[Bug 45080] New: Null pointer dereference: possible undocumented nonstandard cppstdlib behaviour in Windows.
https://bugs.winehq.org/show_bug.cgi?id=45080 Bug ID: 45080 Summary: Null pointer dereference: possible undocumented nonstandard cppstdlib behaviour in Windows. Product: Wine Version: 3.6 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: ucrtbase Assignee: wine-bugs(a)winehq.org Reporter: aphid.mmonly(a)gmail.com Distribution: --- Created attachment 61231 --> https://bugs.winehq.org/attachment.cgi?id=61231 Crash: detailed call log on Wine-staging 3.6. I tried running/debugging the new game Frostpunk under Wine after multiple other users tried to run this application and posted it would not start in a request thread for a Mac/Linux version of this currently windows-only application. I tried starting it with some debugging options attached and found out it crashed because of a null pointer dereference error. Crash log on this post is Wine-Staging. I'll retest with regular wine as well (essentially the same error occurs) and add that as a separate attachment. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #1 from aphid.mmonly(a)gmail.com --- Created attachment 61232 --> https://bugs.winehq.org/attachment.cgi?id=61232 Crash log and calls for wine-3.7 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 Fabian Maurer <dark.shadow4(a)web.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dark.shadow4(a)web.de --- Comment #2 from Fabian Maurer <dark.shadow4(a)web.de> --- What brings you to the conclusion that it's "possible undocumented nonstandard cppstdlib behaviour in Windows"? Does it work with native vc runtime? Since the program is not free, I can't test, so if you have more information, can you provide that please? :) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #3 from aphid.mmonly(a)gmail.com --- Created attachment 61235 --> https://bugs.winehq.org/attachment.cgi?id=61235 Path followed through wined3d11, assembly -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #4 from Fabian Maurer <dark.shadow4(a)web.de> --- I'm sorry, but what exactly does that tell me? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #5 from aphid.mmonly(a)gmail.com --- I traced the program through a debugger. It's multithreaded, and the problem happened way earlier in the process. It called out to a d3d11 function. One of the parameters it supplied was a pointer set to null. This pointer is supposed to be changed by d3d11, but wine's implementation did not. Changing the relevant attributes of this bug to reflect my findings. Here's where it happens in the application code: | 0x140337c68 mov qword [rsp + 0x58], 0 | 0x140337c71 mov rax, qword [rbx] | 0x140337c74 lea r8, qword [rsp + 0x58] | 0x140337c79 lea rdx, qword [0x1414a0cd8] | 0x140337c80 mov rcx, rbx | 0x140337c83 call qword [rax]0x00007f9a97b90000 | 0x140337c85 mov rcx, qword [rsp + 0x58] | 0x140337c8a mov rax, qword [rcx] The call goes out to 0x00007f9a97b9bb71, which is the function offset at 0xbb71 in the D3D11 dll file (the PE), as it was hooked to address 0x00007f9a97b90000. The third attachment goes into more detail what happened in this file. The program reads out 'rsp + 0x58', possibly some member variable of a class returned. Unfortunately this is null, so when it tries to read it out it fails with a null pointer exception. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 aphid.mmonly(a)gmail.com changed: What |Removed |Added ---------------------------------------------------------------------------- Component|ucrtbase |directx-d3dx11 Summary|Null pointer dereference: |Null pointer dereference in |possible undocumented |member function of D3D11 |nonstandard cppstdlib |device |behaviour in Windows. | -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 Toni <eldrad(a)autistici.