[Bug 20862] New: Write buffer overrun in VARIANT_UserUnmarshal?

http://bugs.winehq.org/show_bug.cgi?id=20862

Summary: Write buffer overrun in VARIANT_UserUnmarshal?
           Product: Wine
           Version: 1.1.33
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Keywords: download, source, testcase
          Severity: normal
          Priority: P2
         Component: oleaut32
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

http://kegel.com/wine/valgrind/logs/2009-11-27-12.53/vg-oleaut32_usrmarshal....
says
 Invalid write of size 4
    at  CoUnmarshalInterface (marshal.c:1841)
    by  interface_variant_unmarshal (usrmarshal.c:396)
    by  VARIANT_UserUnmarshal (usrmarshal.c:612)
    by  test_marshal_VARIANT (usrmarshal.c:1368)
  Address 0x7f07dd80 is 0 bytes after a block of size 0 alloc'd
    at  notify_alloc (heap.c:247)
    by  RtlAllocateHeap (heap.c:1697)
    by  IMalloc_fnAlloc (ifs.c:186)
    by  CoTaskMemAlloc (ifs.c:562)
    by  VARIANT_UserUnmarshal (usrmarshal.c:559)
    by  test_marshal_VARIANT (usrmarshal.c:1368)

Looks like some disagreement about the size needed for
the type being unmarshalled?

[Bug 20862] Write buffer overrun in VARIANT_UserUnmarshal?

http://bugs.winehq.org/show_bug.cgi?id=20862

--- Comment #1 from Dan Kegel   2009-11-28 18:13:02 ---
Rob says he already sent a patch:
http://www.winehq.org/pipermail/wine-patches/2009-November/081810.html

[Bug 20862] Write buffer overrun in VARIANT_UserUnmarshal?

http://bugs.winehq.org/show_bug.cgi?id=20862

Rob Shearman  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #2 from Rob Shearman   2009-12-30 05:12:45 ---
Valgrind warning no longer present in recent logs.

[Bug 20862] Write buffer overrun in VARIANT_UserUnmarshal?

http://bugs.winehq.org/show_bug.cgi?id=20862

Jeff Zaroyko  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Jeff Zaroyko   2010-01-09 04:55:15 ---
Closing bugs fixed in 1.1.36.