March 2021 - Wine-bugs - list.winehq.org

[Bug 36413] New: valgrind shows uninitialized memory in msxml3/tests/xmparser.c
by wine-bugs＠winehq.org 12 May '21

12 May '21

https://bugs.winehq.org/show_bug.cgi?id=36413 Bug ID: 36413 Summary: valgrind shows uninitialized memory in msxml3/tests/xmparser.c Product: Wine Version: 1.7.18 Hardware: x86 OS: Linux Status: NEW Keywords: download, source, testcase Severity: normal Priority: P2 Component: msxml3 Assignee: wine-bugs(a)winehq.org Reporter: austinenglish(a)gmail.com ==24204== 28 bytes in 1 blocks are possibly lost in loss record 219 of 700 ==24204== at 0x7BC50A9B: RtlAllocateHeap (heap.c:255) ==24204== by 0x538CBB8: apartment_getclassobject (compobj.c:526) ==24204== by 0x538FFC6: get_inproc_class_object (compobj.c:2894) ==24204== by 0x5392D2F: CoGetClassObject (compobj.c:3032) ==24204== by 0x53934B7: CoCreateInstance (compobj.c:3197) ==24204== by 0x4DD74AE: func_xmlparser (xmlparser.c:108) ==24204== by 0x4DD9310: run_test (test.h:584) ==24204== by 0x4DD96FF: main (test.h:654) ==24204== -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 3

[Bug 36172] New: xcopy tests fail under valgrind
by wine-bugs＠winehq.org 12 May '21

12 May '21

https://bugs.winehq.org/show_bug.cgi?id=36172 Bug ID: 36172 Summary: xcopy tests fail under valgrind Product: Wine Version: 1.7.17 Hardware: x86 OS: Linux Status: NEW Keywords: download, source, testcase Severity: normal Priority: P2 Component: programs Assignee: wine-bugs(a)winehq.org Reporter: austinenglish(a)gmail.com xcopy.c:59: Test failed: xcopy /D:d-m-y test returned rc=258 xcopy.c:64: Test failed: xcopy /D:m-d-y test failed rc=258 xcopy.c:65: Test failed: xcopy did not create xcopytest\xcopy1 xcopy.c:70: Test failed: xcopy /D:m-d-y test failed rc=258 xcopy.c:71: Test failed: xcopy did not create xcopytest\xcopy1 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 4

[Bug 28816] New: kernel32/tests/loader.ok fails under valgrind
by wine-bugs＠winehq.org 12 May '21

12 May '21

http://bugs.winehq.org/show_bug.cgi?id=28816 Bug #: 28816 Summary: kernel32/tests/loader.ok fails under valgrind Product: Wine Version: 1.3.30 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: kernel32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com Classification: Unclassified Under Valgrind, "make loader.ok" fails with log loader.c:375: Test failed: 2: 0x10002000 != 0 loader.c:376: Test failed: 2: 1 != 0 loader.c:378: Test failed: 2: 2000 != MEM_FREE loader.c:379: Test failed: 2: 20000 != 0 -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 9

[Bug 28738] New: user32/tests: invalid read in server_end_to_end_callback in dde.ok?
by wine-bugs＠winehq.org 12 May '21

12 May '21

http://bugs.winehq.org/show_bug.cgi?id=28738 Bug #: 28738 Summary: user32/tests: invalid read in server_end_to_end_callback in dde.ok? Product: Wine Version: 1.3.30 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: user32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com Classification: Unclassified Not sure how bad an invalid read in a dbgstr is, but here's the log: Invalid read of size 2 at wine_dbgstr_wn (test.h:471) by server_end_to_end_callback (test.h:66) by WDML_InvokeCallback (dde_misc.c:734) by WDML_ServerHandle (dde_server.c:834) by WDML_ServerConvProc (dde_server.c:1112) by ??? (in user32/user32.dll.so) by call_window_proc (winproc.c:242) by WINPROC_call_window (winproc.c:908) by DispatchMessageA (message.c:3738) by test_end_to_end_server (dde.c:2680) by func_dde (dde.c:2746) by run_test (test.h:556) by main (test.h:624) Address 0x7f00dae8 is 16 bytes inside a block of size 20 free'd at notify_free (heap.c:262) by RtlFreeHeap (heap.c:1748) by RtlFreeUnicodeString (rtlstr.c:319) by RegQueryValueExA (registry.c:1489) by load_face (freetype.c:1207) by WineEngInit (freetype.c:1345) by DllMain (gdiobj.c:582) -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 7

