[Bug 20896] Use-after-free in DdeClientTransaction in user32 dde tests

wine-bugs at winehq.org wine-bugs at winehq.org
Wed Oct 19 20:38:15 CDT 2011


http://bugs.winehq.org/show_bug.cgi?id=20896

--- Comment #4 from Dan Kegel <dank at kegel.com> 2011-10-19 20:38:15 CDT ---
Here's an slightly less inlined stack:

 Invalid read of size 2
    at GlobalFree (heap.c:758)
    by WDML_FreeTransaction (dde_misc.c:2444)
    by DdeClientTransaction (dde_client.c:1228)
    by test_ddeml_client (dde.c:406, 416)
    by func_dde (dde.c:2702)
  Address 0x7f032ab8 is 0 bytes inside a block of size 8 free'd
    at notify_free (heap.c:262)
    by RtlFreeHeap (heap.c:1748)
    by HeapFree (heap.c:272)
    by GlobalFree (heap.c:770)
    by WDML_HandlePokeReply (dde_client.c:781)
    by WDML_HandleReply (dde_client.c:946)
    by WDML_SyncWaitTransactionReply (dde_client.c:1053)
    by WDML_ClientHandle (dde_client.c:1126)
    by DdeClientTransaction (dde_client.c:1224)
    by test_ddeml_client (dde.c:406)
    by func_dde (dde.c:2702)

-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.



More information about the wine-bugs mailing list