[Bug 20851] New: Read buffer overflow in CombineRgn, triggered by imm32/tests/imm32.c

http://bugs.winehq.org/show_bug.cgi?id=20851

Summary: Read buffer overflow in CombineRgn, triggered by
                    imm32/tests/imm32.c
           Product: Wine
           Version: 1.1.33
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Keywords: download, source, testcase
          Severity: normal
          Priority: P2
         Component: -unknown
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

http://kegel.com/wine/valgrind/logs/2009-11-18-21.51/vg-imm32_imm32.txt through
http://kegel.com/wine/valgrind/logs/2009-11-27-12.53/vg-imm32_imm32.txt
have the warning

Invalid read of size 4
    at REGION_SubtractO (region.c:2219)
    by REGION_RegionOp (region.c:1776)
    by REGION_SubtractRegion (region.c:2258)
    by CombineRgn (region.c:1376)
    by NC_DoNCPaint (nonclient.c:1022)
    by NC_HandleNCPaint (nonclient.c:1117)
    by DEFWND_DefWinProc (defwnd.c:303)
    by DefWindowProcA (defwnd.c:914)
    by ??? (library.h:159)
    by call_window_proc (winproc.c:469)
    by WINPROC_CallProcWtoA (winproc.c:1279)
    by WINPROC_call_window (winproc.c:2216)
    by call_window_proc (message.c:1635)
    by send_message (message.c:2482)
    by SendMessageW (message.c:2605)
    by send_ncpaint (painting.c:665)
    by BeginPaint (painting.c:871)
    by DEFWND_DefWinProc (defwnd.c:428)
    by DefWindowProcA (defwnd.c:914)
    by ??? (library.h:159)
  Address 0x7f082810 is 0 bytes after a block of size 32 alloc'd
    at notify_alloc (heap.c:247)
    by RtlAllocateHeap (heap.c:1697)
    by init_region (region.c:492)
    by REGION_RegionOp (region.c:1666)
    by REGION_UnionRegion (region.c:2094)
    by REGION_UnionRectWithRegion (region.c:1260)
    by ExtCreateRegion (region.c:1073)
    by get_update_region (painting.c:549)
    by send_ncpaint (painting.c:621)
    by BeginPaint (painting.c:871)
    by DEFWND_DefWinProc (defwnd.c:428)
    by DefWindowProcA (defwnd.c:914)
    by ??? (library.h:159)
    by call_window_proc (winproc.c:469)
    by WINPROC_call_window (winproc.c:2223)
    by DispatchMessageA (message.c:3089)
    by msg_spy_pump_msg_queue (imm32.c:81)
    by msg_spy_flush_msgs (imm32.c:88)
    by msg_spy_init (imm32.c:118)
    by init (imm32.c:173)

This is likely a very old problem.

[Bug 20851] Read buffer overflow in CombineRgn, triggered by user32 and imm32 tests

http://bugs.winehq.org/show_bug.cgi?id=20851

Dan Kegel  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|-unknown                    |gdi32
            Summary|Read buffer overflow in     |Read buffer overflow in
                   |CombineRgn, triggered by    |CombineRgn, triggered by
                   |imm32/tests/imm32.c         |user32 and imm32 tests

--- Comment #1 from Dan Kegel   2009-11-28 01:44:04 ---
Also seen in four user32 tests, e.g.
http://kegel.com/wine/valgrind/logs/2009-11-27-12.53/vg-user32_menu.txt
The command
valgrind --trace-children=yes wine user32_test.exe.so menu.c
reproduces the problem about half the time.
Looks like someone just forgot to test a limit.

Patch sent,
http://www.winehq.org/pipermail/wine-patches/2009-November/081856.html

[Bug 20851] Read buffer overflow in CombineRgn, triggered by user32 and imm32 tests

http://bugs.winehq.org/show_bug.cgi?id=20851

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #2 from Nikolay Sivov   2009-12-11 05:22:05 ---
This is fixed by commit f3560ece31d59f1aaba2c2fef2487bccb1f20d96.

[Bug 20851] Read buffer overflow in CombineRgn, triggered by user32 and imm32 tests

http://bugs.winehq.org/show_bug.cgi?id=20851

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Alexandre Julliard   2009-12-18 13:08:00 ---
Closing bugs fixed in 1.1.35.