563 #11 0x00006ffffd1293c1 in WINPROC_wrapper (proc=0x1000000000000001, hwnd=0x1, msg=0, wParam=18446742974197923840, lParam=140737456961312) at dlls/user32/winproc.c:85 #12 0x00006ffffd127f6d in call_window_proc (hwnd=0x30158, msg=78, wp=2002, lp=140737456961312, result=0x7ffffe20f538, arg=0x140001820 <ChildWndProc>) at dlls/user32/winproc.c:110 #13 0x00006ffffd1280cf in dispatch_win_proc_params (params=0x7ffffe20f608) at dlls/user32/winproc.c:712 #14 0x00006ffffd112761 in dispatch_send_message (params=0x7ffffe20f608, wparam=2002, lparam=140737456961312) at dlls/user32/message.c:567 #15 0x00006ffffd1126e7 in SendMessageW (hwnd=<optimized out>, msg=<optimized out>, wparam=2002, lparam=140737456961312) at dlls/user32/message.c:586 #16 0x00006ffffdcf3db4 in TREEVIEW_SendRealNotify (infoPtr=<optimized out>, code=4294966845, hdr=0x7ffffe20f720) at dlls/comctl32/treeview.c:517 #17 0x00006ffffdcf7392 in TREEVIEW_SendTreeviewNotify (infoPtr=<optimized out>, code=<optimized out>, action=<optimized out>, mask=<optimized out>, oldItem=<optimized out>, newItem=<optimized out>) at dlls/comctl32/treeview.c:593 #18 0x00006ffffdcf5dc3 in TREEVIEW_DoSelectItem (infoPtr=0x7ffffe23e8a0, action=<optimized out>, newSelect=0x7ffffe7e8b20, cause=1) at dlls/comctl32/treeview.c:4613 #19 0x00006ffffdceff1e in TREEVIEW_LButtonDown (infoPtr=0x7ffffe23e8a0, lParam=<optimized out>) at dlls/comctl32/treeview.c:4420 #20 0x00006ffffdce71bc in TREEVIEW_WindowProc (hwnd=0x30156, uMsg=513, wParam=1, lParam=12058728) at dlls/comctl32/treeview.c:5885 #21 0x00006ffffd1293c1 in WINPROC_wrapper (proc=0x1000000000000001, hwnd=0x1, msg=0, wParam=18446742974197923840, lParam=12058728) at dlls/user32/winproc.c:85 #22 0x00006ffffd127f6d in call_window_proc (hwnd=0x30156, msg=513, wp=1, lp=12058728, result=0x7ffffe20fb48, arg=0x6ffffdce6ee0 <TREEVIEW_WindowProc>) at dlls/user32/winproc.c:110 #23 0x00006ffffd1280cf in dispatch_win_proc_params (params=0x7ffffe20fba8) at dlls/user32/winproc.c:712 #24 0x00006ffffd11317e in dispatch_message (msg=0x7ffffe20fca0, ansi=<optimized out>) at dlls/user32/message.c:804 #25 0x00006ffffd11324d in DispatchMessageW (msg=0x7ffffe20fca0) at dlls/user32/message.c:890 #26 0x000000014001201f in wWinMain (hInstance=<optimized out>, hPrevInstance=<optimized out>, lpCmdLine=<optimized out>, nCmdShow=<optimized out>) at programs/regedit/main.c:183 #27 0x000000014001f433 in wmain (argc=<optimized out>, argv=<optimized out>) at dlls/msvcrt/crt_wwinmain.c:63 (gdb) ================================================================= ==376==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ec8f2a04c3c at pc 0x0001400107f6 bp 0x7ffffe20e760 sp 0x7ffffe20e7a8 READ of size 2 at 0x7ec8f2a04c3c thread T0 #0 0x0001400107f5 in MakeMULTISZDisplayable programs/regedit/listview.c:88 #1 0x0001400104c9 in format_value_data programs/regedit/listview.c:127 #2 0x000140010afd in AddEntryToList programs/regedit/listview.c:185 #3 0x000140011a10 in RefreshListView programs/regedit/listview.c:420 #4 0x000140004276 in OnTreeSelectionChanged programs/regedit/childwnd.c:155 #5 0x000140003174 in treeview_notify programs/regedit/childwnd.c:319 #6 0x000140001f6f in ChildWndProc programs/regedit/childwnd.c:563 #7 0x6ffffd1293c0 in WINPROC_wrapper dlls/user32/winproc.c:85 #8 0x6ffffd127f6c in call_window_proc dlls/user32/winproc.c:110 #9 0x6ffffd1280ce in dispatch_win_proc_params dlls/user32/winproc.c #10 0x6ffffd112760 in dispatch_send_message dlls/user32/message.c:567 #11 0x6ffffd1126e6 in SendMessageW dlls/user32/message.c:586 #12 0x6ffffdcf3db3 in TREEVIEW_SendRealNotify dlls/comctl32/treeview.c:517 #13 0x6ffffdcf7391 in TREEVIEW_SendTreeviewNotify dlls/comctl32/treeview.c:593 #14 0x6ffffdcf5dc2 in TREEVIEW_DoSelectItem