January 2024 - Wine-bugs - list.winehq.org

[Bug 46568] New: 64-bit msxml6.dll from Microsoft Core XML Services 6.0 redist package fails to load (Wine doesn't respect 44-bit user-mode VA limitation from Windows < 8.1)
by wine-bugs＠winehq.org 22 Nov '25

22 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=46568 Bug ID: 46568 Summary: 64-bit msxml6.dll from Microsoft Core XML Services 6.0 redist package fails to load (Wine doesn't respect 44-bit user-mode VA limitation from Windows < 8.1) Product: Wine Version: 4.0 Hardware: x86-64 URL: https://download.microsoft.com/download/2/e/0/2e01308a -e17f-4bf9-bf48-161356cf9c81/msxml6_x64.msi OS: Linux Status: NEW Keywords: download, win64 Severity: normal Priority: P2 Component: ntdll Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, reported by Louis in https://bugs.winehq.org/show_bug.cgi?id=46107#c2 --- quote --- I tried winetricks msxml3 and msxml6, but somehow it didn`t work out in 64-bit wineprefix; i get errors that msxml is not registered etc, Does anyone know a workaround to use native msxml on 64-bit prefix? --- quote --- Relevant part of trace log: --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/Altium/AD18 $ WINEDEBUG=+seh,+relay,+loaddll,+virtual wine64 ./X2.EXE >>log.txt 2>&1 ... 002a:Call KERNEL32.LoadLibraryExW(0053f2b0 L"C:\\windows\\system32\\msxml6.dll",00000000,00000008) ret=7fbe435d7558 ... 002a:trace:loaddll:load_native_dll Loaded L"C:\\windows\\system32\\msxml6.dll" at 0x7ff79e00000: native 002a:Call PE DLL (proc=0x7ff79e0101c,module=0x7ff79e00000 L"msxml6.dll",reason=PROCESS_ATTACH,res=(nil)) ... 002a:Call KERNEL32.HeapCreate(00000001,00000000,00000000) ret=7ff79e18411 002a:trace:virtual:NtAllocateVirtualMemory 0xffffffffffffffff (nil) 00110000 2000 00000004 002a:trace:virtual:map_view got mem with anon mmap 0x7fbe39819000-0x7fbe39929000 002a:trace:virtual:VIRTUAL_DumpView View: 0x7fbe39820000 - 0x7fbe3992ffff (valloc) 002a:trace:virtual:VIRTUAL_DumpView 0x7fbe39820000 - 0x7fbe3992ffff --rw- 002a:trace:virtual:NtAllocateVirtualMemory 0xffffffffffffffff 0x7fbe39820000 00010000 1000 00000004 002a:trace:virtual:mprotect_exec forcing exec permission on 0x7fbe39820000-0x7fbe3982ffff 002a:trace:virtual:VIRTUAL_DumpView View: 0x7fbe39820000 - 0x7fbe3992ffff (valloc) 002a:trace:virtual:VIRTUAL_DumpView 0x7fbe39820000 - 0x7fbe3982ffff c-rw- 002a:trace:virtual:VIRTUAL_DumpView 0x7fbe39830000 - 0x7fbe3992ffff --rw- 002a:Ret KERNEL32.HeapCreate() retval=7fbe39820000 ret=7ff79e18411 ... 