[PATCH v2 0/1] MR11558: win32u: Fix off-by-one in kbd_tables_init_vsc2vk.

[Bernhard Übelacker (＠bernhardu)]

Found by ASan (unix).

<details>
<summary>ASan report details</summary>

```
ASAN_OPTIONS="halt_on_error=0:detect_leaks=0:log_exe_name=1:log_path=\"/home/bernhard/asan\"" wine cmd

ps aux | grep conhost
gdb-multiarch -q --pid 364794
b Die
cont

# pressed d key in the konsole with the running cmd


(gdb) bt
#0  __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:50
#1  0x00007fe0358fee3f in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffffeead316, __in_chrg=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:192
#2  0x00007fe0358fe4a0 in __asan::ReportGenericError (pc=140600888834656, bp=140737470193536, sp=sp@entry=140737470193528, addr=140600890957854, is_write=is_write@entry=false, access_size=2, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:497
#3  0x00007fe0358fe60e in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140737470193536, sp=sp@entry=140737470193528, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=2, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:497
#4  0x00007fe0358ff48c in __asan::__asan_report_load2 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:129
#5  0x00007fe03208ba60 in kbd_tables_init_vsc2vk (tables=0x7fe032362380 <kbdus_tables>, vsc2vk=0x7fe0157c4960) at dlls/win32u/input.c:434
#6  0x00007fe03209261a in NtUserMapVirtualKeyEx (code=68, type=<optimized out>, layout=<optimized out>) at dlls/win32u/input.c:1245
#7  0x00007fe032ad4106 in __wine_syscall_dispatcher () from dlls/ntdll/ntdll.so
#8  0x00007fe032ace093 in server_init_thread (data=data@entry=0x7ffffeda0000) at dlls/ntdll/unix/server.c:1818
#9  0x00007fe03585b1d6 in asan_thread_start (arg=0x7fe02f003000) at ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#10 0x00007fe03569e8bb in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:448
#11 0x00007fe03571c538 in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

=================================================================
==wine==364794==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7fe03229201e at pc 0x7fe03208ba60 bp 0x7ffffeeadf80 sp 0x7ffffeeadf78
READ of size 2 at 0x7fe03229201e thread T19
    #0 0x7fe03208ba5f in kbd_tables_init_vsc2vk dlls/win32u/input.c:434
    #1 0x7fe032092619 in NtUserMapVirtualKeyEx dlls/win32u/input.c:1245
    #2 0x7fe032ad4105 in __wine_syscall_dispatcher (dlls/ntdll/ntdll.so+0xcf105) (BuildId: 7bc5cb3f128a1e422fc0ae4549a1c6aa689df369)
    #3 0x7fe032ace092 in server_init_thread dlls/ntdll/unix/server.c:1818
    #4 0x7fe03585b1d5 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
    #5 0x7fe03569e8ba in start_thread nptl/pthread_create.c:448
    #6 0x7fe03571c537 in __clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x7fe03229201e is located 34 bytes before global variable 'vk_to_wchars1' defined in 'dlls/win32u/input.c:219:28' (0x7fe032292040) of size 44
0x7fe03229201e is located 0 bytes after global variable 'vsc_to_vk' defined in 'dlls/win32u/input.c:326:21' (0x7fe032291f20) of size 254
SUMMARY: AddressSanitizer: global-buffer-overflow dlls/win32u/input.c:434 in kbd_tables_init_vsc2vk
```

</details

--
  v2: win32u: Fix off-by-one in kbdus_tables.
 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11558

[PATCH v2 1/1] win32u: Fix off-by-one in kbdus_tables.

[Bernhard Übelacker]

From: Bernhard Übelacker <[e-mail]>

Found by ASan (unix).

Co-authored-by: Etaash Mathamsetty <[e-mail]>
---
 dlls/win32u/input.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/win32u/input.c b/dlls/win32u/input.c
index 71219aed5fe..20a10178b23 100644
--- a/dlls/win32u/input.c
+++ b/dlls/win32u/input.c
@@ -401,7 +401,7 @@ static const KBDTABLES kbdus_tables =
     .pKeyNames = (VSC_LPWSTR *)key_names,
     .pKeyNamesExt = (VSC_LPWSTR *)key_names_ext,
     .pusVSCtoVK = (USHORT *)vsc_to_vk,
-    .bMaxVSCtoVK = ARRAY_SIZE(vsc_to_vk),
+    .bMaxVSCtoVK = ARRAY_SIZE(vsc_to_vk) - 1,
     .pVSCtoVK_E0 = (VSC_VK *)vsc_to_vk_e0,
     .pVSCtoVK_E1 = (VSC_VK *)vsc_to_vk_e1,
     .fLocaleFlags = MAKELONG(0, KBD_VERSION),
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/11558

[PATCH v2 0/1] MR11558: win32u: Fix off-by-one in kbdus_tables.

[Bernhard Übelacker (＠bernhardu)]

v2:
- Avoid modifying `kbd_tables_init_vsc2vk`, instead change `kbdus_tables` definition.
- Add Co-authored-by.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11558#note_147762

[PATCH v2 0/1] MR11558: win32u: Fix off-by-one in kbdus_tables.

[Bernhard Übelacker (＠bernhardu)]

On Mon Aug  3 22:00:36 2026 +0000, Bernhard Übelacker wrote:
> changed this line in [version 2 of the diff](/wine/wine/-/merge_requests/11558/diffs?diff_id=286886&start_sha=3cbb0f1cc55f954218c4dfd5e9936daba6099354#c0e9abea64045e9b4299dedef42bd12721df8706_432_432)
> Thanks for spotting this, I did not carefully enough look at the `bMaxVSCtoVK` to see it shows the "maximum index" instead of "count elements".

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11558#note_147764

[PATCH v2 0/1] MR11558: win32u: Fix off-by-one in kbdus_tables. - approved

[Rémi Bernon (＠rbernon)]

This merge request was approved by Rémi Bernon.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11558