[Bug 45254] New: Buffer overflow, X file children MAX_CHILDREN limit too small, crashes BIONICLE: The Legend of Mata Nui

https://bugs.winehq.org/show_bug.cgi?id=45254

Bug ID: 45254
           Summary: Buffer overflow, X file children MAX_CHILDREN limit
                    too small, crashes BIONICLE: The Legend of Mata Nui
           Product: Wine
           Version: unspecified
          Hardware: x86
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: directx-d3dxof
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

In dlls/d3dxof/d3dxof_private.h MAX_CHILDREN is defined as 200, which is too
small a buffer for some existing DirectX model .X files:

https://github.com/wine-mirror/wine/blob/4102d8a0dc1b02d37d834f17d1925f3b0de...

In dlls/d3dxof/parsing.c there is actually a warning if that number is
exceeded, but the bounds checking happens after the buffer would be overflown,
so it may read the wrong value or simply crash instead:

https://github.com/wine-mirror/wine/blob/99a5afc09b1e8928a2b3270ce67784083d2...

Native Windows does not appear to impose a hard limit, or if there is one it is
larger than 0xFFFF (the highest size I tested).

This limitation impacts at least one Windows application, namely the game
BIONICLE: The Legend of Mata Nui.

This would impact Wine on all platforms.

GitHub issue for reference:
https://github.com/TheLegendOfMataNui/game-issues/issues/110

[Bug 45254] Buffer overflow, X file children MAX_CHILDREN limit too small, crashes BIONICLE: The Legend of Mata Nui

https://bugs.winehq.org/show_bug.cgi?id=45254

Ken Sharp  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download
            Version|unspecified                 |3.9

[Bug 45254] Buffer overflow, X file children MAX_CHILDREN limit too small, crashes BIONICLE: The Legend of Mata Nui

https://bugs.winehq.org/show_bug.cgi?id=45254

tokktokk  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 45254] Buffer overflow, X file children MAX_CHILDREN limit too small, crashes BIONICLE: The Legend of Mata Nui

https://bugs.winehq.org/show_bug.cgi?id=45254

Matteo Bruni  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
                URL|                            |http://biomediaproject.com/
                   |                            |bmp/the-legend-of-mata-nui/
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Matteo Bruni  ---
Thanks for the bug report, I'm afraid that's probably not the only shortcoming
of Wine's d3dxof...

[Bug 45254] Buffer overflow, X file children MAX_CHILDREN limit too small, crashes BIONICLE: The Legend of Mata Nui

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=45254

joaopa  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from joaopa  ---
Bug still occurs with wine-6.20.