[Bug 20925] New: d3d[89]/tests/visual crash under valgrind
by wine-bugs＠winehq.org 12 May '21

12 May '21

http://bugs.winehq.org/show_bug.cgi?id=20925 Summary: d3d[89]/tests/visual crash under valgrind Product: Wine Version: 1.1.34 Platform: PC OS/Version: Linux Status: NEW Keywords: download, source, testcase Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com http://kegel.com/wine/valgrind/logs/2009-12-05-01.15/vg-d3d8_visual.txt and http://kegel.com/wine/valgrind/logs/2009-12-05-01.15/vg-d3d9_visual.txt both show the crash Unhandled exception: page fault on read access to 0x58469450 in 32-bit code (0x0d9bc92b). Backtrace: =>0 0x0d9bc92b (0x11ad7000) 1 0x0fa16d50 in libgl.so.1 (+0x3dd50) (0x0ffbc038) which might be a problem in the driver, but could also be a disagreement between valgrind and the driver. I'm going to stop running d3d[89]/tests/visual under valgrind for now, since they always crash. Perhaps the good folks at Nvidia could have a look at how to get valgrind and their drivers to play nice together. (One of those logs also seems to have found a real use-after-free bug in their driver: Invalid read of size 4 at ??? (in /usr/lib32/libGLcore.so.180.44) Address 0xe6905f4 is 156 bytes inside a block of size 632 free'd at free (vg_replace_malloc.c:325) by ??? (in /usr/lib32/libGLcore.so.180.44) so perhaps they would actually get something out of this.) -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 10

[Bug 21180] New: user32_crosstest.exe sysparams doesn't properly restore tray icons on Win
by wine-bugs＠winehq.org 12 May '21

12 May '21

http://bugs.winehq.org/show_bug.cgi?id=21180 Summary: user32_crosstest.exe sysparams doesn't properly restore tray icons on Win Product: Wine Version: 1.1.35 Platform: x86 OS/Version: Linux Status: NEW Keywords: download, source, testcase Severity: minor Priority: P2 Component: testcases AssignedTo: wine-bugs(a)winehq.org ReportedBy: bunglehead(a)gmail.com After running sysparams test some tray icons are left a kind of downsampled - e.g. net status icon is 4x4 sized. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 49436] New: 64-bit Diablo III hangs on startup since 5.11
by WineHQ Bugzilla 12 May '21

12 May '21

https://bugs.winehq.org/show_bug.cgi?id=49436 Bug ID: 49436 Summary: 64-bit Diablo III hangs on startup since 5.11 Product: Wine Version: 5.11 Hardware: x86-64 URL: https://www.blizzard.com/en-gb/download/confirmation?p roduct=d3 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: maciej.stanczew+b(a)gmail.com Regression SHA1: e561ce4b9259071f79d219dddf62f05cdd8dd07b Distribution: ArchLinux Created attachment 67524 --> https://bugs.winehq.org/attachment.cgi?id=67524 64-bit client on Staging 5.11 After updating to Staging 5.11, 64-bit Diablo III client hangs after starting, with message: 00d8:err:seh:setup_exception stack overflow 1920 bytes in thread 00d8 eip 00000001402fed5b esp 0000000000c10e90 stack 0xc10000-0xc11000-0xd10000 32-bit client launches correctly. I'm not able to test vanilla Wine, because the game doesn't work there due to bug #45443. Regression testing lead me to the very first commit after 5.10 release: commit e561ce4b9259071f79d219dddf62f05cdd8dd07b Author: Alexandre Julliard <julliard(a)winehq.org> Date: Sat Jun 6 13:56:19 2020 +0200 ntdll: Move NtRaiseException() implementation to the Unix library. The two final configurations I built were: - good: Wine 3cc3b44575, Staging 044cb930, patch ntdll-NtContinue excluded - bad: Wine e561ce4b92, Staging 044cb930, patch ntdll-NtContinue excluded, incremented NTDLL_UNIXLIB_VERSION to allow staging patches to apply ntdll-NtContinue had to be excluded because it conflicts with ntdll changes in Wine (it was removed from Staging in the following rebase). But as we can see, even with it being excluded from 5.10 (without e561ce4b92), the game runs. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 47

