November 2009 - Wine-bugs - list.winehq.org

[Bug 20849] New: read buffer overflow in CRYPT_RemoveStringFromMultiString() triggered by crypt32/tests/oid.c
by wine-bugs＠winehq.org 04 Dec '09

04 Dec '09

http://bugs.winehq.org/show_bug.cgi?id=20849 Summary: read buffer overflow in CRYPT_RemoveStringFromMultiString() triggered by crypt32/tests/oid.c Product: Wine Version: 1.1.33 Platform: PC OS/Version: Linux Status: NEW Keywords: source, testcase Severity: normal Priority: P2 Component: crypt32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com http://kegel.com/wine/valgrind/logs/2009-11-18-21.51/vg-crypt32_oid.txt says Invalid read of size 1 at memmove (mc_replace_strmem.c:613) by CRYPT_RemoveStringFromMultiString (oid.c:885) by CryptUnregisterDefaultOIDFunction (oid.c:1010) by test_registerDefaultOIDFunction (oid.c:437) by func_oid (oid.c:601) by run_test (test.h:535) by main (test.h:585) Address 0x7f040ed4 is 0 bytes after a block of size 44 alloc'd at notify_alloc (heap.c:279) by RtlAllocateHeap (heap.c:1521) by CryptMemAlloc (main.c:125) by CRYPT_GetDefaultOIDDlls (oid.c:930) by CryptUnregisterDefaultOIDFunction (oid.c:1009) by test_registerDefaultOIDFunction (oid.c:437) This is near the code changed in http://www.winehq.org/pipermail/wine-cvs/2009-November/061282.html The error persists with the latest wine sources. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 20764] New: Reason 4 application aborts with "unexpected error" dialog after installation
by wine-bugs＠winehq.org 04 Dec '09

04 Dec '09

http://bugs.winehq.org/show_bug.cgi?id=20764 Summary: Reason 4 application aborts with "unexpected error" dialog after installation Product: Wine Version: 1.1.33 Platform: PC URL: http://dl.propellerheads.se/propellerhead/ReasonDemo_w in.zip OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: ntdll AssignedTo: wine-bugs(a)winehq.org ReportedBy: arethusa26(a)gmail.com With wine-1.1.33-259-g7782ebe, after installing Reason 4, when attempting to launch it, a message box appears: "The application can not run because of an unexpected error." Since Reason 4 started in wine-1.1.29, a regression test was performed, which showed: 1cf1a3f211f9dbbcfff2ef92f53181f540e9ac32 is first bad commit commit 1cf1a3f211f9dbbcfff2ef92f53181f540e9ac32 Author: Alexandre Julliard <julliard(a)winehq.org> Date: Tue Sep 22 17:05:02 2009 +0200 ntdll: Only create the CPU registry keys on first run. :040000 040000 ee7ec1d8aab6722caac42a212b2f16df9e89b527 51a00bde240032ad9d4d0ec3661edea167b91f32 M dlls >From +relay,+seh log: 0009:Call advapi32.RegOpenKeyExW(80000002,02210cb8 L"Hardware\\Description\\System\\CentralProcessor",00000000,00020019,0032da00) ret=0173a6e0 0009:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=0173a6e0 0009:Call advapi32.RegCloseKey(000000a0) ret=0173a6ed 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=0173a6ed ... 0009:Call advapi32.RegCreateKeyExW(80000002,02210cb8 L"Hardware\\Description\\System\\CentralProcessor",00000000,00000000,00000000,00020019,00000000,0032da80,0032d9f8) ret=0173a685 0009:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=0173a685 ... 0009:Call advapi32.RegOpenKeyExW(000000a0,0032da3c L"0",00000000,00020019,0032da00) ret=0173a6e0 0009:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=0173a6e0 0009:Call advapi32.RegCloseKey(000000a4) ret=0173a6ed 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=0173a6ed ... 0009:Call advapi32.RegCreateKeyExW(000000a0,0032da3c L"0",00000000,00000000,00000000,00020019,00000000,0032daa4,0032d9f8) ret=0173a685 0009:Ret advapi32.RegCreateKeyExW() retval=000003fd ret=0173a685 ... 0009:Call KERNEL32.RaiseException(e06d7363,00000001,00000003,0032d9c4) ret=01750372 0009:trace:seh:raise_exception code=e06d7363 flags=1 addr=0x7b8439c3 ip=7b8439c3 tid=0009 RegCreateKeyExW returns ERROR_CHILD_MUST_BE_VOLATILE, so presumably Reason 4 isn't expecting the registry key to be volatile. I also note that once Reason 4 is made to start in an earlier Wine version, Reason 4 will launch in newer Wine versions. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 20774] New: Vampire: The Masquerade - Bloodlines: broken fonts
by wine-bugs＠winehq.org 04 Dec '09

