[Bug 36635] New: valgrind shows uninitialized memory in secur32/tests/schannel.c

https://bugs.winehq.org/show_bug.cgi?id=36635

Bug ID: 36635
           Summary: valgrind shows uninitialized memory in
                    secur32/tests/schannel.c
           Product: Wine
           Version: 1.7.19
          Hardware: x86
                OS: Linux
            Status: NEW
          Keywords: download, source, testcase
          Severity: normal
          Priority: P2
         Component: secur32
          Assignee: [e-mail]
          Reporter: [e-mail]

==20049== Conditional jump or move depends on uninitialised value(s)
==20049==    at 0x565DE46: schan_get_buffer (schannel.c:624)
==20049==    by 0x565DFDD: schan_pull (schannel.c:678)
==20049==    by 0x56602C5: schan_pull_adapter (schannel_gnutls.c:85)
==20049==    by 0x5862A2E: ??? (in /usr/lib/libgnutls.so.28.21.4)
==20049==    by 0x585C674: ??? (in /usr/lib/libgnutls.so.28.21.4)
==20049==    by 0x5863FD9: ??? (in /usr/lib/libgnutls.so.28.21.4)
==20049==    by 0x5867B82: ??? (in /usr/lib/libgnutls.so.28.21.4)
==20049==    by 0x5869654: gnutls_handshake (in /usr/lib/libgnutls.so.28.21.4)
==20049==    by 0x5660684: schan_imp_handshake (schannel_gnutls.c:199)
==20049==    by 0x565E97D: schan_InitializeSecurityContextW (schannel.c:893)
==20049==    by 0x565EC31: schan_InitializeSecurityContextA (schannel.c:940)
==20049==    by 0x5667F30: InitializeSecurityContextA (wrapper.c:282)
==20049==    by 0x4A5E141: test_communication (schannel.c:704)
==20049==    by 0x4A5F3FA: func_schannel (schannel.c:907)
==20049==    by 0x4A61268: run_test (test.h:584)
==20049==    by 0x4A61657: main (test.h:654)
==20049==  Uninitialised value was created by a client request
==20049==    at 0x7BC4C554: mark_block_uninitialized (heap.c:209)
==20049==    by 0x7BC4C6BF: initialize_block (heap.c:240)
==20049==    by 0x7BC50FCB: RtlAllocateHeap (heap.c:1717)
==20049==    by 0x4A5DAE9: init_buffers (schannel.c:551)
==20049==    by 0x4A5DFE8: test_communication (schannel.c:693)
==20049==    by 0x4A5F3FA: func_schannel (schannel.c:907)
==20049==    by 0x4A61268: run_test (test.h:584)
==20049==    by 0x4A61657: main (test.h:654)
==20049==

==20049== Conditional jump or move depends on uninitialised value(s)
==20049==    at 0x585C8F7: ??? (in /usr/lib/libgnutls.so.28.21.4)
==20049==    by 0x5863FD9: ??? (in /usr/lib/libgnutls.so.28.21.4)
==20049==    by 0x5867B82: ??? (in /usr/lib/libgnutls.so.28.21.4)
==20049==    by 0x5869654: gnutls_handshake (in /usr/lib/libgnutls.so.28.21.4)
==20049==    by 0x5660684: schan_imp_handshake (schannel_gnutls.c:199)
==20049==    by 0x565E97D: schan_InitializeSecurityContextW (schannel.c:893)
==20049==    by 0x565EC31: schan_InitializeSecurityContextA (schannel.c:940)
==20049==    by 0x5667F30: InitializeSecurityContextA (wrapper.c:282)
==20049==    by 0x4A5E141: test_communication (schannel.c:704)
==20049==    by 0x4A5F3FA: func_schannel (schannel.c:907)
==20049==    by 0x4A61268: run_test (test.h:584)
==20049==    by 0x4A61657: main (test.h:654)
==20049==  Uninitialised value was created by a client request
==20049==    at 0x7BC4C554: mark_block_uninitialized (heap.c:209)
==20049==    by 0x7BC4C6BF: initialize_block (heap.c:240)
==20049==    by 0x7BC50FCB: RtlAllocateHeap (heap.c:1717)
==20049==    by 0x4A5DAE9: init_buffers (schannel.c:551)
==20049==    by 0x4A5DFE8: test_communication (schannel.c:693)
==20049==    by 0x4A5F3FA: func_schannel (schannel.c:907)
==20049==    by 0x4A61268: run_test (test.h:584)
==20049==    by 0x4A61657: main (test.h:654)
==20049==

[Bug 36635] valgrind shows uninitialized memory in secur32/tests/schannel.c

https://bugs.winehq.org/show_bug.cgi?id=36635

--- Comment #1 from Austin English  ---
Created attachment 48677
  --> https://bugs.winehq.org/attachment.cgi?id=48677
valgrind log

[Bug 36635] valgrind shows uninitialized memory in secur32/tests/schannel.c

https://bugs.winehq.org/show_bug.cgi?id=36635

--- Comment #2 from Bruno Jesus  ---
In secur32/schannel.c:

892     /* Perform the TLS handshake */
 893     ret = schan_imp_handshake(ctx->session);

The ctx->session will only be initialized if (!phContext):

795     if (!phContext)
 796     {
...
 821         if (!schan_imp_create_session(&ctx->session, cred))
 822         {
 823             schan_free_handle(handle, SCHAN_HANDLE_CTX);
 824             HeapFree(GetProcessHeap(), 0, ctx);
 825             return SEC_E_INTERNAL_ERROR;
 826         }

So it's indeed using an invalid ctx->session at line 893. I don't know if
ctx->session was supposed to be already created or if it should be set to NULL
or created in the else branch of the (!phContext) if.

[Bug 36635] valgrind shows uninitialized memory in secur32/tests/schannel.c

https://bugs.winehq.org/show_bug.cgi?id=36635

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |valgrind