March 2017 - Wine-bugs - list.winehq.org

[Bug 40373] New: Double free in RPCRT4
by wine-bugs＠winehq.org 10 Jun '19

10 Jun '19

https://bugs.winehq.org/show_bug.cgi?id=40373 Bug ID: 40373 Summary: Double free in RPCRT4 Product: Wine Version: unspecified Hardware: x86 OS: Windows Status: UNCONFIRMED Severity: normal Priority: P2 Component: rpc Assignee: wine-bugs(a)winehq.org Reporter: timo.kreuzer(a)web.de Created attachment 54078 --> https://bugs.winehq.org/attachment.cgi?id=54078 idl file RPCRT4 can double free parameter allocations from NdrStubCall2 The specific situation where this happened is the following: - The idl file was lsa.idl from ReactOS (file attached) - The function was LsarRetrievePrivateData - The parameter was EncryptedData - It happened in cleanup of marshalled parameters within NdrStubCall2, after calling this function What happened: - NdrStubCall2 iterates though the marshaling phases - On STUBLESS_MUSTFREE: - params[i].attr.MustFree is TRUE for parameter i = 2 (EncryptedData) - call_freer() is invoked with a pointer pointing to the parameter (pointer to the parameter location!) - param->attr.IsByValue is FALSE, so pMemory = *(unsigned char **)pMemory; pMemory is now equal to the value EncryptedData (a pointer to a pointer) - NdrFreer[pFormat[0] & NDR_TABLE_MASK] (NdrPointerFree) is called - NdrPointerFree calls PointerFree - desc = pFormat + *(const SHORT*)pFormat; - (attr & RPC_FC_P_DEREF) is TRUE, so current_pointer = *(unsigned char**)Pointer; (In the observed case this is NULL, since the function returned NULL in that OUT parameter) - NdrFreer[*desc & NDR_TABLE_MASK] (NdrPointerFree) is called with current_pointer (doing nothing, since it's NULL) - Pointer is not within pStubMsg->Buffer - attr & RPC_FC_P_ONSTACK is not set (this is different on midl!) - NdrFree(pStubMsg, Pointer) is called, freeing the pointer - On STUBLESS_FREE: - params[i].attr.ServerAllocSize is != 0 - HeapFree(GetProcessHeap(), 0, *(void **)pArg) is called on the pointer that was freed before. I cannot say exactly what is wrong here, but I see 2 potential problems: - The type for the parameter has different flags between midl and widl (the parameter data is the same), where widl is missing the [alloced_on_stack] flag: midl: /* 2076 */ 0x11, 0x14, /* FC_RP [alloced_on_stack] [pointer_deref] */ /* 2078 */ NdrFcShort( 0xffb6 ), /* Offset= -74 (2004) */ widl: /* 3112 (PLSAPR_CR_CIPHER_VALUE *) */ 0x11, 0x10, /* FC_RP [pointer_deref] */ NdrFcShort(0xfffa), /* Offset= -6 (3108) */ With this flag, the parameter is not freed, but that might not be the correct solution. - Parameters with ServerAlloc are allocated from the heap, while according to https://msdn.microsoft.com/library/windows/desktop/aa374362%28v=vs.85%29.as…, it should be allocated on the stack, so it would not be freed. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 37279] New: builtin IE "document.location.pathname" returns without leading slash
by wine-bugs＠winehq.org 10 Jun '19

10 Jun '19

https://bugs.winehq.org/show_bug.cgi?id=37279 Bug ID: 37279 Summary: builtin IE "document.location.pathname" returns without leading slash Product: Wine Version: 1.7.26 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: mshtml Assignee: wine-bugs(a)winehq.org Reporter: penghao(a)linuxdeepin.com Created attachment 49577 --> https://bugs.winehq.org/attachment.cgi?id=49577 test case I have upload a test html page, use jscript to get value of document.location.pathname. if it was start with a leading slash, nothing will happen; if don't, will be a alert. this page was tested on IE8/11, Chrome, Firefox. they are all right. but in builtin IE the value will do not have leading slash. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 10

[Bug 34021] New: IE8 crashes badly when navigating to www.microsoft.com
by wine-bugs＠winehq.org 10 Jun '19