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |eldrad(a)autistici.org --- Comment #6 from Toni <eldrad(a)autistici.org> --- you could run the program with apitrace to see a detailed log of all d3d11 calls and return values -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #7 from Toni <eldrad(a)autistici.org> --- You can try as follows: download https://github.com/apitrace/apitrace (you can try mingw version, but if you have problems try msvc version, binaries at https://people.freedesktop.org/~jrfonseca/apitrace/) at least with the msvc version you can just place the bin/ and lib/ folder next to your .exe binary in the game folder run bin/apitrace.exe trace -a dxgi yourbinary.exe then run bin/apitrace.exe dump yourbinary.trace that might give you an idea otherwise you can post the trace dump here as txt -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #8 from Toni <eldrad(a)autistici.org> --- forgot to say so, but you must run the commands above with wine (guess it's obvious but just in case) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #9 from aphid.mmonly(a)gmail.com --- Here is what the msft apitrace tool reports: env WINEPREFIX=/hdd/games_wine/steam/ wine /hdd/games_wine/steam/drive_c/Programs/apitrace-msvc/x64/bin/apitrace.exe dump Frostpunk.trace // process.name = "C:\\steam\\steamapps\\common\\Frostpunk\\Frostpunk.exe" 0 D3D11CreateDevice(pAdapter = NULL, DriverType = D3D_DRIVER_TYPE_HARDWARE, Software = NULL, Flags = D3D11_CREATE_DEVICE_BGRA_SUPPORT, pFeatureLevels = {D3D_FEATURE_LEVEL_11_0, D3D_FEATURE_LEVEL_10_1, D3D_FEATURE_LEVEL_10_0, D3D_FEATURE_LEVEL_9_3, D3D_FEATURE_LEVEL_9_2, D3D_FEATURE_LEVEL_9_1}, FeatureLevels = 6, SDKVersion = 7, ppDevice = &0x252f100, pFeatureLevel = &D3D_FEATURE_LEVEL_11_0, ppImmediateContext = &0x252f130) = S_OK 1 ID3D11Device::AddRef(this = 0x252f100) = 3 2 ID3D11Device::QueryInterface(this = 0x252f100, riid = IID_IDXGIDevice2, ppvObj = ?) = E_NOINTERFACE I've also tried to load debugging symbols for wine debugger and tried to use other debuggers, but to no avail; I can't manage to get the symbols loaded, so I can't help you with getting something more readable than assembler. There just isn't any good resources available on how to properly debug wine dlls in 64-bit mode, e.g. attach unmangled names to function addresses. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #10 from Nikolay Sivov <bunglehead(a)gmail.com> --- IDXGIDevice2 is currently not implemented. If you enable +dxgi,+d3d11 wine debug channels you'll get corresponding warning. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #11 from Toni <eldrad(a)autistici.org> --- Yep by the apitrace it looks like it's getting a null IDXGIDevice2 and that might be the reason of a crash if the app is using the pointer blindly after that. You can try returning IDXGIDevice1 instead on that query and see what happens. If you get lucky IDXGIDevice2 specific methods won't be really used, otherwise you would have to implement the interface more or less properly (something like bug 41063), or more interfaces might be needed after that. It might be smth else, but if that's the whole apitrace it doesn't seem to be much more going on. About using the debugger I can't help you but I'm sure there must be a way, although by your previous info and the apitrace it already seems to be pointing somewhere. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #12 from Toni <eldrad(a)autistici.org> --- In case it's not clear you can try editing dlls/dxgi/device.c, around line 42 (depends on the wine source you're editing), where you have the line "|| IsEqualGUID(riid, &IID_IDXGIDevice1)", add another line with "|| IsEqualGUID(riid, &IID_IDXGIDevice2)" instead just below that. That will make it return an incomplete IDXGIDevice2 interface that might or might not work. Try that and then see if you get to the same point or hit some new problem. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #13 from Nikolay Sivov <bunglehead(a)gmail.com> --- (In reply to Toni from comment #12)
In case it's not clear you can try editing dlls/dxgi/device.c, around line 42 (depends on the wine source you're editing), where you have the line "|| IsEqualGUID(riid, &IID_IDXGIDevice1)", add another line with "|| IsEqualGUID(riid, &IID_IDXGIDevice2)" instead just below that. That will make it return an incomplete IDXGIDevice2 interface that might or might not work.
Try that and then see if you get to the same point or hit some new problem.
I don't think it's useful. If you're going to edit it, you should be adding new methods too so you don't have to guess later why it failed. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #14 from Toni <eldrad(a)autistici.org> --- (In reply to Nikolay Sivov from comment #13)
I don't think it's useful. If you're going to edit it, you should be adding new methods too so you don't have to guess later why it failed.
