Skip to content

ucrtbase/tests: Avoid reading behind buffer in test_swprintf (ASan).

The test test_swprintf creates an un-terminated buffer and calls WideCharToMultiByte without explicit srclen on it.

This patch wraps the buffer into a struct providing a termination without modifying the test itself.

ASan output:
=================================================================
==ucrtbase_test.exe==532==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffe1ffac0 at pc 0x6ffffe845638 bp 0x7ffffe1ff030 sp 0x7ffffe1ff078
READ of size 24 at 0x7ffffe1ffac0 thread T0
    #0 0x6ffffe845637 in wcslen C:/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/../sanitizer_common\sanitizer_common_interceptors.inc:7215:3
    #1 0x6fffff7d1eff in lstrlenW .../wine/include/winbase.h:2574:5
    #2 0x6fffff7d2a33 in WideCharToMultiByte .../wine/dlls/kernelbase/locale.c:7382:30
    #3 0x000140016e6c in test_swprintf .../wine/dlls/ucrtbase/tests/printf.c:196:9
    #4 0x000140015f3e in func_printf .../wine/dlls/ucrtbase/tests/printf.c:891:5
    #5 0x00014002da0e in run_test .../wine/include/wine/test.h:765:5
    #6 0x00014002d53a in main .../wine/include/wine/test.h:884:12
    #7 0x00014002f005 in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:58:11
    #8 0x6fffffc355be in BaseThreadInitThunk .../wine/dlls/kernel32/thread.c:61:24
    #9 0x6fffffdbbcc2 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17004bcc2)

Address 0x7ffffe1ffac0 is located in stack of thread T0 at offset 256 in frame
    #0 0x000140016b6f in test_swprintf .../wine/dlls/ucrtbase/tests/printf.c:176

  This frame has 8 object(s):
    [32, 44) 'str_short' (line 177)
    [64, 80) 'str_justfit' (line 178)
    [96, 114) 'str_justfits' (line 179)
    [160, 182) 'str_muchlonger' (line 180)
    [224, 226) 'str_empty' (line 181)
    [240, 256) 'buffer' (line 184)
    [272, 280) 'narrow' (line 185) <== Memory access at offset 256 partially underflows this variable
    [304, 320) 'narrow_fmt' (line 185)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp, SEH and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow .../wine/include/winbase.h:2574:5 in lstrlenW
Shadow bytes around the buggy address:
  0x7ffffe1ff800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ffffe1ff880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ffffe1ff900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ffffe1ff980: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 04 f2 f2
  0x7ffffe1ffa00: 00 00 f2 f2 00 00 02 f2 f2 f2 f2 f2 00 00 06 f2
=>0x7ffffe1ffa80: f2 f2 f2 f2 02 f2 00 00[f2]f2 00 f2 f2 f2 00 00
  0x7ffffe1ffb00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ffffe1ffb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ffffe1ffc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ffffe1ffc80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f8 f8 f8
  0x7ffffe1ffd00: f8 f8 f8 f8 f3 f3 f3 f3 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Merge request reports

Loading