002a:Call ntdll.RtlAllocateHeap(7fbe39820000,00000000,00000060) ret=7ff79e03c10 002a:Ret ntdll.RtlAllocateHeap() retval=7fbe39822730 ret=7ff79e03c10 002a:Call msvcrt.memset(7fbe39822740,00000000,00000042) ret=7ff79e03a5a 002a:Ret msvcrt.memset() retval=7fbe39822740 ret=7ff79e03a5a 002a:trace:seh:NtRaiseException code=c0000005 flags=0 addr=0x7ff79e03efe ip=7ff79e03efe tid=002a 002a:trace:seh:NtRaiseException info[0]=0000000000000000 002a:trace:seh:NtRaiseException info[1]=ffffffffffffffff 002a:trace:seh:NtRaiseException rax=000000000011b2d0 rbx=6c61567274736270 rcx=0000000000000008 rdx=0000000000000000 002a:trace:seh:NtRaiseException rsi=0000000000007fbe rdi=0000000000000730 rbp=00000ff7c73044e8 rsp=000000000053ea70 002a:trace:seh:NtRaiseException r8=00007fbe39822740 r9=0000000000000000 r10=0000000000000000 r11=0000000000000000 002a:trace:seh:NtRaiseException r12=00007fbe39822740 r13=000007ff79f8dc80 r14=00007fbe436c6160 r15=000000000053f708 ... 002a:exception c0000005 in PE entry point (proc=0x7ff79e0101c,module=0x7ff79e00000,reason=PROCESS_ATTACH,res=(nil)) 002a:Ret PE DLL (proc=0x7ff79e0101c,module=0x7ff79e00000 L"msxml6.dll",reason=PROCESS_ATTACH,res=(nil)) retval=0 002a:Call PE DLL (proc=0x7ff79e0101c,module=0x7ff79e00000 L"msxml6.dll",reason=PROCESS_DETACH,res=(nil)) 002a:Ret PE DLL (proc=0x7ff79e0101c,module=0x7ff79e00000 L"msxml6.dll",reason=PROCESS_DETACH,res=(nil)) retval=1 002a:trace:loaddll:free_modref Unloaded module L"C:\\windows\\system32\\msxml6.dll" : native 002a:Ret KERNEL32.LoadLibraryExW() retval=00000000 ret=7fbe435d7558 002a:err:ole:COMPOBJ_DllList_Add couldn't load in-process dll L"C:\\windows\\system32\\msxml6.dll" --- snip --- It seems that certain older 64-bit components such as Microsoft XML libs make assumptions about the 64-bit user-mode virtual address space layout. This is different from the usual broken apps a la "I failed at porting my 32-bit app to 64-bit" (pointer truncation). In this case, pointers from certain allocations are broken into multiple parts and used as indices into multi-level lookup tables. Pitfall: there is a 44-bit user-mode VA limitation (8TB) for 64-bit Windows which was lifted starting with Windows 8.1+. Wine doesn't respect the 44-bit pre-Windows 8.1 virtual address space limits, allowing process heaps to be placed in 0000'7Fxx'0000'0000 range (128 TB) which causes out-of-bounds access to lookup tables when indices overflow (derived from pointer bits). The exception occurs in entry point, causing 'msxml6.dll' to be unloaded. One workaround is to move Wine's top-down allocations/heaps into 8 TB VA range (Wine preloader) and impose same user-mode address space bits limits as with all 64-bit Windows versions < 8.1 to stay "compatible". I've tested it and it works for native here. Not sure if it's worth to change though. I don't know if a separate 64-bit MSXML6 re-distributable package exists that has been fixed wrt Windows 8.1+ address space limits. MSXML6 is part of Windows OS for newer versions and automatically kept up-to-date. $ sha1sum msxml6_x64.msi 1eb84eeae7729ea5db7fe79779f4e216114261ba msxml6_x64.msi $ du -sh msxml6_x64.msi 2.6M msxml6_x64.msi $ wine --version wine-4.0-276-g84459ba94b Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 17

