[Bug 46481] New: strftime has a buffer overflow

https://bugs.winehq.org/show_bug.cgi?id=46481

Bug ID: 46481
           Summary: strftime has a buffer overflow
           Product: Wine
           Version: 3.19
          Hardware: x86
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: msvcrt
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ArchLinux

Created attachment 63309
  --> https://bugs.winehq.org/attachment.cgi?id=63309
test-program

Steps:
1. Compile the attached program with mingw
2. Run the resulting executable

Expected outcome:
The program prints a number less than 2

Actual outcome:
The program prints 21 (I am in Eastern Standard Time)

This happens with both 32-bit and 64-bit executables.  If the buffer size is
decreased enough, this can smash the stack.

[Bug 46481] strftime has a buffer overflow

https://bugs.winehq.org/show_bug.cgi?id=46481

Fabian Maurer  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #1 from Fabian Maurer  ---
Confirming. The function is missing a check for the buffer size.

[Bug 46481] strftime has a buffer overflow

https://bugs.winehq.org/show_bug.cgi?id=46481

--- Comment #2 from Mathew Hodson  ---
https://source.winehq.org/git/wine.git/commitdiff/79188582f067b16e3aaebfad4a...

[Bug 46481] strftime has a buffer overflow

https://bugs.winehq.org/show_bug.cgi?id=46481

Fabian Maurer  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED
      Fixed by SHA1|                            |79188582f067b16e3aaebfad4a8
                   |                            |53d84f3a310cc

--- Comment #3 from Fabian Maurer  ---
Marking fixed as of 79188582f067b16e3aaebfad4a853d84f3a310cc.

[Bug 46481] strftime has a buffer overflow

https://bugs.winehq.org/show_bug.cgi?id=46481

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #4 from Alexandre Julliard  ---
Closing bugs fixed in 4.3.

[Bug 46481] strftime has a buffer overflow

https://bugs.winehq.org/show_bug.cgi?id=46481

Michael Stefaniuc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.0.x

[Bug 46481] strftime has a buffer overflow

https://bugs.winehq.org/show_bug.cgi?id=46481

Michael Stefaniuc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.0.x                       |---

--- Comment #5 from Michael Stefaniuc  ---
Removing the 4.0.x milestone from bug fixes included in 4.0.1.