NtGdiCreatePaletteInternal parameter value #0 uninit false pos on Win8.1 calc

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on November 14, 2013 11:23:14_

On Windows 8.1 x86 or wow64, starting up calc results in this system call
uninit. It's slotted as a "potential error" so not high priority but it's
worth a look as it could indicate either a real Windows bug or a DrMemory
bug:

Potential Error `#1`: UNINITIALIZED READ: reading 0x0514f47c-0x0514f480 4 byte(s) within 0x0514f45c-0x0514f860
#0 system call NtGdiCreatePaletteInternal parameter value `#0`
#1 GDI32.dll!CreatePalette
#2 gdiplus.dll!InternalNotificationStartup
#3 gdiplus.dll!BackgroundThreadProc
#4 gdiplus.dll!DllRefCountSafeThreadThunk
#5 KERNEL32.dll!BaseThreadInitThunk
Note: @0:00:04.078 in thread 344

typedef struct tagLOGPALETTE {
WORD palVersion;
WORD palNumEntries;
PALETTEENTRY palPalEntry[1];
} LOGPALETTE;
typedef struct tagPALETTEENTRY {
BYTE peRed;
BYTE peGreen;
BYTE peBlue;
BYTE peFlags;
} PALETTEENTRY;

4 bytes + 4 bytes per
so one of the PALLETTEENRY structs in the array is uninit, 0x20 into whole thing.

0:001:x86> dds esp
02bff568 773a9f23 GDI32!CreatePalette+0x17
02bff56c 02bff5b8
02bff570 00000100
0:001:x86> kb
ChildEBP RetAddr Args to Child
02bff564 773a9f23 02bff5b8 00000100 02bff9c8 GDI32!NtGdiCreatePaletteInternal
02bff574 778eaae0 02bff5b8 77a0f2d4 00000000 GDI32!CreatePalette+0x17
02bff9c8 778e102a 00000000 00000000 0000023f gdiplus!InternalNotificationStartup+0x123

gdiplus!InternalNotificationStartup+0x118:
778eaad5 8d442438 lea eax,[esp+38h]
778eaad9 50 push eax
778eaada ff157015a177 call dword ptr [gdiplus!_imp__CreatePalette (77a11570)]

bu gdiplus!InternalNotificationStartup
0:001:x86> ? 013ffa7c - 013ff630
Evaluate expression: 1100 = 0000044c

so at entry esp+38h + 0x20 to uninit == esp-44c+38+20

seems to be written here:
gdiplus!InternalNotificationStartup+0xf9:
778eaab6 884c943c mov byte ptr [esp+edx*4+3Ch],cl

cl came from gdiplus!GetDefaultColorPalette == from gdiplus.dll .data?

also here:
778eaac7 885c943f mov byte ptr [esp+edx*4+3Fh],bl

Ran out of time to analyze: moving on, but filing so we can pick this up
again. If it really is initialized this is a bug in DrMem.

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=1382_

Start by reproducing the Windows 8.1 x86 or WoW64 calc report and trace NtGdiCreatePaletteInternal through GDI32!CreatePalette and gdiplus!InternalNotificationStartup. Compare the reported uninitialized bytes with the LOGPALETTE and PALETTEENTRY layout; done means determining whether the value is initialized by Windows or whether DrMemory reports it incorrectly.

Written by the indexing model from the issue text.