[Bug 59285] New: mixerOpen (08D87BBC, 0, 0, 0, 0) cause null pointer derefence due to failing to populate default device

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59285

            Bug ID: 59285
           Summary: mixerOpen (08D87BBC, 0, 0, 0, 0) cause null pointer
                    derefence due to failing to populate default device
           Product: Wine
           Version: 11.0
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: winmm&mci
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Created attachment 80213
  --> http://bugs.winehq.org/attachment.cgi?id=80213
log generated from WINEDEBUG=+mmdevapi,+winmm,+seh wine 2> debug.log

Tagged version 11.0, also verified with latest master
(4de3377785fd8d14a90ee3b2c1d7886689d241ed at time of writing) (patch file is
against this target)

Trying to run a win32 music game I got a crash where it failed call winmm.dll
openMixer. (see attached log)

The log points to the error happening on trying to read with offset 0xC4 at
winmm.dll + 0x1b0e0, which I traced to the code line:

  *lphMix = (HMIXER)WINMM_MakeHWAVE(uDeviceID, TRUE, mmdevice->mixer_count);

(specifically mmdevice->mixer_count as mixer_count is on offset +0xC4

Looking at the source and this is the erroneous flow as I understand it:

1. Game calls mixerOpen for the default device mixerOpen (06B77BBC, 0, 0, 0, 0)
2. mixerOpen calls WINMM_InitMMDevices() which in turn generates a map of
output devices using WINMM_EnumDevices()
3. To populate the default device WINMM_EnumDevices() compares the pointer to
the default device (gotten by IMMDeviceEnumerator_GetDefaultAudioEndpoint()) to
the pointer to each device in the device list (gotten by WINMM_InitMMDevice()):

  if(device == def_dev)
    (*map)[0] = &(*devices)[n];

for some reason (unstable COM Pointers?) the default device pointer for each
method isn't equal for the same underlying default device which results in
g_out_map[0] remaining null

4. When mixerOpen tries to get the default device it gets the null pointer and
tries to access ->mixer_count, which causes the crash.


I then tried to fix it by looking up the ID of the device and comparing this
instead of the pointers and that solved the issue, it successfully opened a
mixer for the device and the game started with working audio (see attached
patch file)

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.