[Bug 9324] New: Mp3Tag: crash when editing the "Year" field in some cases

http://bugs.winehq.org/show_bug.cgi?id=9324

Summary: Mp3Tag: crash when editing the "Year" field in some
                    cases
           Product: Wine
           Version: CVS
          Platform: PC
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: wine-comctl32
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Created an attachment (id=7595)
 --> (http://bugs.winehq.org/attachment.cgi?id=7595)
winedbg output and backtrace after crash

wine 0.9.43 and last git version
gcc (GCC) 4.2.0 (Gentoo 4.2.0 p1.4)
Linux k8t800 2.6.22-gentoo-r3 #1 PREEMPT Tue Aug 14 17:33:41 CEST 2007 i686 AMD
Athlon(tm) 64 Processor 3500+ AuthenticAMD GNU/Linux

How to reproduce:
- download Mp3Tag v2.39 from http://www.mp3tag.de/en/download.html
- edit the date field of some OGG file with another editor (e.g. via
Properties->Meta Info in konqueror) to ensure it has more than 4 symbols in
that, e.g. "August 2007"
- open it with Mp3Tag
- select this file in the list
- place the cursor to the beginning of the string "August 2007" in the Year
field in tag panel (left panel)
- press "Delete" button
-> segfault

Relevant part of the winedbg output with some additional trace calls added by
me attached.

The problem is absent on Windows.

It seems that the maximal text length in the "year" combo box in Mp3Tag is set
to 4, but if a file with more text in the "Year" field is loaded, it is showed
in the corresponding combo box tough.
This causes a negative string length in a calculation in EDIT_EM_ReplaceSel
function in dlls/user32/edit.c:3208 and a buffer overflow later (line 3236).

I've made a patch which seems to work fine and do not cause unneeded side
effects, but I'm not very familiar with wine internals so better check it :)

I'll provide additional info if needed.

[Bug 9324] Mp3Tag: crash when editing the "Year" field in some cases

http://bugs.winehq.org/show_bug.cgi?id=9324

--- Comment #1 from [e-mail]  2007-08-14 23:44:03 ---
Created an attachment (id=7596)
 --> (http://bugs.winehq.org/attachment.cgi?id=7596)
Proposed patch to fix segfault with comboboxes containing a longer text than
buffer limit

[Bug 9324] Mp3Tag: crash when editing the "Year" field in some cases

http://bugs.winehq.org/show_bug.cgi?id=9324

Vitaliy Margolen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|wine-comctl32               |wine-user

--- Comment #2 from Vitaliy Margolen   2007-08-15 07:58:49 ---
Looks reasonable to me. Please send the patch to wine-patches ML. Patches are
not being picked up from the bugzilla.

[Bug 9324] Mp3Tag: crash when editing the "Year" field in some cases

http://bugs.winehq.org/show_bug.cgi?id=9324

--- Comment #3 from [e-mail]  2007-08-15 14:03:16 ---
> Please send the patch to wine-patches ML.

Done.

[Bug 9324] Mp3Tag: crash when editing the "Year" field in some cases

http://bugs.winehq.org/show_bug.cgi?id=9324

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1

--- Comment #4 from Austin English   2007-10-21 00:48:50 ---
Direct Link: http://www.anytag.de/download/mp3tagv239setup.exe

Still present in wine 0.9.47, kubuntu gusty.

[Bug 9324] Mp3Tag: crash when editing the "Year" field in some cases

http://bugs.winehq.org/show_bug.cgi?id=9324

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download

[Bug 9324] Mp3Tag: crash when editing the "Year" field in some cases

http://bugs.winehq.org/show_bug.cgi?id=9324

scguy318  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #5 from scguy318   2008-05-13 00:19:00 ---
I can't reproduce this problem with Wine 1.0-rc1, so this issue seems to be
fixed.

[Bug 9324] Mp3Tag: crash when editing the "Year" field in some cases

http://bugs.winehq.org/show_bug.cgi?id=9324

[e-mail] changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #6 from [e-mail]  2008-05-13 06:26:05 ---
The patch was included into wine 0.9.48 and works for me since then

[Bug 9324] Mp3Tag: crash when editing the "Year" field in some cases

http://bugs.winehq.org/show_bug.cgi?id=9324

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #7 from Alexandre Julliard   2008-05-23 10:37:43 ---
Closing bugs fixed in 1.0-rc2.

[Bug 9324] Mp3Tag: crash when editing the "Year" field in some cases

http://bugs.winehq.org/show_bug.cgi?id=9324

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|CVS/GIT                     |unspecified