[PATCH 0/1] MR7041: crypt32: Avoid stack-use-after-scope in CSignedEncodeMsg_GetParam. (ASan)
This moves the stack variable to the outer scope, because it gets stored in the variable info and used below the call to `CRYPT_AsnEncodeCMSSignedInfo` a few lines below.
``` ================================================================= ==1032==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffffe1ff133 at pc 0x6ffff821dbd1 bp 0x7ffffe1fe700 sp 0x7ffffe1fe748 READ of size 1 at 0x7ffffe1ff133 thread T0 0430:fixme:file:server_get_file_info Unsupported info class e #0 0x6ffff821dbd0 in CRYPT_AsnEncodeOid .../wine/dlls/crypt32/encode.c:839:13 #1 0x6ffff821a98a in CRYPT_AsnEncodeSequence .../wine/dlls/crypt32/encode.c:185:15 #2 0x6ffff821e456 in CRYPT_AsnEncodePKCSContentInfoInternal .../wine/dlls/crypt32/encode.c:1942:12 #3 0x6ffff821a98a in CRYPT_AsnEncodeSequence .../wine/dlls/crypt32/encode.c:185:15 #4 0x6ffff821f3b9 in CRYPT_AsnEncodeCMSSignedInfo .../wine/dlls/crypt32/encode.c:4400:12 #5 0x6ffff82576bc in CSignedEncodeMsg_GetParam .../wine/dlls/crypt32/msg.c:1281:19 #6 0x6ffff82570a0 in CryptMsgGetParam .../wine/dlls/crypt32/msg.c:3720:12 #7 0x6ffff82570a0 in CSignedEncodeMsg_GetParam .../wine/dlls/crypt32/msg.c:1217:15 #8 0x6ffff824750e in CryptSignMessage .../wine/dlls/crypt32/message.c:508:19 #9 0x0001400e11ad in test_sign_message .../wine/dlls/crypt32/tests/message.c:1015:11 #10 0x0001400e11ad in func_message .../wine/dlls/crypt32/tests/message.c:1310:5 #11 0x00014015ecb1 in run_test .../wine/include/wine/test.h:765:5 #12 0x00014015ecb1 in main .../wine/include/wine/test.h:884:12 #13 0x000140160bbf in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:58:11 #14 0x6ffffbdc4808 in BaseThreadInitThunk .../wine/dlls/kernel32\thread.c:61:5 #15 0x6ffffad1fa1a in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17000fa1a)
Address 0x7ffffe1ff133 is located in stack of thread T0 at offset 275 in frame #0 0x6ffff8256f4f in CSignedEncodeMsg_GetParam .../wine/dlls/crypt32/msg.c:1207
This frame has 5 object(s): [32, 56) 'info' (line 1215) [96, 117) 'oid_rsa_signed' (line 1228) [160, 240) 'info22' (line 1243) [272, 293) 'oid_rsa_data' (line 1249) <== Memory access at offset 275 is inside this variable [336, 352) 'blob' (line 1258) HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp, SEH and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-use-after-scope .../wine/dlls/crypt32/encode.c:839:13 in CRYPT_AsnEncodeOid Shadow bytes around the buggy address: 0x7ffffe1fee80: 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 f3 f3 f3 f3 0x7ffffe1fef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1fef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ff000: 00 00 00 00 f1 f1 f1 f1 f8 f8 f8 f2 f2 f2 f2 f2 0x7ffffe1ff080: f8 f8 f8 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 =>0x7ffffe1ff100: 00 00 f2 f2 f2 f2[f8]f8 f8 f2 f2 f2 f2 f2 f8 f8 0x7ffffe1ff180: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ff200: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 0x7ffffe1ff280: 00 00 00 f2 f2 f2 f2 f2 f8 f8 f8 f2 f2 f2 f2 f2 0x7ffffe1ff300: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f8 f8 0x7ffffe1ff380: f8 f2 f2 f2 f2 f2 f8 f8 f3 f3 f3 f3 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1032==ABORTING make: *** [Makefile:36953: dlls/crypt32/tests/x86_64-windows/message.ok] Fehler 1 ```
From: Bernhard Übelacker bernhardu@mailbox.org
--- dlls/crypt32/msg.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/dlls/crypt32/msg.c b/dlls/crypt32/msg.c index a5ee20f04a6..5e6d59a1f58 100644 --- a/dlls/crypt32/msg.c +++ b/dlls/crypt32/msg.c @@ -1242,12 +1242,11 @@ static BOOL CSignedEncodeMsg_GetParam(HCRYPTMSG hCryptMsg, DWORD dwParamType, { CRYPT_SIGNED_INFO info; BOOL freeContent = FALSE; + char oid_rsa_data[] = szOID_RSA_data;
info = *msg->msg_data.info; if (!msg->innerOID || !strcmp(msg->innerOID, szOID_RSA_data)) { - char oid_rsa_data[] = szOID_RSA_data; - /* Quirk: OID is only encoded messages if an update has happened */ if (msg->base.state != MsgStateInit) info.content.pszObjId = oid_rsa_data;
It would be nice to have an ASan stage in Gitlab CI to catch these issues. I tried ASan a few years ago and I was unable to get it working. Maybe it's much easier now. Did you do anything special or following https://gitlab.winehq.org/wine/wine/-/wikis/Building-Wine#memory--address-ch... is enough?
On Wed Dec 18 16:31:16 2024 +0000, Zhiyi Zhang wrote:
It would be nice to have an ASan stage in Gitlab CI to catch these issues. I tried ASan a few years ago and I was unable to get it working. Maybe it's much easier now. Did you do anything special or following https://gitlab.winehq.org/wine/wine/-/wikis/Building-Wine#memory--address-ch... is enough?
Having PE-ASan in CI at the end would be great, but unfortunately my attempt involved building llvm-mingw/llvm-project with a few patches, which I attempted upstreaming for quite some time. Then building wine with it needs also a few patches, and running it involves currently an ugly mix of a non-ASan and an ASan build. Some more old/outdated details are [here](https://gitlab.winehq.org/wine/wine/-/merge_requests/6791#note_86908), for running just the executables below wine/programs.
But running the tests locally produced quite a few unfinished [patches](https://gitlab.winehq.org/bernhardu/wine/-/commits/asan-pe_2024-12-18) where I try to get the more obvious and hopefully freeze-compatible ones in, while waiting on progress with llvm-project.
-
Bernhard Übelacker -
Bernhard Übelacker (＠bernhardu)
-
Zhiyi Zhang (＠zhiyi)