[Bug 21355] New: Need heap overrun detection

http://bugs.winehq.org/show_bug.cgi?id=21355

Summary: Need heap overrun detection
           Product: Wine
           Version: 1.1.36
          Platform: x86
        OS/Version: Linux
            Status: NEW
          Keywords: patch
          Severity: normal
          Priority: P2
         Component: ntdll
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Microsoft Windows XP obeys a number of flags that turn on
additional heap sanity checks which detect write-past-end
and write-after-free of heap allocations.

Wine should implement similar overrun detection; apps that
overrun their heap buffers should either get an error from the
heap call, or optionally be terminated aggressively, if we're
feeling really strict (I think Windows 7 does this).

Furthermore, Wine's heap code should contain Valgrind annotations
to let Valgrind produce good error messages even on read-after-free
or read overrun errors.

Patches to implement most of this are in use today
in the wine valgrind bot at http://kegel.com/wine/valgrind/logs
and in the chromium continuous build and test bot.

Here are the latest version of these patches:

(basic check-whether-unused-bytes-were-modified)
http://www.winehq.org/pipermail/wine-patches/2010-January/083609.html
http://www.winehq.org/pipermail/wine-patches/2010-January/083610.html
http://www.winehq.org/pipermail/wine-patches/2010-January/083611.html

(add 8 byte redzone to each allocation; can be increased, as sometimes 32 byte
redzones catch more bugs.)
http://www.winehq.org/pipermail/wine-patches/2009-November/081804.html

(use-after-free check)
http://www.winehq.org/pipermail/wine-patches/2009-November/081855.html

I've been trying to get these committed, but so far without much luck.

[Bug 21355] Need heap overrun detection

http://bugs.winehq.org/show_bug.cgi?id=21355

--- Comment #1 from Dan Kegel   2010-01-13 23:35:40 ---
See also bug 21336 for a testcase and fix for the large block
realloc case.

[Bug 21355] Need heap overrun detection

http://bugs.winehq.org/show_bug.cgi?id=21355

--- Comment #2 from Austin English   2010-01-20 14:38:23 ---
Seems Alexandre took mercy on you and did it himself:
http://source.winehq.org/git/wine.git/?a=commitdiff;h=1c119dad6dc9a5ca029e76...

http://source.winehq.org/git/wine.git/?a=commitdiff;h=39a1227cdbd4dd160b201c...

http://source.winehq.org/git/wine.git/?a=commitdiff;h=4ae9c2fe1f7152711d0308...

[Bug 21355] Need heap overrun detection

http://bugs.winehq.org/show_bug.cgi?id=21355

--- Comment #3 from Dan Kegel   2010-01-20 17:14:26 ---
I think he's not done yet, but I see he's also going to do
CriticalSectionTimeout, which is awesome.

[Bug 21355] Need heap overrun detection

http://bugs.winehq.org/show_bug.cgi?id=21355

Dan Kegel  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #4 from Dan Kegel   2010-01-29 15:31:03 ---
I think this is done now.

[Bug 21355] Need heap overrun detection

http://bugs.winehq.org/show_bug.cgi?id=21355

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #5 from Alexandre Julliard   2010-02-05 11:39:15 ---
Closing bugs fixed in 1.1.38.