04 Dec '09

http://bugs.winehq.org/show_bug.cgi?id=20774 Summary: Vampire: The Masquerade - Bloodlines: broken fonts Product: Wine Version: 1.1.26 Platform: PC OS/Version: Linux Status: UNCONFIRMED Severity: minor Priority: P4 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: twee(a)tweedle-dee.org Created an attachment (id=24870) --> (http://bugs.winehq.org/attachment.cgi?id=24870) Screenshot displaying incorrect fonts After installation from CD, game render fonts very badly, as shown on attachment (taken on Slackware 12 with wine-1.1.26). -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[Bug 20754] New: QIP Infium not start with 1.1.33 [regression]
by wine-bugs＠winehq.org 04 Dec '09

04 Dec '09

http://bugs.winehq.org/show_bug.cgi?id=20754 Summary: QIP Infium not start with 1.1.33 [regression] Product: Wine Version: 1.1.33 Platform: PC URL: http://qip.ru OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: landy2005(a)gmail.com Versions: OS: Linux Ubintu karmic i386 Wine: 1.1.33 Repo: https://launchpad.net/~ubuntu-wine/ QIP: Infium (Build 9032 RC4) QIP Infium does not start after upgrading to wine version 1.1.33. With previous versions of wine it works fine. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 20759] New: Read buffer overflow in NdrConformantArrayMarshall?
by wine-bugs＠winehq.org 04 Dec '09

04 Dec '09

http://bugs.winehq.org/show_bug.cgi?id=20759 Summary: Read buffer overflow in NdrConformantArrayMarshall? Product: Wine Version: 1.1.33 Platform: PC OS/Version: Linux Status: NEW Keywords: source, testcase Severity: normal Priority: P2 Component: rpc AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com http://kegel.com/wine/valgrind/logs/2009-11-18-21.51/vg-ole32_marshal.txt contains a new warning thanks to the heap tail check: Invalid read of size 1 at memcpy (mc_replace_strmem.c:482) by safe_copy_to_buffer (ndr_marshall.c:707) by array_write_variance_and_marshall (ndr_marshall.c:1926) by NdrConformantArrayMarshall (ndr_marshall.c:3626) by PointerMarshall (ndr_marshall.c:816) by NdrPointerMarshall (ndr_marshall.c:1488) by PointerMarshall (ndr_marshall.c:816) by NdrPointerMarshall (ndr_marshall.c:1488) by IRemUnknown_RemQueryInterface_Stub (dcom_p.c:386) by CStdStubBuffer_Invoke (cstub.c:475) by RPC_ExecuteCall (rpc.c:1392) by apartment_wndproc (compobj.c:885) by ??? (library.h:159) by call_window_proc (winproc.c:469) by WINPROC_CallProcAtoW (winproc.c:1023) by WINPROC_call_window (winproc.c:2225) by DispatchMessageA (message.c:3089) by host_object_proc (marshal.c:253) by ??? (signal_i386.c:2312) by call_thread_entry_point (signal_i386.c:2338) Address 0x7f04822f is 3 bytes after a block of size 44 alloc'd at notify_alloc (heap.c:279) by RtlAllocateHeap (heap.c:1521) by IMalloc_fnAlloc (ifs.c:186) by CoTaskMemAlloc (ifs.c:562) by RemUnknown_RemQueryInterface (stubmanager.c:657) by IRemUnknown_RemQueryInterface_Stub (dcom_p.c:370) by CStdStubBuffer_Invoke (cstub.c:475) by RPC_ExecuteCall (rpc.c:1392) by apartment_wndproc (compobj.c:885) by ??? (library.h:159) by call_window_proc (winproc.c:469) by WINPROC_CallProcAtoW (winproc.c:1023) by WINPROC_call_window (winproc.c:2225) by DispatchMessageA (message.c:3089) by host_object_proc (marshal.c:253) by ??? (signal_i386.c:2312) by call_thread_entry_point (signal_i386.c:2338) by start_thread (thread.c:469) by start_thread (pthread_create.c:297) by clone (clone.S:130) This can be reproduced locally by setting up valgrind as described in http://wiki.winehq.org/Valgrind and applying the heap tail check patch to wine, starting winemine (to avoid valgrinding services), then running WINETEST_PLATFORM=wine WINE_HEAP_REDZONE=16 valgrind --trace-children=yes --track-origins=yes --num-callers=30 wine ole32_test.exe.so marshal (And, bonus deal, there's a null ptr crash in the same log file later down: Backtrace: =>0 test_local_server+0x5e4() [dlls/ole32/tests/marshal.c:2711] in ole32_test 1 func_marshal+0x1ab() [dlls/ole32/tests/marshal.c:3092] in ole32_test ... 2711 IClassFactory_Release(cf); but I suppose that might be a different bug.) -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 20760] New: Write buffer overrun in CreateFileMoniker()
by wine-bugs＠winehq.org 04 Dec '09

