[Bug 20849] New: read buffer overflow in CRYPT_RemoveStringFromMultiString() triggered by crypt32/tests/oid.c

http://bugs.winehq.org/show_bug.cgi?id=20849

Summary: read buffer overflow in
                    CRYPT_RemoveStringFromMultiString() triggered by
                    crypt32/tests/oid.c
           Product: Wine
           Version: 1.1.33
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Keywords: source, testcase
          Severity: normal
          Priority: P2
         Component: crypt32
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

http://kegel.com/wine/valgrind/logs/2009-11-18-21.51/vg-crypt32_oid.txt
says
 Invalid read of size 1
   at  memmove (mc_replace_strmem.c:613)
   by  CRYPT_RemoveStringFromMultiString (oid.c:885)
   by  CryptUnregisterDefaultOIDFunction (oid.c:1010)
   by  test_registerDefaultOIDFunction (oid.c:437)
   by  func_oid (oid.c:601)
   by  run_test (test.h:535)
   by  main (test.h:585)
 Address 0x7f040ed4 is 0 bytes after a block of size 44 alloc'd
   at  notify_alloc (heap.c:279)
   by  RtlAllocateHeap (heap.c:1521)
   by  CryptMemAlloc (main.c:125)
   by  CRYPT_GetDefaultOIDDlls (oid.c:930)
   by  CryptUnregisterDefaultOIDFunction (oid.c:1009)
   by  test_registerDefaultOIDFunction (oid.c:437)

This is near the code changed in
  http://www.winehq.org/pipermail/wine-cvs/2009-November/061282.html

The error persists with the latest wine sources.

[Bug 20849] read buffer overflow in CRYPT_RemoveStringFromMultiString() triggered by crypt32/tests/oid.c

http://bugs.winehq.org/show_bug.cgi?id=20849

--- Comment #1 from Juan Lang   2009-11-29 12:04:13 ---
(In reply to comment #0)
> This is near the code changed in
>   http://www.winehq.org/pipermail/wine-cvs/2009-November/061282.html

This change in fact removed an uninitialized memory reference, so reverting it
doesn't make it better.

[Bug 20849] read buffer overflow in CRYPT_RemoveStringFromMultiString() triggered by crypt32/tests/oid.c

http://bugs.winehq.org/show_bug.cgi?id=20849

--- Comment #2 from Juan Lang   2009-11-29 13:45:26 ---
Patch sent:
http://www.winehq.org/pipermail/wine-patches/2009-November/081904.html

[Bug 20849] read buffer overflow in CRYPT_RemoveStringFromMultiString() triggered by crypt32/tests/oid.c

http://bugs.winehq.org/show_bug.cgi?id=20849

Juan Lang  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #3 from Juan Lang   2009-11-30 10:56:37 ---
Fixed by commit f2040b772544ebc434fa82a27713aa3a248c1b45.

[Bug 20849] read buffer overflow in CRYPT_RemoveStringFromMultiString() triggered by crypt32/tests/oid.c

http://bugs.winehq.org/show_bug.cgi?id=20849

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #4 from Alexandre Julliard   2009-12-04 12:16:40 ---
Closing bugs fixed in 1.1.34.