[Bug 45349] New: Multiple applications and games crash due to missing support for 64-bit syscall thunks (StreetFighter V)
by wine-bugs＠winehq.org 12 May '21

12 May '21

https://bugs.winehq.org/show_bug.cgi?id=45349 Bug ID: 45349 Summary: Multiple applications and games crash due to missing support for 64-bit syscall thunks (StreetFighter V) Product: Wine Version: 3.10 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ntdll Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, had this one lying around for some time, sadly got distracted from further analysis (there are more bugs). The game is "StreetFighter V Arcade Edition" and was gifted to me by Valve for investigation, thanks ;-) https://store.steampowered.com/app/310950/Street_Fighter_V_Arcade_Edition/ It has some custom DRM/protection scheme which uses various 64-bit anti-debug and obfuscation techniques. There are a lot of single-step (TF) exceptions in the code which are there by design (decrypt continuations). At one point it crashes with invalid instruction exception: --- snip --- ... 002e:trace:seh:NtRaiseException code=80000004 flags=0 addr=0x143fc99e9 ip=143fc99e9 tid=002e 002e:trace:seh:NtRaiseException rax=00000000006000aa rbx=000000000000005e rcx=000000000000005f rdx=000000000000071c 002e:trace:seh:NtRaiseException rsi=0000000143fcf826 rdi=0000000000000000 rbp=00000000005ffbd8 rsp=00000000005ffbd0 002e:trace:seh:NtRaiseException r8=0000000143fd2240 r9=000000000000000c r10=0000000143fd26f8 r11=0000000000000000 002e:trace:seh:NtRaiseException r12=000000000000005f r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 002e:trace:seh:RtlVirtualUnwind type 1 rip 143fc99e9 rsp 5ffbd0 002e:trace:seh:dump_unwind_info **** func 3fc9980-3fca910 002e:trace:seh:dump_unwind_info unwind info at 0x143fd26f0 flags 1 prolog 0x0 bytes function 0x143fc9980-0x143fca910 002e:trace:seh:dump_unwind_info handler 0x143fd2240 data at 0x143fd26f8 002e:trace:seh:call_handler calling handler 0x143fd2240 (rec=0x5ffa90, frame=0x5ffbd0 context=0x5fed30, dispatch=0x5ff200) 002e:trace:seh:call_handler handler at 0x143fd2240 returned 0 002e:trace:module:LdrGetDllHandle L"Kernel32.dll" -> 0x7b460000 (load path L"Z:\\home\\focht\\Downloads;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem") 002e:trace:ntdll:NtQueryInformationProcess (0xffffffffffffffff,0x00000007,0x5ffcb0,0x00000008,0x5ffcb0) 002e: get_process_info( handle=ffffffff ) 002e: get_process_info() = 0 { pid=002d, ppid=0000, affinity=000000ff, peb=7fffffeaf000, start_time=1d3e17d69097156 (-0.0309210), end_time=0, exit_code=259, priority=2, cpu=x86_64, debugger_present=0, debug_children=1 } 002e:trace:module:LdrGetDllHandle L"Kernel32.dll" -> 0x7b460000 (load path L"Z:\\home\\focht\\Downloads;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem") 002e:trace:seh:NtRaiseException code=c0000096 flags=0 addr=0x143fca968 ip=143fca968 tid=002e 002e:trace:seh:NtRaiseException rax=00000000564d5868 rbx=000000008685d465 rcx=000000000000000a rdx=0000000143fc5658 002e:trace:seh:NtRaiseException rsi=00000000005ffd58 rdi=0000000143fd3344 rbp=00000000005ffc18 rsp=00000000005ffc08 002e:trace:seh:NtRaiseException r8=0000000143fd26f8 r9=000000000000000c r10=0000000143fd26f8 r11=0000000000000000 002e:trace:seh:NtRaiseException r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 002e:trace:seh:RtlVirtualUnwind type 1 rip 143fca968 rsp 5ffc08 002e:trace:seh:dump_unwind_info **** func 3fca910-3fcfbbc 002e:trace:seh:dump_unwind_info unwind info at 0x143fd26f0 flags 1 prolog 0x0 bytes function 0x143fca910-0x143fcfbbc 002e:trace:seh:dump_unwind_info handler 0x143fcbbe8 data at 0x143fd26f8 002e:trace:seh:call_handler calling handler 0x143fcbbe8 (rec=0x5ffac0, frame=0x5ffc08 context=0x5fed60, dispatch=0x5ff230) 002e:trace:seh:call_handler handler at 0x143fcbbe8 returned 0 ... --- snip --- One has to debug it to see the mess. For that you need to defeat a few anti-debug trickery ;-) The game protection copies native API entry point code