[Bug 58340] New: dbghelp: symt_add_func_line, possible use after free.

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58340

Bug ID: 58340
           Summary: dbghelp: symt_add_func_line, possible use after free.
           Product: Wine
           Version: unspecified
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dbghelp
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

ASan reports function `symt_add_func_line`.
There in line 446 memory gets accessed via the pointer `prev`
which got freed in `vector_add` by a HeapReAlloc.

An example ASan output is available here:
https://gitlab.winehq.org/bernhardu/wine/-/blob/asan-pe_2025-05-06_wine-10.8...

This shows up only with ASAN_OPTION windows_hook_rtl_allocators=1.

A possible solution might be simply to repeat the assignment of `prev`
from line 429 after the `vector_add` in line 438?

[Bug 58340] dbghelp: symt_add_func_line, possible use after free.

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58340

Eric Pouech  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #1 from Eric Pouech  ---
thanks for catching this one

I'd prefer moving
   /* clear previous last */
   if (prev) prev->is_last = 0;
just before
    if (!last_matches)
(so that we have first half dealing with existing entries, and second half
dealing with new entries)

(for the record, regression introduced by
5c54087c4748324b1726fb8545dd90b3d80bc698)

[Bug 58340] dbghelp: symt_add_func_line, possible use after free.

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58340

--- Comment #2 from Bernhard Übelacker  ---
Thanks for the guidance, I submitted a merge request:
https://gitlab.winehq.org/wine/wine/-/merge_requests/8241

[Bug 58340] dbghelp: symt_add_func_line, possible use after free.

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58340

Bernhard Übelacker  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unspecified                 |10.4
         Resolution|---                         |FIXED
      Fixed by SHA1|                            |8f3bcabbc6af0645ec46d1e18ce
                   |                            |cca5dc832ebe6
             Status|NEW                         |RESOLVED
       Distribution|---                         |Debian
    Regression SHA1|                            |5c54087c4748324b1726fb8545d
                   |                            |d90b3d80bc698

--- Comment #3 from Bernhard Übelacker  ---
Merge request got committed, resolving fixed.

[Bug 58340] dbghelp: symt_add_func_line, possible use after free.

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58340

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #4 from Alexandre Julliard  ---
Closing bugs fixed in 10.10.