wine users - Dec 2001 - (fwd) Re: [Possible BUG]: Wine-20011108

Quoting Uwe Bonnes <bon@elektron.ikp.physik.tu-darmstadt.de>:
> Pavel Tsekov <ptsekov@syntrex.com> wrote:
> :> 
> :> Pavel Tsekov <ptsekov@syntrex.com> wrote:
> :> : fixme:msvcrt:MSVCRT_signal (11 (nil)):stub
> :> It seems to me like you are using builtin MSVCRT. Signal Handling is
> broken
> :> there. If the programm uses signal handling, it probably will
> crash.
> 
> : Nope It's pretty simple and it fails on a call to malloc as I 
> : said before.. If I only knew how to copy and paste from 
> : winedebug I'd show you the backtrace. The problem is 
> : in heap.c, line 353 - something on this line causes 
> : signal 11 to be generated.
> Running with --debugmsg +heap you get something like:
> 0806feb0:Call msvcrt.strcat(403a4005 "Cygwin/bin/",403a3fb0
> "/pinco/panco") ret=004014f2
> 0806feb0:Ret  msvcrt.strcat() retval=403a4005 ret=004014f2
> 0806feb0:Call msvcrt.free(403a3fac) ret=00401501
> 0806feb0:Call kernel32.HeapFree(403a0000,00000000,403a3fac)
> ret=42563e35
> err:heap:HEAP_ValidateFreeArena Heap 403a0000: prev arena 403a401c
> invalid for 403a0344
> Heap: 403a0000
> 
> This looks like heap corruption. In 
> URLParser.cc:127:        strcat ((char *) path, schema);
> you scribble to path, but you have no storage allocated for path.
> 
> So recheck you code.
Thanks, for your analisys - the call to realloc () before the strcat ()
is unchecked indeed - however this means that wine fails repeatedly 
every call to realloc (). If you could give me any pointers how to debug 
further the problem I'll be glad to try and see whats going on exactly. 
Note that this code even with the unchecked calls to realloc () runs fine
on win2k and linux. Btw I'll add the additional checks but I still think
there
is some kind of problem with wine.

ptsekov@syntrex.com writes:
> Thanks, for your analisys - the call to realloc () before the strcat ()
> is unchecked indeed - however this means that wine fails repeatedly 
> every call to realloc (). If you could give me any pointers how to debug 
> further the problem I'll be glad to try and see whats going on exactly.
realloc does not fail, but you are overflowing the buffer:

0806abc0:Call msvcrt.realloc(40382cac,00000020) ret=0040197e
0806abc0:Ret  msvcrt.realloc() retval=40382cac ret=0040197e
0806abc0:Call msvcrt.strcat(40382cb5 "Cygwin/bin/",40382c60
"/pinco/panco") ret=004019ae
0806abc0:Ret  msvcrt.strcat() retval=40382cb5 ret=004019ae

You realloc 32 bytes but copy 33. And this is the bug:

   internalURL = (char *) realloc (internalURL,
                                   internalURLlen + strlen (schema + 1));
                                                    ^^^^^^^^^^^^^^^^^^^^^
you take the length of schema+1 but copy schema.
> Note that this code even with the unchecked calls to realloc () runs fine
> on win2k and linux. Btw I'll add the additional checks but I still
think there
> is some kind of problem with wine.
It could be argued that since it doesn't crash on Windows it shouldn't
crash on Wine. But I suspect that with some other combination of
strings you could make it crash on Windows too.

-- 
Alexandre Julliard
julliard@winehq.com