[Bug 28766] New: DIB engine multiple invalid memory accesses

http://bugs.winehq.org/show_bug.cgi?id=28766

Bug #: 28766
           Summary: DIB engine multiple invalid memory accesses
           Product: Wine
           Version: 1.3.30
          Platform: x86
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: gdi32
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]
    Classification: Unclassified

In gdi32/tests, running "make bitmap.ok dib.ok font.ok pen.ok"
makes Valgrind go bonkers.   Huw asked for a bug to track these,
and said one big bug would suffice.

I'll attach the initial log, and will do more valgrind runs on request.

[Bug 28766] DIB engine multiple invalid memory accesses

http://bugs.winehq.org/show_bug.cgi?id=28766

--- Comment #1 from Dan Kegel  2011-10-17 09:48:29 CDT ---
Created attachment 36948
  --> http://bugs.winehq.org/attachment.cgi?id=36948
Valgrind log of bitmap.ok, dib.ok, pen.ok

[Bug 28766] DIB engine multiple invalid memory accesses

http://bugs.winehq.org/show_bug.cgi?id=28766

--- Comment #2 from Bruno Jesus  ---
Is this still an issue in the latest development version of wine?

[Bug 28766] DIB engine multiple invalid memory accesses

https://bugs.winehq.org/show_bug.cgi?id=28766

--- Comment #3 from Austin English  ---
(In reply to Bruno Jesus from comment #2)
> Is this still an issue in the latest development version of wine?

Definitely.

==10523== Conditional jump or move depends on uninitialised value(s)
==10523==    at 0x530FA72: GetDIBits (dib.c:1248)
==10523==    by 0x496AFE6: test_dibsections (bitmap.c:542)
==10523==    by 0x4990928: func_bitmap (bitmap.c:5629)
==10523==    by 0x49EBCE4: run_test (test.h:584)
==10523==    by 0x49EC0D3: main (test.h:654)
==10523==  Uninitialised value was created by a stack allocation
==10523==    at 0x496A45A: test_dibsections (bitmap.c:415)
==10523==

==10523== Source and destination overlap in memcpy(0x5aa0000, 0x5aa0000, 16)
==10523==    at 0x400ACD3: memcpy (in
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==10523==    by 0x532C6FD: convert_to_8 (primitives.c:3264)
==10523==    by 0x5314F32: convert_bitmapinfo (dc.c:227)
==10523==    by 0x5310131: GetDIBits (dib.c:1395)
==10523==    by 0x496D3B4: test_dibsections (bitmap.c:841)
==10523==    by 0x4990928: func_bitmap (bitmap.c:5629)
==10523==    by 0x49EBCE4: run_test (test.h:584)
==10523==    by 0x49EC0D3: main (test.h:654)
==10523==

wine-1.7.17-92-ge2bf516

[Bug 28766] DIB engine multiple invalid memory accesses

https://bugs.winehq.org/show_bug.cgi?id=28766

--- Comment #4 from Austin English  ---
Another one:
==30078== Invalid read of size 4
==30078==    at 0x53EF595: CreatePolyPolygonRgn (region.c:2672)
==30078==    by 0x53E79DA: PATH_PathToRegion (path.c:412)
==30078==    by 0x53E7A69: PATH_FillPath (path.c:677)
==30078==    by 0x53E98CB: nulldrv_FillPath (path.c:2149)
==30078==    by 0x53E91B2: FillPath (path.c:746)
==30078==    by 0x4DB0765: test_path_state (path.c:230)
==30078==    by 0x4DB0FB8: func_path (path.c:740)
==30078==    by 0x4D57467: main (test.h:584)
==30078==  Address 0x4823a08 is 16 bytes after a block of size 16 alloc'd
==30078==    at 0x7BC4D7D7: RtlAllocateHeap (heap.c:233)
==30078==    by 0x53E770B: alloc_gdi_path (path.c:122)
==30078==    by 0x53E7784: PATH_FlattenPath (path.c:339)
==30078==    by 0x53E790B: PATH_PathToRegion (path.c:377)
==30078==    by 0x53E7A69: PATH_FillPath (path.c:677)
==30078==    by 0x53E98CB: nulldrv_FillPath (path.c:2149)
==30078==    by 0x53E91B2: FillPath (path.c:746)
==30078==    by 0x4DB0765: test_path_state (path.c:230)
==30078==    by 0x4DB0FB8: func_path (path.c:740)
==30078==    by 0x4D57467: main (test.h:584)
==30078== 
{

[Bug 28766] DIB engine multiple invalid memory accesses

https://bugs.winehq.org/show_bug.cgi?id=28766

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download, source, testcase,
                   |                            |valgrind

[Bug 28766] DIB engine multiple invalid memory accesses

https://bugs.winehq.org/show_bug.cgi?id=28766

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 28766] DIB engine multiple invalid memory accesses

https://bugs.winehq.org/show_bug.cgi?id=28766

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 28766] DIB engine multiple invalid memory accesses

https://bugs.winehq.org/show_bug.cgi?id=28766

[e-mail] changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #5 from [e-mail] ---
Hello,

For the reported:
==10523== Conditional jump or move depends on uninitialised value(s)
==10523==    at 0x530FA72: GetDIBits (dib.c:1248)
==10523==    by 0x496AFE6: test_dibsections (bitmap.c:542)
==10523==    by 0x4990928: func_bitmap (bitmap.c:5629)
==10523==    by 0x49EBCE4: run_test (test.h:584)
==10523==    by 0x49EC0D3: main (test.h:654)
==10523==  Uninitialised value was created by a stack allocation
==10523==    at 0x496A45A: test_dibsections (bitmap.c:415)

I've just sent the patch:
http://source.winehq.org/patches/data/108226

Cheers;
Marc

PS: the line in GetDIBits has changed, it is now:
==32731== Conditional jump or move depends on uninitialised value(s)
==32731==    at 0x55D1E5E: GetDIBits (dib.c:1256)
==32731==    by 0x506F202: test_dibsections (bitmap.c:542)
==32731==    by 0x5094CF2: func_bitmap (bitmap.c:5643)
==32731==    by 0x50F08CE: run_test (test.h:584)
==32731==    by 0x50F0CBC: main (test.h:654)
==32731==  Uninitialised value was created by a stack allocation
==32731==    at 0x506E676: test_dibsections (bitmap.c:415)
==32731==

[Bug 28766] DIB engine multiple invalid memory accesses

https://bugs.winehq.org/show_bug.cgi?id=28766

joaopa  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #6 from joaopa  ---
Does the bug still occur with current wine(4.0-rc1)?

[Bug 28766] DIB engine multiple invalid memory accesses

https://bugs.winehq.org/show_bug.cgi?id=28766

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Austin English  ---
(In reply to joaopa from comment #6)
> Does the bug still occur with current wine(4.0-rc1)?

Looks good in 4.0-rc2, aside from a couple test failures:
dc.c:639: Test failed: expected ret2 > 0, got 0
dc.c:654: Test failed: expected desc.nSize == sizeof(descr), got 0

[Bug 28766] DIB engine multiple invalid memory accesses

https://bugs.winehq.org/show_bug.cgi?id=28766

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #8 from Alexandre Julliard  ---
Closing bugs fixed in 4.0-rc3.