[PATCH 0/1] MR9513: user32/tests: Avoid out-of-bounds access in DdeCreateDataHandle (ASan).
The literal "data" is just 5 bytes, but DdeCreateDataHandle is currently told to read a length of MAX_PATH.
[Testbot run with this patch](https://testbot.winehq.org/JobDetails.pl?Key=160926)
<details> <summary>ASan report details</summary>
``` ================================================================= ==1464==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000140292045 at pc 0x6ffffe8ccfac bp 0x7ffffe1feed0 sp 0x7ffffe1fef18 READ of size 258 at 0x000140292045 thread T0 #0 0x6ffffe8ccfab in memmove /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt\lib/asan/../sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:100:3 #1 0x6ffffa6dd6e6 in DdeCreateDataHandle .../wine/dlls/user32/dde_misc.c:1328 #2 0x000140061ffe in test_DdeCreateDataHandle .../wine/dlls/user32/tests/dde.c:1943 #3 0x00014005b743 in func_dde .../wine/dlls/user32/tests/dde.c:2764 #4 0x000140268de2 in run_test .../wine/include/wine/test.h:780 #5 0x0001402687eb in main .../wine/include/wine/test.h:900 #6 0x00014026aa7a in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:62 #7 0x6ffffaf57a54 in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x178027a54) #8 0x6ffffdcb06d6 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x1700506d6)
0x000140292045 is located 27 bytes before global variable '"Expected non-NULL ptr\n"' defined in '.../wine/dlls/user32/tests/dde.c:1915' (0x000140292060) of size 23 '"Expected non-NULL ptr\n"' is ascii string 'Expected non-NULL ptr ' 0x000140292045 is located 0 bytes after global variable '"data"' defined in '.../wine/dlls/user32/tests/dde.c:1886' (0x000140292040) of size 5 '"data"' is ascii string 'data' SUMMARY: AddressSanitizer: global-buffer-overflow .../wine/dlls/user32/dde_misc.c:1328 in DdeCreateDataHandle ```
</details>
From: Bernhard Übelacker bernhardu@mailbox.org
--- dlls/user32/tests/dde.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/dlls/user32/tests/dde.c b/dlls/user32/tests/dde.c index d54451f3758..c48d1fdfd87 100644 --- a/dlls/user32/tests/dde.c +++ b/dlls/user32/tests/dde.c @@ -1883,7 +1883,7 @@ static void test_DdeCreateDataHandle(void) item = DdeCreateStringHandleA(dde_inst2, "item", CP_WINANSI); ok(item != NULL, "Expected non-NULL hsz\n");
- hdata = DdeCreateDataHandle(0xdeadbeef, (LPBYTE)"data", MAX_PATH, 0, item, CF_TEXT, 0); + hdata = DdeCreateDataHandle(0xdeadbeef, (LPBYTE)"data", 5, 0, item, CF_TEXT, 0);
/* 0 instance id * This block tests an invalid instance Id. The correct behaviour is that if the instance Id @@ -1893,7 +1893,7 @@ static void test_DdeCreateDataHandle(void) */ DdeGetLastError(dde_inst); DdeGetLastError(dde_inst2); - hdata = DdeCreateDataHandle(0, (LPBYTE)"data", MAX_PATH, 0, item, CF_TEXT, 0); + hdata = DdeCreateDataHandle(0, (LPBYTE)"data", 5, 0, item, CF_TEXT, 0); err = DdeGetLastError(dde_inst); ok(hdata == NULL, "Expected NULL, got %p\n", hdata); ok(err == DMLERR_INVALIDPARAMETER, "Expected DMLERR_INVALIDPARAMETER, got %d\n", err); @@ -1940,14 +1940,14 @@ static void test_DdeCreateDataHandle(void)