[Bug 15039] New: MSVC 6: Menu popdowns too narrow for arrows
by wine-bugs＠winehq.org 22 Nov '25

22 Nov '25

http://bugs.winehq.org/show_bug.cgi?id=15039 Summary: MSVC 6: Menu popdowns too narrow for arrows Product: Wine Version: 1.1.1 Platform: PC-x86-64 OS/Version: Linux Status: NEW Severity: minor Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: claus.fischer(a)clausfischer.com CC: claus.fischer(a)clausfischer.com Microsoft Visual C++ 6 is working to a large extent. When opening a menu of the developer studio, the menu items with arrows (that open submenus) are not displayed correctly. The triangular arrows on the right end will stick out of the menu popdown area. I'm not sure if they just stick out to the end of the "shadow" (3d effect) around the popdown, or sometimes more. They should be fully contained in the popdown area. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 23

[Bug 54979] New: Futexes which protect memory allocation congest, causing 100x performance degradation
by WineHQ Bugzilla 21 Nov '25

21 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=54979 Bug ID: 54979 Summary: Futexes which protect memory allocation congest, causing 100x performance degradation Product: Wine Version: 8.0.1 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: ntdll Assignee: wine-bugs(a)winehq.org Reporter: nagle(a)animats.com Distribution: --- Created attachment 74518 --> https://bugs.winehq.org/attachment.cgi?id=74518 Debugger output with multiple threads stuck in spinlocks. SUMMARY Under the wrong circumstances, a program doing many memory allocations from multiple threads can experience more than 100x performance degradation. I'm seeing this in my own Rust program, which has 16 sometimes-compute-bound threads on a 12 CPU machine. This works fine on Microsoft Windows and when compiled for Linux. Under Wine, it can be over 100x slower. Multiple threads are banging on a spinlock at _InterlockedCompareExchange [Z:\usr\src\packages\BUILD\include\winnt.h:6630] in ntdll spin_lock [Z:\usr\src\packages\BUILD\dlls\ntdll\sync.c:937] in ntdll This is the spin lock around the queue for pausing threads. DISCUSSION This looks like futex congestion. That's a known kind of problem, but doesn't seem to have been seen in Wine before. It may be that some programs just run really slow under Wine, and nobody knows why. The code in NTDLL is clearly intended to handle the fast case without doing an OS-level lock. Under light load, that's O(1). But under heavy load, with multiple threads pounding on spinlocks, each spinlock waits longer, and there are multiple threads, so it becomes O(N^2). Which means huge slowdowns. See discussion at https://forum.winehq.org/viewtopic.php?t=37688 which has snippets of the code that's causing the problem. I can copy all that info over here if necessary. Let me know. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 19

[Bug 54455] New: CodeMeterRuntime: Install fails with '00c4:err:service:process_send_command service protocol error - failed to write pipe!'
by WineHQ Bugzilla 20 Nov '25

20 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=54455 Bug ID: 54455 Summary: CodeMeterRuntime: Install fails with '00c4:err:service:process_send_command service protocol error - failed to write pipe!' Product: Wine Version: 8.1 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: irmin.okic(a)gmail.com Distribution: --- Created attachment 74012 --> https://bugs.winehq.org/attachment.cgi?id=74012 Terminal output of the installer. Steps to reproduce: * Install dotnet48 into the prefix with winetricks. * Download CodeMeterRuntime 64bit 7.60 (but earlier versions had the same error) for Windows from: https://www.wibu.com/us/support/user/downloads-user-software.html * Execute the installer. * To reduce complexity in the installer on the Custom Setup step select "don't install" for all components except "CodeMeter Runtime Kit". I.e. "don't install" for Network Server, WibuShellExtension, User Help, Automatic server search, Remote access to WebAdmin. * Finish the installation. The installer will state that it ended prematurely. The relevant errors are probably: 00c4:err:service:process_send_command service protocol error - failed to write pipe! 016c:err:msi:ITERATE_StartService failed to start service L"CmWebAdmin.exe" (1053) 016c:err:msi:execute_script Execution of script 0 halted; action L"StartServices" returned 1627 016c:err:msi:ITERATE_Actions Execution halted, action L"InstallExecute" returned 1627 In Wine 7 I ignored the installer error with the following arguments to the installer: /ComponentArgs "*":"/qn ADDLOCAL=Complete,DotNET_Modules,AutomaticServerSearch REMOVE=WibuShellExtension,EnableNetworkServer,AccessToWebAdmin /l*v C:\users\z0rb\Temp\keyinst.log /norestart DISABLEROLLBACK=1 PROP_CMCC=\"none\"" The important argument was DISABLEROLLBACK=1. This meant that I can keep the install even with the failure. Then run CodeMeterCC.exe which started the CodeMeter windows service. With that service I could use further software that uses CodeMeter as their licensing service. In wine 8 even that service (together with CmWebAdmin.exe) started having the "failed to write pipe error!". I am out of workarounds at the moment and asking here for help. If you can instruct me with further debug flags and similar to narrow down the error I am ready to put in the work. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 11268] New: Civilization I for Windows (16-bt) incorrectly displays some dialogues
by wine-bugs＠winehq.org 18 Nov '25