around and assumes 64-bit Windows API entries which have a distinct signature/sequence. A similar problem is described in bug 21232 which is about 32-bit syscall thunks. Partial copy of 'ntdll.NtQueryInformationProcess' entry point: --- snip --- 0000000143FCFA88 | 55 | push rbp 0000000143FCFA89 | 48 89 E5 | mov rbp, rsp 0000000143FCFA8C | 57 | push rdi 0000000143FCFA8D | 56 | push rsi 0000000143FCFA8E | 48 81 EC A0 00 00 00 | sub rsp, A0 0000000143FCFA95 | 48 83 E4 F0 | and rsp, FFFFFFFFFFFFFFF0 0000000143FCFA99 | 48 81 EC 40 03 00 00 | sub rsp, 340 0000000143FCFAA0 | 0F 11 B5 50 FF FF FF | movups xmmword ptr ss:[rbp - B0], xmm6 0000000143FCFAA7 | 0F C4 08 33 | pinsrw mm1, word ptr ds:[rax], 33 0000000143FCFAAB | C0 48 83 C4 | ror byte ptr ds:[rax - 7D], C4 0000000143FCFAAF | 28 C3 | sub bl, al 0000000143FCFAB1 | CC | int3 0000000143FCFAB2 | CC | int3 0000000143FCFAB3 | CC | int3 0000000143FCFAB4 | CC | int3 0000000143FCFAB5 | CC | int3 0000000143FCFAB6 | CC | int3 0000000143FCFAB7 | CC | int3 0000000143FCFAB8 | 48 89 5C 24 08 | mov qword ptr ss:[rsp + 8], rbx 0000000143FCFABD | 48 89 6C 24 10 | mov qword ptr ss:[rsp + 10], rbp 0000000143FCFAC2 | 48 89 74 24 18 | mov qword ptr ss:[rsp + 18], rsi 0000000143FCFAC7 | 57 | push rdi 0000000143FCFAC8 | 48 83 EC 30 | sub rsp, 30 0000000143FCFACC | 41 8B D9 | mov ebx, r9d 0000000143FCFACF | 49 8B F0 | mov rsi, r8 0000000143FCFAD2 | 8B EA | mov ebp, edx 0000000143FCFAD4 | 48 8B F9 | mov rdi, rcx 0000000143FCFAD7 | EB 02 | jmp streetfighterv.143FCFADB 0000000143FCFAD9 | 48 EB E8 | jmp streetfighterv.143FCFAC4 --- snip --- This obviously can't work. On 64-bit Windows the native API entry code is much smaller (< 16 bytes). Due to partial opcode copy a fault is triggered when executing. Original 64-bit Wine API entry code: --- snip --- 000000007BCEF058 55 push rbp 000000007BCEF059 48 89 E5 mov rbp, rsp 000000007BCEF05C 57 push rdi 000000007BCEF05D 56 push rsi 000000007BCEF05E 48 81 EC A0 00 00 00 sub rsp, 0A0h 000000007BCEF065 48 83 E4 F0 and rsp, 0FFFFFFFFFFFFFFF0h 000000007BCEF069 48 81 EC 40 03 00 00 sub rsp, 340h 000000007BCEF070 0F 11 B5 50 FF FF FF movups [rbp+var_B0], xmm6 000000007BCEF077 0F 11 BD 60 FF FF FF movups [rbp+var_A0], xmm7 000000007BCEF07E 44 0F 11 85 70 FF FF FF movups [rbp+var_90], xmm8 000000007BCEF086 44 0F 11 4D 80 movups [rbp+var_80], xmm9 000000007BCEF08B 44 0F 11 55 90 movups [rbp+var_70], xmm10 000000007BCEF090 44 0F 11 5D A0 movups [rbp+var_60], xmm11 000000007BCEF095 44 0F 11 65 B0 movups [rbp+var_50], xmm12 000000007BCEF09A 44 0F 11 6D C0 movups [rbp+var_40], xmm13 000000007BCEF09F 44 0F 11 75 D0 movups [rbp+var_30], xmm14 000000007BCEF0A4 44 0F 11 7D E0 movups [rbp+var_20], xmm15 000000007BCEF0A9 48 89 4D 10 mov [rbp+ProcessHandle], rcx 000000007BCEF0AD 89 55 18 mov [rbp+ProcessInformationClass], edx 000000007BCEF0B0 4C 89 45 20 mov [rbp+ProcessInformation], r8 000000007BCEF0B4 44 89 4D 28 mov [rbp+ProcessInformationLength], r9d 000000007BCEF0B8 C7 84 24 3C 03 00 00 00+ mov dword ptr [rsp+3F0h+n+4], 0 000000007BCEF0C3 C7 84 24 38 03 00 00 00+ mov dword ptr [rsp+3F0h+n], 0 000000007BCEF0CE 48 B8 70 CA D9 7B 00 00+ mov rax, offset __wine_dbch_ntdll_6 ... --- snip --- Wine-Staging patchset: https://github.com/wine-staging/wine-staging/tree/HEAD/patches/winebuild-Fa… Relevant part: https://github.com/wine-staging/wine-staging/blob/HEAD/patches/winebuild-Fa… (+prerequisite). Generated 64-bit thunks: --- snip --- ... 0000000143FCFA88 | B8 70 00 00 00 | mov eax, 70 0000000143FCFA8D | 65 FF 14 25 00 01 00 00 | call qword ptr gs:[100] 0000000143FCFA95 | C3 | ret 0000000143FCFA96 | 00 00 | add byte ptr ds:[rax], al 0000000143FCFA98 | B8 71 00 00 00 | mov eax, 71 0000000143FCFA9D | 65 FF 14 25 00 01 00 00 | call qword ptr gs:[100] 0000000143FCFAA5 | C3 | ret ... --- snip --- NOTE: I wanted to keep a separate ticket for 64-bit syscall thunks to track/validate it separately from 32-bit parts (bug 21232). Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 59