04 Dec '09

http://bugs.winehq.org/show_bug.cgi?id=20760 Summary: Write buffer overrun in CreateFileMoniker() Product: Wine Version: 1.1.33 Platform: PC OS/Version: Linux Status: NEW Keywords: source, testcase Severity: normal Priority: P2 Component: ole32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com http://kegel.com/wine/valgrind/logs/2009-11-18-21.51/diff-hlink_hlink.txt http://kegel.com/wine/valgrind/logs/2009-11-18-21.51/vg-hlink_hlink.txt shows a new error thanks to the heap tail check. Looks like a level-of-indirection-during-allocation error, 1039 strgtable = CoTaskMemAlloc(len*sizeof(WCHAR)); should be 1039 strgtable = CoTaskMemAlloc(len*sizeof(WCHAR *)); Ulrich, you were in there last, could you have a look? Invalid write of size 4 at FileMonikerImpl_DecomposePath (filemoniker.c:1056) by FileMonikerImpl_Construct (filemoniker.c:1375) by CreateFileMoniker (filemoniker.c:1443) by FileMoniker_CreateFromDisplayName (filemoniker.c:1484) by MkParseDisplayName (moniker.c:1130) by HlinkCreateFromString (hlink_main.c:124) by test_persist (hlink.c:479) by func_hlink (hlink.c:1122) by run_test (test.h:535) by main (test.h:585) Address 0x7f04416c is 4 bytes inside a block of size 6 alloc'd at notify_alloc (heap.c:279) by RtlAllocateHeap (heap.c:1521) by IMalloc_fnAlloc (ifs.c:186) by CoTaskMemAlloc (ifs.c:562) by FileMonikerImpl_DecomposePath (filemoniker.c:1039) by FileMonikerImpl_Construct (filemoniker.c:1375) by CreateFileMoniker (filemoniker.c:1443) by FileMoniker_CreateFromDisplayName (filemoniker.c:1484) by MkParseDisplayName (moniker.c:1130) by HlinkCreateFromString (hlink_main.c:124) by test_persist (hlink.c:479) This can be reproduced locally by setting up valgrind as described in http://wiki.winehq.org/Valgrind and applying the heap tail check patch to wine, starting winemine (to avoid valgrinding services), then running cd dlls/ole32/tests WINETEST_PLATFORM=wine WINE_HEAP_REDZONE=16 valgrind --trace-children=yes --track-origins=yes --num-callers=30 wine ole32_test.exe.so moniker although when I do that with today's sources, I get the slightly different error Invalid write of size 4 at FileMonikerImpl_DecomposePath (filemoniker.c:1087) by FileMonikerImpl_Construct (filemoniker.c:1375) by FileMonikerCF_CreateInstance (filemoniker.c:1593) by CoCreateInstance (compobj.c:2502) by get_unmarshaler_from_stream (marshal.c:1575) by CoReleaseMarshalData (marshal.c:1882) by rot_entry_delete (moniker.c:182) by RunningObjectTableImpl_Revoke (moniker.c:595) by test_ROT (moniker.c:632) by func_moniker (moniker.c:1943) Address 0x7f03fcb0 is 0 bytes after a block of size 0 alloc'd at notify_alloc (heap.c:279) by RtlAllocateHeap (heap.c:1521) by IMalloc_fnAlloc (ifs.c:186) by CoTaskMemAlloc (ifs.c:562) by FileMonikerImpl_DecomposePath (filemoniker.c:1039) by FileMonikerImpl_Construct (filemoniker.c:1375) by FileMonikerCF_CreateInstance (filemoniker.c:1593) by CoCreateInstance (compobj.c:2502) by get_unmarshaler_from_stream (marshal.c:1575) by CoReleaseMarshalData (marshal.c:1882) by rot_entry_delete (moniker.c:182) by RunningObjectTableImpl_Revoke (moniker.c:595) by test_ROT (moniker.c:632) by func_moniker (moniker.c:1943) There's a simpler, similar looking error later on: Invalid write of size 4 at 0xD876677: FileMonikerImpl_DecomposePath (filemoniker.c:1087) by 0xD8771E0: FileMonikerImpl_Construct (filemoniker.c:1375) by 0xD877514: CreateFileMoniker (filemoniker.c:1443) by 0xCF306BC: test_file_moniker (moniker.c:1387) by 0xCF30A50: test_file_monikers (moniker.c:1448) by 0xCF333FC: func_moniker (moniker.c:1947) Address 0x7f045468 is 8 bytes inside a block of size 10 alloc'd at 0xCC8463B: notify_alloc (heap.c:279) by 0xCC844D9: RtlAllocateHeap (heap.c:1521) by 0xD87B372: IMalloc_fnAlloc (ifs.c:186) by 0xD87C38E: CoTaskMemAlloc (ifs.c:562) by 0xD8764EA: FileMonikerImpl_DecomposePath (filemoniker.c:1039) by 0xD8771E0: FileMonikerImpl_Construct (filemoniker.c:1375) by 0xD877514: CreateFileMoniker (filemoniker.c:1443) by 0xCF306BC: test_file_moniker (moniker.c:1387) -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 20739] New: winecfg emits a warning called an error
by wine-bugs＠winehq.org 04 Dec '09