18 Nov '25

http://bugs.winehq.org/show_bug.cgi?id=11268 Summary: Civilization I for Windows (16-bt) incorrectly displays some dialogues Product: Wine Version: 0.9.53. Platform: PC OS/Version: Linux Status: UNCONFIRMED Severity: enhancement Priority: P2 Component: gdi32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: neptunia(a)mail.ru Some dialogue windows in the game have non-rendered areas near window border which display garbage/previous windows existed in this place. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 39

[Bug 39257] New: user32/tests/dde.c crashes under valgrind
by wine-bugs＠winehq.org 18 Nov '25

18 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=39257 Bug ID: 39257 Summary: user32/tests/dde.c crashes under valgrind Product: Wine Version: 1.7.51 Hardware: x86 OS: Linux Status: NEW Keywords: download, source, testcase, valgrind Severity: normal Priority: P2 Component: user32 Assignee: wine-bugs(a)winehq.org Reporter: austinenglish(a)gmail.com Distribution: Fedora Created attachment 52324 --> https://bugs.winehq.org/attachment.cgi?id=52324 backtrace Backtrace: =>0 0x0483c341 wine_dbgstr_wn+0x76(str="????????????????H", n=0xffffffff) [/home/austin/wine-valgrind/dlls/user32/tests/../../../include/wine/test.h:486] in user32_test (0x04acf528) 1 0x047718bc wine_dbgstr_w+0x1f(s="????????????????H") [/home/austin/wine-valgrind/dlls/user32/tests/../../../include/wine/test.h:69] in user32_test (0x04acf548) 2 0x0477e757 server_end_to_end_callback+0x718(uType=<couldn't compute location>, uFmt=<couldn't compute location>, hconv=<couldn't compute location>, hsz1=<couldn't compute location>, hsz2=<couldn't compute location>, hdata=<couldn't compute location>, dwData1=<couldn't compute location>, dwData2=<couldn't compute location>) [/home/austin/wine-valgrind/dlls/user32/tests/dde.c:2464] in user32_test (0x04acf788) 3 0x04b0b4b2 WDML_InvokeCallback+0xa2(pInstance=0x46616c8, uType=0x4050, uFmt=0, hConv=0x46638b0, hsz1=0xc002, hsz2=(nil), hdata=0x4663cf2, dwData1=0, dwData2=0) [/home/austin/wine-valgrind/dlls/user32/dde_misc.c:1231] in user32 (0x04acf7e8) 4 0x04b0f980 WDML_ServerHandleExecute+0x134(pConv=0x46638b0, pXAct=0x4663cb0) [/home/austin/wine-valgrind/dlls/user32/dde_server.c:834] in user32 (0x04acf848) 5 0x04b0fe35 WDML_ServerHandle+0xdd(pConv=0x46638b0, pXAct=0x4663cb0) [/home/austin/wine-valgrind/dlls/user32/dde_server.c:1002] in user32 (0x04acf888) 6 0x04b10303 WDML_ServerConvProc+0x3f0(hwndServer=<couldn't compute location>, iMsg=<couldn't compute location>, wParam=<couldn't compute location>, lParam=<couldn't compute location>) [/home/austin/wine-valgrind/dlls/user32/dde_server.c:1112] in user32 (0x04acf908) 7 0x04b8870a WINPROC_wrapper+0x19() in user32 (0x04acf948) 8 0x04b8883d call_window_proc+0xb1(hwnd=0xb2011a, msg=0x3e8, wp=0xaf011e, lp=0x4663c4a, result=0x4acfac8, arg=0x4b0ff12) [/home/austin/wine-valgrind/dlls/user32/winproc.c:245] in user32 (0x04acf988) 9 0x04b8a67b WINPROC_call_window+0x1c2(hwnd=0xb2011a, msg=0x3e8, wParam=0xaf011e, lParam=0x4663c4a, result=0x4acfac8, unicode=0, mapping=WMCHAR_MAP_DISPATCHMESSAGE) [/home/austin/wine-valgrind/dlls/user32/winproc.c:910] in user32 (0x04acf9d8) 10 0x04b51dc0 DispatchMessageA+0x1a7(msg=<couldn't compute location>) [/home/austin/wine-valgrind/dlls/user32/message.c:3952] in user32 (0x04acfaf8) 11 0x0477f5ca test_end_to_end_server+0x18c(hproc=0x5c, hthread=0x60, type_a=0x1) [/home/austin/wine-valgrind/dlls/user32/tests/dde.c:2674] in user32_test (0x04acfb58) 12 0x0477f95f func_dde+0x2ba() [/home/austin/wine-valgrind/dlls/user32/tests/dde.c:2740] in user32_test (0x04acfcf8) 13 0x0483c82d run_test+0x9f(name="dde") [/home/austin/wine-valgrind/dlls/user32/tests/../../../include/wine/test.h:584] in user32_test (0x04acfd38) 14 0x0483cc75 main+0x222(argc=<couldn't compute location>, argv=<couldn't compute location>) [/home/austin/wine-valgrind/dlls/user32/tests/../../../include/wine/test.h:666] in user32_test (0x04acfde8) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 2