dlls/comctl32/treeview.c:4613 #15 0x6ffffdceff1d in TREEVIEW_LButtonDown dlls/comctl32/treeview.c:4420 #16 0x6ffffdce71bb in TREEVIEW_WindowProc dlls/comctl32/treeview.c:5885 #17 0x6ffffd1293c0 in WINPROC_wrapper dlls/user32/winproc.c:85 #18 0x6ffffd127f6c in call_window_proc dlls/user32/winproc.c:110 #19 0x6ffffd1280ce in dispatch_win_proc_params dlls/user32/winproc.c #20 0x6ffffd11317d in dispatch_message dlls/user32/message.c:804 #21 0x6ffffd11324c in DispatchMessageW dlls/user32/message.c:890 #22 0x00014001201e in wWinMain programs/regedit/main.c:183 #23 0x00014001f432 in wmain dlls/msvcrt/crt_wwinmain.c:63 0x7ec8f2a04c3d is located 0 bytes after 45-byte region [0x7ec8f2a04c10,0x7ec8f2a04c3d) allocated by thread T0 here: #0 0x6ffffe60d911 in malloc /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:87:3 #1 0x0001400118a7 in RefreshListView programs/regedit/listview.c:407 #2 0x000140004276 in OnTreeSelectionChanged programs/regedit/childwnd.c:155 #3 0x000140003174 in treeview_notify programs/regedit/childwnd.c:319 #4 0x000140001f6f in ChildWndProc programs/regedit/childwnd.c:563 #5 0x6ffffd1293c0 in WINPROC_wrapper dlls/user32/winproc.c:85 #6 0x6ffffd127f6c in call_window_proc dlls/user32/winproc.c:110 #7 0x6ffffd1280ce in dispatch_win_proc_params dlls/user32/winproc.c #8 0x6ffffd112760 in dispatch_send_message dlls/user32/message.c:567 #9 0x6ffffd1126e6 in SendMessageW dlls/user32/message.c:586 #10 0x6ffffdcf3db3 in TREEVIEW_SendRealNotify dlls/comctl32/treeview.c:517 #11 0x6ffffdcf7391 in TREEVIEW_SendTreeviewNotify dlls/comctl32/treeview.c:593 #12 0x6ffffdcf5dc2 in TREEVIEW_DoSelectItem dlls/comctl32/treeview.c:4613 #13 0x6ffffdceff1d in TREEVIEW_LButtonDown dlls/comctl32/treeview.c:4420 #14 0x6ffffdce71bb in TREEVIEW_WindowProc dlls/comctl32/treeview.c:5885 #15 0x6ffffd1293c0 in WINPROC_wrapper dlls/user32/winproc.c:85 #16 0x6ffffd127f6c in call_window_proc dlls/user32/winproc.c:110 #17 0x6ffffd1280ce in dispatch_win_proc_params dlls/user32/winproc.c #18 0x6ffffd11317d in dispatch_message dlls/user32/message.c:804 #19 0x6ffffd11324c in DispatchMessageW dlls/user32/message.c:890 #20 0x00014001201e in wWinMain programs/regedit/main.c:183 #21 0x00014001f432 in wmain dlls/msvcrt/crt_wwinmain.c:63 SUMMARY: AddressSanitizer: heap-buffer-overflow programs/regedit/listview.c:88 in MakeMULTISZDisplayable ``` </details> -- https://gitlab.winehq.org/wine/wine/-/merge_requests/11282
From: Bernhard Übelacker <bernhardu@mailbox.org> Happened when watching a leftover from winetest: $WINEPREFIX/user.reg: [WineTest] 1735348650 #time=1db58c643eafd1e "CapitalsOfEurope"=str(7):"Brussels\0Paris\0%PATH%" --- programs/regedit/listview.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/programs/regedit/listview.c b/programs/regedit/listview.c index 757ce41855c..a99b22b8e4e 100644 --- a/programs/regedit/listview.c +++ b/programs/regedit/listview.c @@ -401,7 +401,7 @@ BOOL RefreshListView(HWND hwndLV, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR highli /* account for the terminator char */ max_val_name_len++; - max_val_size++; + max_val_size += sizeof(WCHAR); valName = malloc(max_val_name_len * sizeof(WCHAR)); valBuf = malloc(max_val_size); @@ -416,7 +416,7 @@ BOOL RefreshListView(HWND hwndLV, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR highli valType = 0; errCode = RegEnumValueW(hKey, index, valName, &valNameLen, NULL, &valType, valBuf, &valSize); if (errCode != ERROR_SUCCESS) goto done; - valBuf[valSize] = 0; + *(WCHAR*)(valBuf + valSize) = 0; AddEntryToList(hwndLV, valName[0] ? valName : NULL, valType, valBuf, valSize, -1); } -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/11282
participants (2)
-
Bernhard Übelacker -
Bernhard Übelacker (＠bernhardu)