[Bug 28769] New: shell32/shellpath tests: test_knownFolders() triggers use-after-free and invalid free in foldermanager

wine-bugs at winehq.org wine-bugs at winehq.org
Mon Oct 17 10:44:22 CDT 2011


http://bugs.winehq.org/show_bug.cgi?id=28769

             Bug #: 28769
           Summary: shell32/shellpath tests: test_knownFolders() triggers
                    use-after-free and invalid free in foldermanager
           Product: Wine
           Version: 1.3.30
          Platform: x86
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: shell32
        AssignedTo: wine-bugs at winehq.org
        ReportedBy: dank at kegel.com
    Classification: Unclassified


Running "make shellpath.ok" in shell32/tests, Valgrind complains:

Invalid read of size 1
   at foldermanager_GetFolder (shellpath.c:3764)
   by test_knownFolders (shellpath.c:2199)
   by func_shellpath (shellpath.c:2517)
   by run_test (test.h:556)
   by main (test.h:624)
 Address 0x7f041870 is 472 bytes inside a block of size 1,024 free'd
   at RtlFreeHeap (heap.c:262)
   by add_with_alpha (imagelist.c:237)
   by ImageList_ReplaceIcon (imagelist.c:2508)
   by SIC_IconAppend (iconcache.c:284)
   by SIC_Initialize (iconcache.c:428)
   by DllMain (shell32_main.c:1200)

Invalid read of size 1
   at foldermanager_GetFolder (shellpath.c:3764)
   by test_knownFolders (shellpath.c:2233)
   by func_shellpath (shellpath.c:2517)
   by run_test (test.h:556)
   by main (test.h:624)
 Address 0x7f041870 is 472 bytes inside a block of size 1,024 free'd
   at RtlFreeHeap (heap.c:262)
   by add_with_alpha (imagelist.c:237)
   by ImageList_ReplaceIcon (imagelist.c:2508)
   by SIC_IconAppend (iconcache.c:284)
   by SIC_Initialize (iconcache.c:428)
   by DllMain (shell32_main.c:1200)

Invalid free() / delete / delete[]
   at RtlFreeHeap (heap.c:262)
   by foldermanager_Release (shellpath.c:3684)
   by test_knownFolders (shellpath.c:2485)
   by func_shellpath (shellpath.c:2517)
   by run_test (test.h:556)
   by main (test.h:624)
 Address 0x7f041870 is 472 bytes inside a block of size 1,024 free'd
   at RtlFreeHeap (heap.c:262)
   by add_with_alpha (imagelist.c:237)
   by ImageList_ReplaceIcon (imagelist.c:2508)
   by SIC_IconAppend (iconcache.c:284)
   by SIC_Initialize (iconcache.c:428)
   by DllMain (shell32_main.c:1200)

-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.



More information about the wine-bugs mailing list