true uninitialized read in UxTheme running calc.exe in WinXP

_From [zhao...@google.com](https://code.google.com/u/106321947286816917100/) on August 27, 2013 13:56:30_

split from issue #1149 comment 4:

Error `#1`: UNINITIALIZED READ: reading 0x0007f980-0x0007f984 4 byte(s)
#0 UxTheme.dll!GetThemeBackgroundContentRect +0x95 (0x5ad73f1f )
#1 UxTheme.dll!DrawThemeText +0xce2 (0x5ad73cdb )
#2 UxTheme.dll!DrawThemeText +0xd21 (0x5ad73d1a )
#3 UxTheme.dll!GetThemeBackgroundContentRect +0x80 (0x5ad73f0b )
#4 COMCTL32.dll!Ordinal384 +0xc60f (0x773f84cb )
#5 COMCTL32.dll!Ordinal384 +0xc8f5 (0x773f87b1 )
#6 COMCTL32.dll!Ordinal384 +0xcf3f (0x773f8dfb )
#7 COMCTL32.dll!Ordinal384 +0xd274 (0x773f9130 )
#8 USER32.dll!GetDC +0x6c (0x7e418734 )
#9 USER32.dll!GetDC +0x14e (0x7e418816 )
#10 USER32.dll!DefWindowProcW +0x17f (0x7e428ea0 )
#11 USER32.dll!DefWindowProcW +0x1cb (0x7e428eec )
Note: @0:00:08.359 in thread 128
Note: instruction: cmp (%eax) %edx

0x5ad73f1f: cmp [eax],edx
the eax value is 0007f980, which is an address passed from caller.

The caller function:
5ad73c9a 8bff mov edi,edi
5ad73c9c 55 push ebp
5ad73c9d 8bec mov ebp,esp
5ad73c9f 83ec18 sub esp,0x18 <== allocate memory at 0007f980 from stack
5ad73ca2 53 push ebx
5ad73ca3 56 push esi
...
5ad73cc6 8bf8 mov edi,eax
5ad73cc8 8d45f8 lea eax,[ebp-0x8]
5ad73ccb 50 push eax
5ad73ccc 8d45e8 lea eax,[ebp-0x18] <== 0007f980
5ad73ccf 50 push eax
5ad73cd0 ff7510 push dword ptr [ebp+0x10]
5ad73cd3 8bcb mov ecx,ebx
5ad73cd5 57 push edi
5ad73cd6 e89ae7ffff call UxTheme+0x2475 (5ad72475)

There is no initialization on the caller.

It seems there is no init code for that memory in callee either.
5ad72475 8bff mov edi,edi
5ad72477 55 push ebp
5ad72478 8bec mov ebp,esp
5ad7247a 83ec10 sub esp,0x10
5ad7247d 56 push esi
5ad7247e 57 push edi
5ad7247f 8b7d08 mov edi,[ebp+0x8]
5ad72482 33d2 xor edx,edx
5ad72484 395714 cmp [edi+0x14],edx
5ad72487 894dfc mov [ebp-0x4],ecx
5ad7248a 0f848c1a0000 je UxTheme!GetThemeBackgroundContentRect+0x92 (5ad73f1c)
...
5ad73f1c 8b4510 mov eax,[ebp+0x10]
5ad73f1f 3910 cmp [eax],edx <== Uninit error report

ebp = 0x7f95c
app stack:
0:000> dds 0x7f944
0007f944 00f64e88
0007f948 00000000
0007f94c 00f64d3c
0007f950 00000010
0007f954 00000023
0007f958 00f64d3c
0007f95c 0007f998
0007f960 5ad73cdb UxTheme!DrawThemeText+0xce3
0007f964 00f64e88
0007f968 0007fad0
0007f96c 0007f980
0007f970 0007f990
0007f974 0007fa78
0007f978 0007fad0
0007f97c 00b61800
0007f980 00000000
0007f984 0000000e
0007f988 773d30c0 comctl32!Ordinal249+0x30c0
0007f98c 5ad7153d UxTheme+0x153d
0007f990 00383d34
0007f994 00383d20
0007f998 0007f9c4
0007f99c 5ad73d1a UxTheme!DrawThemeText+0xd22
0007f9a0 020215f8
0007f9a4 d8010847

It seems more likely to be a real uninit read error.

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=1316_