Well, it's the easiest thing to try first, then of course the new methods need to be added but that will require more work, and my suggestion is to just try and add -that one line- and see what happens. Also, looking at the new methods in IDXGIDevice2 they don't even look that useful for a game, so who knows. If the app fails afterwards in an undeclared IDXGIDevice2 method it will be really obvious in apitrace since it will be the last line, akin to what happened in bug 41063. Anyways you seem like the right person to provide an stub implementation of IDXGIDevice2 if you think it's better to start there, I'm still a bit lost with advanced interface stuff, besides adding fake/partial interface declarations for debugging. It astonished me how fast you implemented those stubs for ID3D11Device1 and ID3D11DeviceContext1. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #15 from Nikolay Sivov <bunglehead(a)gmail.com> --- Created attachment 61239 --> https://bugs.winehq.org/attachment.cgi?id=61239 patch (In reply to Toni from comment #14)
(In reply to Nikolay Sivov from comment #13)
I don't think it's useful. If you're going to edit it, you should be adding new methods too so you don't have to guess later why it failed.
Well, it's the easiest thing to try first, then of course the new methods need to be added but that will require more work, and my suggestion is to just try and add -that one line- and see what happens. Also, looking at the new methods in IDXGIDevice2 they don't even look that useful for a game, so who knows. If the app fails afterwards in an undeclared IDXGIDevice2 method it will be really obvious in apitrace since it will be the last line, akin to what happened in bug 41063.
Thing is we have custom methods right after IDXGIDevice1 ones. I don't know much about apitrace, but I'm assuming it hooks vtables somehow. Advertising IDXGIDevice2 will let it hook custom methods using wrong prototypes. Completion event method looks like something application could be using. Anyway, attaching a patch. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #16 from Toni <eldrad(a)autistici.org> --- (In reply to Nikolay Sivov from comment #15)
Thing is we have custom methods right after IDXGIDevice1 ones. I don't know much about apitrace, but I'm assuming it hooks vtables somehow. Advertising IDXGIDevice2 will let it hook custom methods using wrong prototypes.
Ok, I wasn't aware about that. Thank you for the information Nikolay! I'll be more careful about that in the future. Also, thank you again for your quick implementation of the stub interface. Let's see what happens when op can test it on the game. Imo it should work in progressing further in starting it. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 tokktokk <fdsfgs(a)krutt.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fdsfgs(a)krutt.org -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 Jack Mitchell <winehq(a)embed.me.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |winehq(a)embed.me.uk --- Comment #17 from Jack Mitchell <winehq(a)embed.me.uk> --- Created attachment 61266 --> https://bugs.winehq.org/attachment.cgi?id=61266 FrostPunk Graphical Glitches -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #18 from Jack Mitchell <winehq(a)embed.me.uk> --- I can confirm that this patch allows the game to sucessfully start. However there are major graphical glitches that render it unplayable. Screenshot attached. The following log line is constantly repeated. 0070:err:d3d11:d3d11_immediate_context_ClearRenderTargetView Failed to clear view, hr 0x8876086c. 0070:fixme:d3d:wined3d_device_clear_rendertarget_view Layered clears not implemented. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 --- Comment #19 from Toni <eldrad(a)autistici.org> --- Since this bug is about the null pointer dereference/game not starting, it's better to open a new bug about the graphical errors now, so we can keep each bug focused on one problem at a time. Thank you for testing this! -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 Matteo Bruni <matteo.mystral(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|directx-d3dx11 |directx-d3d Summary|Null pointer dereference in |Frostpunk crashes (requires |member function of D3D11 |IDXGIDevice2) |device | -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 Adam Bolte <abolte(a)systemsaviour.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |abolte(a)systemsaviour.com -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 Alistair Leslie-Hughes <leslie_alistair(a)hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Staged patchset| |https://github.com/wine-sta | |ging/wine-staging/tree/mast | |er/patches/dxgi-IDXGIDevice | |2 Ever confirmed|0 |1 CC| |leslie_alistair(a)hotmail.com Status|UNCONFIRMED |STAGED -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 Alistair Leslie-Hughes <leslie_alistair(a)hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |e4034dcc838b01a8c41de08c63d | |3db4b4906890f Resolution|--- |FIXED Status|STAGED |RESOLVED --- Comment #20 from Alistair Leslie-Hughes <leslie_alistair(a)hotmail.com> --- Fixed by https://source.winehq.org/git/wine.git/?a=commit;h=e4034dcc838b01a8c41de08c6... -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45080 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #21 from Alexandre Julliard <julliard(a)winehq.org> --- Closing bugs fixed in 3.9. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
wine-bugs＠winehq.org