[Bug 14543] New: Worms World Party crashes on attempting to run
by wine-bugs＠winehq.org 18 Nov '25

18 Nov '25

http://bugs.winehq.org/show_bug.cgi?id=14543 Summary: Worms World Party crashes on attempting to run Product: Wine Version: 1.1.1 Platform: Other OS/Version: other Status: UNCONFIRMED Severity: trivial Priority: P2 Component: quartz AssignedTo: wine-bugs(a)winehq.org ReportedBy: Rincebrain(a)gmail.com Created an attachment (id=14883) --> (http://bugs.winehq.org/attachment.cgi?id=14883) Wine 1.1.1 output log (including BT) Worms World Party crashed when I attempted to run it - WWP fullscreened and rendered a black screen atop everything else, then Wine crashed, and sat at a backtrace until I killed wineserver. Wine output, including backtrace, attached. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 48

[Bug 37644] New: .NET 3.5 crash when running System.Console.Clear()
by wine-bugs＠winehq.org 17 Nov '25

17 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=37644 Bug ID: 37644 Summary: .NET 3.5 crash when running System.Console.Clear() Product: Wine Version: 1.7.30 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: james(a)jameswarner.us Distribution: --- Created attachment 50099 --> https://bugs.winehq.org/attachment.cgi?id=50099 Example program, source code to said program and output log When running System.Console.Clear() under .NET 3.5 in WINE (installed in a clean .wine through Winetricks), it will crash with: Unhandled Exception: System.IO.IOException: Invalid handle. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.Console.GetBufferInfo(Boolean throwOnNoConsole, Boolean& succeeded) at System.Console.Clear() This can be reproduced by running System.Console.Clear() under any application in .NET 3.5. Attached is a demo application to reproduce this, the source code to produce this issue and the log generated. WINE version: 1.7.30 under Debian (sid) x86. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 5

[Bug 50193] New: Minimizing a window of a Delphi app leads to a window completely disappearing without any ability to restore it
by WineHQ Bugzilla 17 Nov '25

