[Bug 20884] New: Write buffer overrun in LsaLookupNames2?

http://bugs.winehq.org/show_bug.cgi?id=20884

Summary: Write buffer overrun in LsaLookupNames2?
           Product: Wine
           Version: 1.1.33
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Keywords: download, source, testcase
          Severity: normal
          Priority: P2
         Component: advapi32
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

First posted in
http://www.winehq.org/pipermail/wine-devel/2009-November/079920.html
I don't think anyone's posted a fix...

Still present today, see
http://kegel.com/wine/valgrind/logs/2009-11-27-12.53/vg-advapi32_lsa.txt

Invalid write of size 1
   at memmove (mc_replace_strmem.c:613)
   by RtlCopySid (sec.c:376)
   by CopySid (security.c:905)
   by lookup_local_wellknown_name (security.c:2800)
   by lookup_name (lsa.c:308)
   by LsaLookupNames2 (lsa.c:411)
   by test_LsaLookupNames2 (lsa.c:336)
   by func_lsa (lsa.c:362)
 Address 0x7f03c550 is 6 bytes after a block of size 26 alloc'd
   at notify_alloc (heap.c:279)
   by RtlAllocateHeap (heap.c:1521)
   by LsaLookupNames2 (lsa.c:402)
   by test_LsaLookupNames2 (lsa.c:336)
   by func_lsa (lsa.c:362)

Looks like LsaLookupNames2() is at fault, the allocation
at line 402 should be the size promised at line 411?

[Bug 20884] Write buffer overrun in LsaLookupNames2?

http://bugs.winehq.org/show_bug.cgi?id=20884

--- Comment #1 from Austin English  2011-02-09 19:07:30 CST ---
Still present:
http://austinenglish.com/logs/valgrind/2011-02-08-15.53/vg-advapi32_lsa.txt

[Bug 20884] Write buffer overrun in LsaLookupNames2?

http://bugs.winehq.org/show_bug.cgi?id=20884

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #2 from Nikolay Sivov  2013-04-29 00:46:00 CDT ---
I don't see this warning in current git, spent some time to figure out what
could have fixed it, but code was significantly different when this was
reported. Also I sent a patch to fix a regression with recent rewrite, marking
this fixed.

[Bug 20884] Write buffer overrun in LsaLookupNames2?

http://bugs.winehq.org/show_bug.cgi?id=20884

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Alexandre Julliard  2013-05-10 13:42:02 CDT ---
Closing bugs fixed in 1.5.30.