10 Jun '19

http://bugs.winehq.org/show_bug.cgi?id=34021 Bug #: 34021 Summary: IE8 crashes badly when navigating to www.microsoft.com Product: Wine Version: 1.6-rc4 Platform: x86-64 URL: http://download.microsoft.com/download/C/C/0/CC0BD555- 33DD-411E-936B-73AC6F95AE11/IE8-WindowsXP-x86-ENU.exe OS/Version: Linux Status: NEW Keywords: download Severity: minor Priority: P2 Component: wininet AssignedTo: wine-bugs(a)winehq.org ReportedBy: kennybobs(a)o2.co.uk Classification: Unclassified Created attachment 45209 --> http://bugs.winehq.org/attachment.cgi?id=45209 wine-1.6-rc4-122-g104adb7 console output (caught by redirects) Working around Bug 25648, "wine ~/.wine/drive_c/Program\ Files/Internet\ Explorer/iexplore.exe www.microsoft.com" crashes out badly. See logs. However, workaround is supplied wininet (and urlmon - unimplemented function). -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 10

[Bug 36652] New: valgrind shows some uninitialized variables in d3d10core/tests/device.c
by wine-bugs＠winehq.org 10 Jun '19

10 Jun '19

https://bugs.winehq.org/show_bug.cgi?id=36652 Bug ID: 36652 Summary: valgrind shows some uninitialized variables in d3d10core/tests/device.c Product: Wine Version: 1.7.19 Hardware: x86 OS: Linux Status: NEW Keywords: download, source, testcase, valgrind Severity: normal Priority: P2 Component: directx-d3d Assignee: wine-bugs(a)winehq.org Reporter: austinenglish(a)gmail.com ==6205== Conditional jump or move depends on uninitialised value(s) ==6205== at 0x402DEDF: bcmp (mc_replace_strmem.c:935) ==6205== by 0x50CE81F: d3d10_depthstencil_state_compare (device.c:2092) ==6205== by 0x50C7637: wine_rb_get (rbtree.h:237) ==6205== by 0x50CCA1A: d3d10_device_CreateDepthStencilState (device.c:1416) ==6205== by 0x4F5C5AD: test_create_depthstencil_state (d3d10.h:5752) ==6205== by 0x4F5D127: func_device (device.c:893) ==6205== by 0x4F5DF24: run_test (test.h:584) ==6205== by 0x4F5E312: main (test.h:654) ==6205== Uninitialised value was created by a stack allocation ==6205== at 0x4F5C3D1: test_create_depthstencil_state (device.c:728) ==6205== } ==6205== Conditional jump or move depends on uninitialised value(s) ==6205== at 0x402DEDF: bcmp (mc_replace_strmem.c:935) ==6205== by 0x50CE81F: d3d10_depthstencil_state_compare (device.c:2092) ==6205== by 0x50D1E68: wine_rb_remove (rbtree.h:291) ==6205== by 0x50D2BA5: d3d10_depthstencil_state_Release (state.c:222) ==6205== by 0x4F5C7CE: test_create_depthstencil_state (d3d10.h:3052) ==6205== by 0x4F5D127: func_device (device.c:893) ==6205== by 0x4F5DF24: run_test (test.h:584) ==6205== by 0x4F5E312: main (test.h:654) ==6205== Uninitialised value was created by a stack allocation ==6205== at 0x4F5C3D1: test_create_depthstencil_state (device.c:728) ==6205== ==6205== Conditional jump or move depends on uninitialised value(s) ==6205== at 0x402DEDF: bcmp (mc_replace_strmem.c:935) ==6205== by 0x50CE81F: d3d10_depthstencil_state_compare (device.c:2092) ==6205== by 0x50D1EF8: wine_rb_remove (rbtree.h:300) ==6205== by 0x50D2BA5: d3d10_depthstencil_state_Release (state.c:222) ==6205== by 0x4F5C7CE: test_create_depthstencil_state (d3d10.h:3052) ==6205== by 0x4F5D127: func_device (device.c:893) ==6205== by 0x4F5DF24: run_test (test.h:584) ==6205== by 0x4F5E312: main (test.h:654) ==6205== Uninitialised value was created by a stack allocation ==6205== at 0x4F5C3D1: test_create_depthstencil_state (device.c:728) ==6205== This is on nvidia hardware, rather than intel/mesa: OpenGL renderer string: GeForce GTX 460/PCIe/SSE2 OpenGL core profile version string: 4.3.0 NVIDIA 337.25 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 36249] New: valgrind shows two potential leaks in d3d10/tests/effect.c
by wine-bugs＠winehq.org 10 Jun '19

