gdi32: uninitialized dst_info->bmiHeader.biBitCount in GetDIBits(valgrind)

marc.bessieres at mykolab.com marc.bessieres at mykolab.com
Sun Dec 14 08:11:24 CST 2014


From: Marc Bessières <marc.bessieres at mykolab.com>

partial fix: https://bugs.winehq.org/show_bug.cgi?id=28766

Specific part:
==10523== Conditional jump or move depends on uninitialised value(s)
==10523==    at 0x530FA72: GetDIBits (dib.c:1248)
==10523==    by 0x496AFE6: test_dibsections (bitmap.c:542)
==10523==    by 0x4990928: func_bitmap (bitmap.c:5629)
==10523==    by 0x49EBCE4: run_test (test.h:584)
==10523==    by 0x49EC0D3: main (test.h:654)
==10523==  Uninitialised value was created by a stack allocation
==10523==    at 0x496A45A: test_dibsections (bitmap.c:415)

GetDIBits is called with bits == NULL and info->bmiHeader.biBitCount ==0
so it is just to query bitmap info with a partially initialized info->bmiHeader
But lines != 0, so the code dereference a part of info->bmiHeader that wasn't
initialized to set bits to NULL while it was already NULL..
---
 dlls/gdi32/dib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/gdi32/dib.c b/dlls/gdi32/dib.c
index 2931df1..a8b7d76 100644
--- a/dlls/gdi32/dib.c
+++ b/dlls/gdi32/dib.c
@@ -1253,7 +1253,7 @@ INT WINAPI GetDIBits(
     dst.visrect.right  = dst_info->bmiHeader.biWidth;
     dst.visrect.bottom = abs( dst_info->bmiHeader.biHeight );
 
-    if (lines == 0 || startscan >= dst.visrect.bottom)
+    if (bits && (lines == 0 || startscan >= dst.visrect.bottom))
         bits = NULL;
 
     if (!bits && dst_info->bmiHeader.biBitCount == 0) /* query bitmap info only */
-- 
2.1.2




More information about the wine-patches mailing list