04 Dec '09

http://bugs.winehq.org/show_bug.cgi?id=20739 Summary: winecfg emits a warning called an error Product: Wine Version: 1.1.33 Platform: PC OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: herrold(a)owlriver.com wine-1.1.33-0.el5.mh (Mike Harris packaging for CentOS 5) see: http://wiki.centos.org/AdditionalResources/Repositories for a pointer Ran winecfg, with the 800x600 desktop option set and got: err:x11drv:X11DRV_CreateBitmap Trying to make bitmap with planes=1, bpp=32 This seems to be an uncaught warning, and not an error -- if there a 'try' option to permit detection and 'swallowing' it? -- Russ herrold -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 20745] New: WinZip 12.1 installer subprocess crashes during installation
by wine-bugs＠winehq.org 04 Dec '09

04 Dec '09

http://bugs.winehq.org/show_bug.cgi?id=20745 Summary: WinZip 12.1 installer subprocess crashes during installation Product: Wine Version: 1.1.33 Platform: PC URL: http://download.winzip.com/wzd/winzip121.exe OS/Version: Linux Status: UNCONFIRMED Severity: minor Priority: P2 Component: ole32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: arethusa26(a)gmail.com Created an attachment (id=24813) --> (http://bugs.winehq.org/attachment.cgi?id=24813) WinZip 12.1 installer standard error With wine-1.1.33-150-g4990ca0, during the WinZip 12.1 installation process, the installer invokes the installed winzip32.exe at a certain point in the installation, resulting in: Backtrace: =>0 0x00a7d046 (0x0033fd04) 1 0x7e6fcbca apartment_release+0x15a(apt=0x157818) [/home/andrew/wine-git/dlls/ole32/compobj.c:597] in ole32 (0x0033fd44) 2 0x7e6fd9e2 CoUninitialize+0x152() [/home/andrew/wine-git/dlls/ole32/compobj.c:1385] in ole32 (0x0033fd74) 3 0x7e7254b7 OleUninitialize+0x67() [/home/andrew/wine-git/dlls/ole32/ole2.c:263] in ole32 (0x0033fd94) 4 0x004523e6 in winzip32 (+0x523e6) (0x0033fd9c) ... The standard error output is attached. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 20715] New: ACDSee 3.0 (old version) hanging on exit
by wine-bugs＠winehq.org 04 Dec '09

04 Dec '09

http://bugs.winehq.org/show_bug.cgi?id=20715 Summary: ACDSee 3.0 (old version) hanging on exit Product: Wine Version: 1.1.33 Platform: PC URL: http://www.oldversion.com/download_ACDSee_3.0.html OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: lahmbi5675(a)gmx.de Wine version is 1.1.33, mode is win98. This is a really old version of ACDSee, download link above, not to be confused with current ACDSee 3.0 Pro, which is a completely different application. I'm just starting ACDSee and exiting without any further action, getting this in the console output: err:ntdll:RtlpWaitForCriticalSection section 0x7bc9f660 "exception.c: vectored_handlers_section" wait timed out in thread 001e, blocked by 0009, retrying (60 sec) I then have to do "winserver -k", if I want to properly start ACDSee again. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 20686] New: Regression in latest git causes WOW screen corruption
by wine-bugs＠winehq.org 04 Dec '09

04 Dec '09

http://bugs.winehq.org/show_bug.cgi?id=20686 Summary: Regression in latest git causes WOW screen corruption Product: Wine Version: 1.1.29 Platform: PC OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: celticht32(a)aol.com latest git causes screen corruption in WOW Git regression says : [cahrendt(a)stinky wine-git]$ git bisect bad 8e750b0ef6d810465d12566b6f03e6ce28b9451d is first bad commit commit 8e750b0ef6d810465d12566b6f03e6ce28b9451d Author: Rob Shearman <robertshearman(a)gmail.com> Date: Thu Nov 12 10:31:25 2009 +0000 widl: Include range types in constant BufferLength calculation for server function. :040000 040000 28e1f6d17f58a903618d98357718444b661f40ff 43265670cae4c487353cc73ee8b7d0d5f542df65 M tools [cahrendt(a)stinky wine-git]$ -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5