[Bug 20860] New: Read buffer overflow in INTERNET_SendCallback in wininet... calling strlen on non-nul-terminated buffer?

http://bugs.winehq.org/show_bug.cgi?id=20860

Summary: Read buffer overflow in INTERNET_SendCallback in
                    wininet... calling strlen on non-nul-terminated
                    buffer?
           Product: Wine
           Version: 1.1.33
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Keywords: download, source, testcase
          Severity: normal
          Priority: P2
         Component: wininet
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

The sixth error in
http://kegel.com/wine/valgrind/logs/2009-11-27-12.53/vg-urlmon_protocol.txt
is

Invalid read of size 2
    at  strlenW (unicode.h:216)
    by  heap_strdupW (internet.h:65)
    by  INTERNET_SendCallback (utility.c:313)
    by  SendAsyncCallbackProc (utility.c:351)
    by  INTERNET_WorkerThreadFunc (internet.c:3128)
    by  worker_thread_proc (threadpool.c:114)
  Address 0x7f0ccac6 is 0 bytes after a block of size 14 alloc'd
    at  RtlAllocateHeap (heap.c:1697)
    by  SendAsyncCallback (utility.c:380)
    by  FTP_Connect (ftp.c:2447)
    by  INTERNET_InternetOpenUrlW (internet.c:2860)
    by  AsyncInternetOpenUrlProc (internet.c:2946)
    by  INTERNET_WorkerThreadFunc (internet.c:3128)

It looks like wininet's INTERNET_SendCallback() function
is using strlen when it shouldn't... it's even passed the
length as a parameter?

[Bug 20860] Read buffer overflow in INTERNET_SendCallback in wininet... calling strlen on non-nul-terminated buffer?

http://bugs.winehq.org/show_bug.cgi?id=20860

--- Comment #1 from Juan Lang   2009-12-03 20:19:42 ---
The error is in the caller, which is passing too short a buffer.  I'll send a
patch for this error, but others remain, especially in ftp.c.  Here's one:

SendAsyncCallback(&hIC->hdr, dwContext,
INTERNET_STATUS_CONNECTED_TO_SERVER,
            &socketAddr, sock_namelen);

Note that utility.c assumes the lpvStatusInfo is a wide string, not a socket
address.  Unless FTP cannot be used in async mode (I don't really know), this
is clearly bogus.

[Bug 20860] Read buffer overflow in INTERNET_SendCallback in wininet... calling strlen on non-nul-terminated buffer?

http://bugs.winehq.org/show_bug.cgi?id=20860

--- Comment #2 from Juan Lang   2009-12-03 20:21:28 ---
Patch sent:
http://www.winehq.org/pipermail/wine-patches/2009-December/082211.html

[Bug 20860] Read buffer overflow in INTERNET_SendCallback in wininet... calling strlen on non-nul-terminated buffer?

http://bugs.winehq.org/show_bug.cgi?id=20860

Hans Leidekker  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #3 from Hans Leidekker   2009-12-04 06:49:18 ---
I submitted a patch for the bug mentioned in comment #1:
http://www.winehq.org/pipermail/wine-patches/2009-December/082227.html

[Bug 20860] Read buffer overflow in INTERNET_SendCallback in wininet... calling strlen on non-nul-terminated buffer?

http://bugs.winehq.org/show_bug.cgi?id=20860

Juan Lang  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #4 from Juan Lang   2009-12-04 09:44:45 ---
Fixed by commit b967fde0a86e5adaa7233d76b4691d6a5f5686ad.

Hans helpfully fixed the other bug I pointed out in
5f082498319ce279c7b5dfc381a2808dd76066fd, and even added tests--w00t!  Thanks
Hans.

[Bug 20860] Read buffer overflow in INTERNET_SendCallback in wininet... calling strlen on non-nul-terminated buffer?

http://bugs.winehq.org/show_bug.cgi?id=20860

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #5 from Alexandre Julliard   2009-12-04 12:16:41 ---
Closing bugs fixed in 1.1.34.