10 Jun '19

https://bugs.winehq.org/show_bug.cgi?id=36249 Bug ID: 36249 Summary: valgrind shows two potential leaks in d3d10/tests/effect.c Product: Wine Version: 1.7.18 Hardware: x86 OS: Linux Status: NEW Keywords: download, source, testcase Severity: normal Priority: P2 Component: directx-d3d Assignee: wine-bugs(a)winehq.org Reporter: austinenglish(a)gmail.com ==25807== 12,068 bytes in 1 blocks are possibly lost in loss record 779 of 802 ==25807== at 0x7BC4C735: notify_alloc (heap.c:255) ==25807== by 0x7BC50F79: RtlAllocateHeap (heap.c:1716) ==25807== by 0x4D9230A: wined3d_create (wined3d_main.c:95) ==25807== by 0x4C621D6: dxgi_factory_init (factory.c:332) ==25807== by 0x4C62568: dxgi_factory_create (factory.c:404) ==25807== by 0x4C6084A: CreateDXGIFactory (dxgi_main.c:80) ==25807== by 0x49B63B8: D3D10CreateDevice (d3d10_main.c:63) ==25807== by 0x495611C: create_device (effect.c:30) ==25807== by 0x4967153: test_effect_local_shader (effect.c:2723) ==25807== by 0x497315C: func_effect (effect.c:4284) ==25807== by 0x4973F60: run_test (test.h:584) ==25807== by 0x497434F: main (test.h:654) ==28927== 12,068 bytes in 1 blocks are possibly lost in loss record 808 of 833 ==28927== at 0x7BC4C735: notify_alloc (heap.c:255) ==28927== by 0x7BC50F79: RtlAllocateHeap (heap.c:1716) ==28927== by 0x4F8213E: wined3d_create (wined3d_main.c:95) ==28927== by 0x4E521D6: dxgi_factory_init (factory.c:332) ==28927== by 0x4E52568: dxgi_factory_create (factory.c:404) ==28927== by 0x4E5084A: CreateDXGIFactory (dxgi_main.c:80) ==28927== by 0x49B63B8: D3D10CreateDevice (d3d10_main.c:63) ==28927== by 0x495611C: create_device (effect.c:30) ==28927== by 0x496FEC9: test_effect_state_groups (effect.c:3908) ==28927== by 0x4973166: func_effect (effect.c:4286) ==28927== by 0x4973F60: run_test (test.h:584) ==28927== by 0x497434F: main (test.h:654) ==28927== -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 4

[Bug 22109] New: BiuTicker: Text in list displayed too deep and clipped away
by wine-bugs＠winehq.org 07 Jun '19

07 Jun '19

http://bugs.winehq.org/show_bug.cgi?id=22109 Summary: BiuTicker: Text in list displayed too deep and clipped away Product: Wine Version: 1.1.39 Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: gdi32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: wolfgang.schwotzer(a)gmx.net Created an attachment (id=26951) --> (http://bugs.winehq.org/attachment.cgi?id=26951) BiuTicker list display (text drawn too deep) When starting BiuTicker a list of stock chart properties is displayed. In this list the text is displayed too deep. Only the top most scan line of each character is visible, the rest is clipped away. See attachments. My current error analysis: Within DrawTextExW: y-coordinates are negative viewport coordinates are positive. DT_NOCLIP is 0 (clipping active) DT_SINGLELINE is 1 DT_VCENTER is 1 (Center text vertically) According to these flags the y coordinate (of the bottom line) is calculated. When calling ExtTextOutW the text alignment within the used DC is TA_TOP which results in using the y coordinate as top line (instead of bottom line). Forcing alignment to TA_BOTTOM before calling ExtTextOutW would display the text right but has side effects on other DrawTextExW calls. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 32

[Bug 15443] New: Wacom Bamboo drawing tablet lacking pressure sensitivity with Manga Studio EX 3.0
by wine-bugs＠winehq.org 07 Jun '19

07 Jun '19

http://bugs.winehq.org/show_bug.cgi?id=15443 Summary: Wacom Bamboo drawing tablet lacking pressure sensitivity with Manga Studio EX 3.0 Product: Wine Version: 1.1.5 Platform: PC OS/Version: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: wintab32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: salvatore.iovene(a)gmail.com Created an attachment (id=16316) --> (http://bugs.winehq.org/attachment.cgi?id=16316) Manga Studio EX 3.0 wintab32 debug log Running wine 1.1.5 in Ubuntu 8.04, my Wacom Bamboo One works perfectly under X in programs like Gimp and Inkscape. With Wine, it also works perfectly with ArtRage 2 Starters Edition. But Manga Studio EX 3.0 (rated platinum in wine apps db) lacks pressure sensitivity. Please find the attached debug logs from wintab32. I attached the log from Manga Studio and from ArtRage (for comparison). Both logs have been acquired by launching the program and try to draw a few lines with the pen. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 37