/* cbOff is non-zero */ DdeGetLastError(dde_inst); - hdata = DdeCreateDataHandle(dde_inst, (LPBYTE)"data", MAX_PATH, 2, item, CF_TEXT, 0); + hdata = DdeCreateDataHandle(dde_inst, (LPBYTE)"data", 5, 2, item, CF_TEXT, 0); err = DdeGetLastError(dde_inst); ok(hdata != NULL, "Expected non-NULL hdata\n"); ok(err == DMLERR_NO_ERROR, "Expected DMLERR_NO_ERROR, got %d\n", err);
ptr = DdeAccessData(hdata, &size); ok(ptr != NULL, "Expected non-NULL ptr\n"); - ok(size == 262, "Expected 262, got %ld\n", size); + ok(size == 7, "Expected 7, got %ld\n", size); todo_wine { ok(ptr && !*ptr, "Expected 0, got %d\n", lstrlenA((LPSTR)ptr)); @@ -1961,7 +1961,7 @@ static void test_DdeCreateDataHandle(void)
/* NULL item */ DdeGetLastError(dde_inst); - hdata = DdeCreateDataHandle(dde_inst, (LPBYTE)"data", MAX_PATH, 0, 0, CF_TEXT, 0); + hdata = DdeCreateDataHandle(dde_inst, (LPBYTE)"data", 5, 0, 0, CF_TEXT, 0); err = DdeGetLastError(dde_inst); ok(hdata != NULL, "Expected non-NULL hdata\n"); ok(err == DMLERR_NO_ERROR, "Expected DMLERR_NO_ERROR, got %d\n", err); @@ -1969,7 +1969,7 @@ static void test_DdeCreateDataHandle(void) ptr = DdeAccessData(hdata, &size); ok(ptr != NULL, "Expected non-NULL ptr\n"); ok(!lstrcmpA((LPSTR)ptr, "data"), "Expected data, got %s\n", ptr); - ok(size == 260, "Expected 260, got %ld\n", size); + ok(size == 5, "Expected 5, got %ld\n", size);
ret = DdeUnaccessData(hdata); ok(ret == TRUE, "Expected TRUE, got %d\n", ret); @@ -1979,7 +1979,7 @@ static void test_DdeCreateDataHandle(void)
/* NULL item */ DdeGetLastError(dde_inst); - hdata = DdeCreateDataHandle(dde_inst, (LPBYTE)"data", MAX_PATH, 0, (HSZ)0xdeadbeef, CF_TEXT, 0); + hdata = DdeCreateDataHandle(dde_inst, (LPBYTE)"data", 5, 0, (HSZ)0xdeadbeef, CF_TEXT, 0); err = DdeGetLastError(dde_inst); ok(hdata != NULL, "Expected non-NULL hdata\n"); ok(err == DMLERR_NO_ERROR, "Expected DMLERR_NO_ERROR, got %d\n", err); @@ -1987,7 +1987,7 @@ static void test_DdeCreateDataHandle(void) ptr = DdeAccessData(hdata, &size); ok(ptr != NULL, "Expected non-NULL ptr\n"); ok(!lstrcmpA((LPSTR)ptr, "data"), "Expected data, got %s\n", ptr); - ok(size == 260, "Expected 260, got %ld\n", size); + ok(size == 5, "Expected 5, got %ld\n", size);
ret = DdeUnaccessData(hdata); ok(ret == TRUE, "Expected TRUE, got %d\n", ret); @@ -1997,7 +1997,7 @@ static void test_DdeCreateDataHandle(void)
/* invalid clipboard format */ DdeGetLastError(dde_inst); - hdata = DdeCreateDataHandle(dde_inst, (LPBYTE)"data", MAX_PATH, 0, item, 0xdeadbeef, 0); + hdata = DdeCreateDataHandle(dde_inst, (LPBYTE)"data", 5, 0, item, 0xdeadbeef, 0); err = DdeGetLastError(dde_inst); ok(hdata != NULL, "Expected non-NULL hdata\n"); ok(err == DMLERR_NO_ERROR, "Expected DMLERR_NO_ERROR, got %d\n", err); @@ -2005,7 +2005,7 @@ static void test_DdeCreateDataHandle(void) ptr = DdeAccessData(hdata, &size); ok(ptr != NULL, "Expected non-NULL ptr\n"); ok(!lstrcmpA((LPSTR)ptr, "data"), "Expected data, got %s\n", ptr); - ok(size == 260, "Expected 260, got %ld\n", size); + ok(size == 5, "Expected 5, got %ld\n", size);
ret = DdeUnaccessData(hdata); ok(ret == TRUE, "Expected TRUE, got %d\n", ret);
-
Bernhard Übelacker -
Bernhard Übelacker (＠bernhardu)