[Bug 20985] New: Crash in CryptMsgUpdate under valgrind

http://bugs.winehq.org/show_bug.cgi?id=20985

Summary: Crash in CryptMsgUpdate under valgrind
           Product: Wine
           Version: 1.1.34
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: crypt32
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

http://kegel.com/wine/valgrind/logs/2009-12-10-03.53/vg-crypt32_msg.txt
shows a crash.  Adding +relay,+seh,+crypt shows a bit more:

001e:Call crypt32.CryptMsgUpdate(7f044948,07783e13,00000004,00000000)
ret=0774e9b4
trace:crypt:CryptMsgUpdate (0x7f044948, 0x7783e13, 4, 0)
001e:Call KERNEL32.LocalAlloc(00000000,00000011) ret=07be6df0
001e:Ret  KERNEL32.LocalAlloc() retval=7f044988 ret=07be6df0
err:seh:segv_handler Got unexpected trap 0
...
001e:Call KERNEL32.UnhandledExceptionFilter(7f21f5cc) ret=074b5deb
...
Unhandled exception: illegal instruction in 32-bit code (0x00000000).
Backtrace:
=>0 0x00000000 (0x7f21fc48)
  1 0x0d3fced4 CryptMsgUpdate+0xa0(hCryptMsg=0x7f0bd740, pbData="
",
cbData=4, fFinal=0) [dlls/crypt32/msg.c:2786] in crypt32 (0x7f21fc88)
  2 0x0cf429b4 test_data_msg_update+0x5b1() [dlls/crypt32/tests/msg.c:445] in
crypt32_test (0x7f21fd08)

(two logs are smashed together there, so pointers don't match exactly)

When run not under valgrind, the same crash happens, but is handled:

001c:Call crypt32.CryptMsgUpdate(00154948,7ec0ce13,00000004,00000000)
ret=7ebd79b4
trace:crypt:CryptMsgUpdate (0x154948, 0x7ec0ce13, 4, 0)
001c:Call KERNEL32.LocalAlloc(00000000,00000011) ret=7eb29df0
001c:Ret  KERNEL32.LocalAlloc() retval=00154988 ret=7eb29df0
trace:seh:raise_exception code=c0000005 flags=0 addr=(nil) ip=00000000 tid=001c
trace:seh:raise_exception  info[0]=00000000
trace:seh:raise_exception  info[1]=00000000
trace:seh:raise_exception  eax=00000000 ebx=7eb68ff4 ecx=00154988 edx=00000011
esi=00000000 edi=0032fc20
trace:seh:raise_exception  ebp=0032fbc8 esp=0032facc cs=0023 ds=002b es=002b
fs=0063 gs=006b flags=00010202
trace:seh:call_vectored_handlers calling handler at 0x7ed88f41 code=c0000005
flags=0
trace:seh:call_vectored_handlers handler at 0x7ed88f41 returned 0
trace:seh:call_stack_handlers calling handler at 0x7eb39d84 code=c0000005
flags=0
001c:Call ntdll.RtlUnwind(0032faf0,7eb39e1a,0032fa74,00000000) ret=7eb39e9f
001c:  eax=7eb00b15 ebx=7eb68ff4 ecx=0032fa74 edx=0032faf0 esi=0032faf0
edi=7eb39e1a ebp=0032f588 esp=0032f558 ds=002b es=002b fs=0063 gs=006b
flags=00000212
trace:seh:__regs_RtlUnwind code=c0000005 flags=2
trace:seh:__regs_RtlUnwind calling handler at 0x7efb47d4 code=c0000005 flags=2
trace:seh:__regs_RtlUnwind handler at 0x7efb47d4 returned 1
001c:Ret  ntdll.RtlUnwind() retval=00000000 ret=7eb39e9f
001c:  eax=00000000 ebx=7eb68ff4 ecx=0032fa74 edx=0032faf0 esi=0032faf0
edi=7eb39e1a ebp=0032f588 esp=0032f558 ds=002b es=002b fs=0063 gs=006b
flags=00000212
001c:Call KERNEL32.SetLastError(c0000005) ret=7eb39ca6
001c:Ret  KERNEL32.SetLastError() retval=c0000005 ret=7eb39ca6
001c:Ret  crypt32.CryptMsgUpdate() retval=00000000 ret=7ebd79b4

This is kind of mysterious.  I can't find the __TRY that applies
to that fault...
this could well be a valgrind bug, but I need to understand how
it works normally under wine.

[Bug 20985] Crash in CryptMsgUpdate under valgrind

http://bugs.winehq.org/show_bug.cgi?id=20985

--- Comment #1 from Juan Lang   2009-12-10 13:13:49 ---
(In reply to comment #0)
> http://kegel.com/wine/valgrind/logs/2009-12-10-03.53/vg-crypt32_msg.txt
> shows a crash.

Here's the bit from the backtrace that's relevant:
> 2 0x0cf429b4 test_data_msg_update+0x5b1() [dlls/crypt32/tests/msg.c:445] in
> crypt32_test (0x7f21fd08)

Here are the lines leading up to line 445 of tests/msg.c.  Notice the comments
:)
        /* Calling update after opening with an empty stream info (with a bogus
         * output function) yields an error:
         */
        /* Crashes on some Win9x */
        msg = CryptMsgOpenToEncode(PKCS_7_ASN_ENCODING, 0, CMSG_DATA, NULL,
NULL,
         &streamInfo);
        SetLastError(0xdeadbeef);
        ret = CryptMsgUpdate(msg, msgData, sizeof(msgData), FALSE);
> This is kind of mysterious.  I can't find the __TRY that applies
> to that fault...

http://source.winehq.org/source/dlls/crypt32/msg.c#L201

This is indeed a valgrind bug, the exception is supposed to be caught.

[Bug 20985] Crash in CryptMsgUpdate under valgrind

http://bugs.winehq.org/show_bug.cgi?id=20985

Juan Lang  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #2 from Juan Lang   2010-01-25 11:31:07 ---
Sorry, should have marked this invalid before, as it's a valgrind bug, not a
Wine one.

[Bug 20985] Crash in CryptMsgUpdate under valgrind

http://bugs.winehq.org/show_bug.cgi?id=20985

Dmitry Timoshkov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Dmitry Timoshkov   2010-01-26 00:46:17 ---
Closing invalid.

[Bug 20985] Crash in CryptMsgUpdate under valgrind

http://bugs.winehq.org/show_bug.cgi?id=20985

--- Comment #4 from Dan Kegel  2011-10-18 22:37:44 CDT ---
See https://bugs.kde.org/show_bug.cgi?id=264785