[Bug 39389] New: Text does not render in Forward to the Sky
by wine-bugs＠winehq.org 10 May '21

10 May '21

https://bugs.winehq.org/show_bug.cgi?id=39389 Bug ID: 39389 Summary: Text does not render in Forward to the Sky Product: Wine Version: 1.7.51 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: funtimeschaos(a)rocketmail.com Distribution: --- Created attachment 52500 --> https://bugs.winehq.org/attachment.cgi?id=52500 Terminal output Title. I get empty speech bubbles with voice acting, as well as intro screens with just a picture and a button to continue, when there should be text with the picture. I've attached terminal output. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 4

[Bug 46864] New: MyStat 12 crashes when trying to open spreadsheet tab
by wine-bugs＠winehq.org 09 May '21

09 May '21

https://bugs.winehq.org/show_bug.cgi?id=46864 Bug ID: 46864 Summary: MyStat 12 crashes when trying to open spreadsheet tab Product: Wine Version: 4.3 Hardware: x86-64 OS: Mac OS X Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: lleytonj73(a)gmail.com Created attachment 63918 --> https://bugs.winehq.org/attachment.cgi?id=63918 Error backtrace (Wine 4.3) There's actually quite a lot of reasons this program crashes, and I noticed there aren't any existing bug reports for this program here. The error backtrace attached was caused when I selected File > New > Data to open a spreadsheet tab. Instead of opening the tab, the program "encountered an error and needs to close". -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 11