17 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=50193 Bug ID: 50193 Summary: Minimizing a window of a Delphi app leads to a window completely disappearing without any ability to restore it Product: Wine Version: 1.2-rc2 Hardware: x86-64 OS: Linux Status: NEW Keywords: download, regression, source, testcase Severity: normal Priority: P2 Component: winex11.drv Assignee: wine-bugs(a)winehq.org Reporter: dmitry(a)baikal.ru Regression SHA1: 61e50e15ba45ad54655f98619f5ef33917033165 Distribution: --- Created attachment 68708 --> https://bugs.winehq.org/attachment.cgi?id=68708 test app (source + binary) Applications created with Delphi create secondary top level windows without WS_EX_APPWINDOW style set, and minimizing such a window leads to a window completely disappearing without any ability to restore it. This is a regression caused by commit 61e50e15ba45ad54655f98619f5ef33917033165 Author: Alexandre Julliard <julliard(a)winehq.org> Date: Fri May 28 12:14:43 2010 +0200 winex11: Map zero-size windows and set an empty window region for them. Admittedly Windows behaviour is weird: it minimizes such windows in an MDI style with desktop as an MDI client and Delphi window as an MDI child. https://source.winehq.org/patches/data/196455 is an attempt to fix this regression. Before this patch: no taskbar window for a normal or minimized owned window. After this patch: no taskbar window for normal owned window, after a window being minimized a taskbar button appears, after a window being restored a taskbar button gets removed. Attachment contains a simple test app (source + binary) that reproduces this problem. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 4

[Bug 21483] New: changed token security breaks .NET Framework SDK tools
by wine-bugs＠winehq.org 16 Nov '25