[Bug 38012] New: Shivers video does not play in fullscreen
by wine-bugs＠winehq.org 07 Jun '19

07 Jun '19

https://bugs.winehq.org/show_bug.cgi?id=38012 Bug ID: 38012 Summary: Shivers video does not play in fullscreen Product: Wine Version: 1.7.35 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: legluondunet(a)free.fr Distribution: --- Hello, the last road to a 100% Shivers Wine compatibility is near. But it stays a very annoying bug: Shivers videos (VDM video files from Sierra) don't play in fullscreen, but in their original resolution, very tiny resolution, in the upper left corner of the screen... LGDN. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 23

[Bug 28800] New: d3d8/tests/device.ok fails under valgrind?
by wine-bugs＠winehq.org 06 Jun '19

06 Jun '19

http://bugs.winehq.org/show_bug.cgi?id=28800 Bug #: 28800 Summary: d3d8/tests/device.ok fails under valgrind? Product: Wine Version: 1.3.30 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: directx-d3d AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com Classification: Unclassified On my i5 laptop, with ubuntu 11.10, "make device.ok" fails in d3d8/tests under valgrind. Log: device.c:2472: Test failed: cw is 0xf7f, expected 0xf60. device.c:2484: Test failed: cw is 0x37f, expected 0x7f. device.c:2489: Test failed: cw is 0x37f, expected 0x7f. device.c:2492: Test failed: cw is 0xf7f, expected 0xf60. device.c:2499: Test failed: cw is 0xf7f, expected 0xf60. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 8

[Bug 36347] New: valgrind shows a few leaks in d3d8/tests/stateblock.c
by wine-bugs＠winehq.org 06 Jun '19

06 Jun '19

https://bugs.winehq.org/show_bug.cgi?id=36347 Bug ID: 36347 Summary: valgrind shows a few leaks in d3d8/tests/stateblock.c Product: Wine Version: 1.7.17 Hardware: x86 OS: Linux Status: NEW Keywords: download, source, testcase Severity: normal Priority: P2 Component: directx-d3d Assignee: wine-bugs(a)winehq.org Reporter: austinenglish(a)gmail.com ==3441== 148 bytes in 1 blocks are possibly lost in loss record 551 of 826 ==3441== at 0x40087BA: calloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==3441== by 0x72DB6AF: ??? (in /usr/lib/libdrm_intel.so.1.0.0) ==3441== by 0x72D6294: drm_intel_bo_alloc (in /usr/lib/libdrm_intel.so.1.0.0) ==3441== by 0x6EE4251: ??? (in /usr/lib/dri/i965_dri.so) ==3441== by 0x6EE484B: ??? (in /usr/lib/dri/i965_dri.so) ==3441== by 0x6F196DB: ??? (in /usr/lib/dri/i965_dri.so) ==3441== by 0x6EA89B4: ??? (in /usr/lib/dri/i965_dri.so) ==3441== by 0x67CCB9B: ??? (in /usr/lib/libGL.so.1.2.0) ==3441== by 0x679C2F4: ??? (in /usr/lib/libGL.so.1.2.0) ==3441== by 0x5ED0DF2: create_glxcontext.isra.0 (opengl.c:1254) ==3441== by 0x5ED1127: X11DRV_wglCreateContextAttribsARB (opengl.c:2071) ==3441== by 0x52FBC29: wglCreateContextAttribsARB (wgl.c:268) ==3441== by 0x4E619D8: context_create (context.c:1543) ==3441== by 0x4EF7866: wined3d_swapchain_create (swapchain.c:914) ==3441== by 0x4AE811F: d3d8_swapchain_create (swapchain.c:163) ==3441== by 0x4AE48FA: d3d8_device_CreateAdditionalSwapChain (device.c:565) ==3441== by 0x4A7570B: switch_render_target (stateblock.c:185) ==3441== by 0x4A77594: execute_test_chain (stateblock.c:136) ==3441== by 0x4A782E6: test_state_management (stateblock.c:450) ==3441== by 0x4A91648: run_test (test.h:584) ==3441== -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 2