16 Nov '25

http://bugs.winehq.org/show_bug.cgi?id=21483 Summary: changed token security breaks .NET Framework SDK tools Product: Wine Version: 1.1.33 Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: wineserver AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Hello, some of Microsoft's tools from .NET Framework SDKs - namely managed debuggers (CLR) - stopped working after 1.1.33+ release. They seem to be very picky about object security. I bisected this one but technically this isn't a regression because Rob's token patches made Wine more correct - exposing another object security problem. --- snip --- $ git bisect bad bd56916f90e68632993a7275fe30a55a7efa222a is the first bad commit commit bd56916f90e68632993a7275fe30a55a7efa222a Author: Rob Shearman <robertshearman(a)gmail.com> Date: Mon Nov 16 20:11:06 2009 +0000 server: Extend get_token_user server call to also retrieve SIDs for the token's owner or primary group. :040000 040000 829f1543526675ae48f6fde8c8cedff74fd51797 7a77653291795c209ec529dd6660d52fc922a58c M dlls :040000 040000 57735b53b28db37ac4627dc009000e225175164a 4dcc1388cb136e559c06106632c08e8e610fe557 M include :040000 040000 4e83227cb0133c7e288a1e930461d4efe1130882 cf1c3539d6b3c91c854fa2b9b672f68ea601f639 M server --- snip --- "old" behaviour, where default process token was like this: Token owner -> S-1-5-4 "NT AUTHORITY\INTERACTIVE" (well-known group) Token user -> S-1-5-4 "NT AUTHORITY\INTERACTIVE" (well-known group) Token primary group -> S-1-5-32-544 "BUILTIN\Administrators" (alias) NtQueryInformationToken had the token owner info hard-coded (to SECURITY_INTERACTIVE_RID) while Rob's patches moved the actual query to wineserver. --- Basically the app code that verifies the security of created objects goes like this: - get SD from created object (event) handle -> GetKernelObjectSecurity( OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION) - get owner SID of SD -> GetSecurityDescriptorOwner() -> SID1 - get DACL of SD -> GetSecurityDescriptorDacl() - for each ACE from DACL (GetAce) -> SID2: check ACE SID against SD owner SID -> EqualSid( SID1, SID2) - match -> profit! not -> fail! --- snip --- ... 0023: create_event( access=001f0003, attributes=00000080, manual_reset=1, initial_state=0, objattr={rootdir=0014,sd={control=00000004,owner=<not present>,group=<not present>,sacl={},dacl={{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-4}},{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-4}}}},name=L"Global\\CorDBIPCSetupSyncEvent_36"} ) 0023: create_event() = 0 { handle=01c4 } ... 0025:trace:advapi:GetKernelObjectSecurity (0xc4,0x00000005,0x14ef40,0x00000050,0x33f7e8) 0025:trace:ntdll:NtQuerySecurityObject (0xc4,0x00000005,0x14ef40,0x00000050,0x33f7e8) 0025: get_security_object( handle=00c4, security_info=00000005 ) 0025: get_security_object() = 0 { sd_len=00000050, sd={control=00000037,owner={S-1-5-4},group=<not present>,sacl={},dacl={{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-4}},{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-4}}}} } 0025:trace:ntdll:RtlGetDaclSecurityDescriptor (0x14ef40,0x33f7c3,0x33f7ec,0x33f7c2) 0025:trace:ntdll:RtlGetAce (0x14ef60,0,0x33f7f0) 0025:trace:ntdll:RtlLengthSid sid=0x14ef54 0025: open_event( access=001f0003, attributes=00000002, rootdir=0034, name=L"Global\\CorDBIPCLSEventAvailName_36" ) 0025: open_event() = 0 { handle=00c8 } ... --- snip --- "new" behaviour, where default process token is now like this: Token owner -> S-1-5-32-544 "BUILTIN\Administrators" (alias) Token user -> S-1-5-4 "NT AUTHORITY\INTERACTIVE" (well-known group) Token primary group -> S-1-5-32-544 "BUILTIN\Administrators" (alias) --- snip --- ... 0024:trace:ntdll:NtOpenProcessTokenEx (0x1b0,0x00000008,0x00000000,0x318e6d0) 0024: open_token( handle=01b0, access=00000008, attributes=00000000, flags=00000000 ) 0024: open_token() = 0 { token=01b4 } ... 0024:trace:advapi:GetTokenInformation (0x1b4, TokenOwner, 0x184130, 20, 0x318e6e0): 0024:trace:ntdll:NtQueryInformationToken (0x1b4,4,0x184130,20,0x318e6e0) 0024: get_token_sid( handle=01b4, which_sid=00000004 ) 0024: get_token_sid() = 0 { sid_len=16, sid={S-1-5-32-544} } ... 0024: create_event( access=001f0003, attributes=00000080, manual_reset=1, initial_state=0, objattr={rootdir=0018,sd={control=00000004,owner=<not present>,group=<not present>,sacl={},dacl={{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-32-544}},{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-32-544}}}},name=L"Global\\CorDBIPCSetupSyncEvent_37"} ) 0024: create_event() = 0 { handle=01c8 } ... 0026:trace:advapi:GetKernelObjectSecurity (0xc8,0x00000005,(nil),0x00000000,0x33f7e8) 0026:trace:ntdll:NtQuerySecurityObject (0xc8,0x00000005,(nil),0x00000000,0x33f7e8) 0026: get_security_object( handle=00c8, security_info=00000005 ) 0026: get_security_object() = 0 { sd_len=00000058, sd={control=00000037,owner={S-1-5-4},group=<not present>,sacl={},dacl={{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-32-544}},{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-32-544}}}} } ... --- snip --- Using the "admins" sid (alias) as token user in server/token.c:token_create_admin() instead of current "interactive" sid fixes the problem. Though I don't know if this is the right thing to do. I hope I provided enough infos and let Alexandre handle it ;-) To get detailed token infos/dumps you might be interested in this little console app, from cygwin's Corinna Vinschen ;-) http://www.mail-archive.com/cygwin(a)cygwin.com/msg71800.html It might provide useful information when run under different security principals. Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 19