December 2024 - Wine-gitlab

[PATCH 0/1] MR7049: vbscript: fix Mid() empty and null handling
by Francis De Brabandere (＠francisdb) 19 Dec '24

19 Dec '24

Fixes https://bugs.winehq.org/show_bug.cgi?id=57563 -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7049

3 3

[PATCH v4 0/1] MR7047: xmllite/tests: Avoid buffer overflow by using LONG_PTR. (ASan)
by Bernhard Übelacker 19 Dec '24

19 Dec '24

This appeared by running tests with PE-side ASan enabled, just with x86_64. The enum DtdProcessing seems to have just a size of four bytes, but dereferencing `LONG_PTR *value` writes 8 bytes. ``` ================================================================= ==560==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffe1ff8c0 at pc 0x6ffff7b33f83 bp 0x7ffffe1fed00 sp 0x7ffffe1fed48 WRITE of size 8 at 0x7ffffe1ff8c0 thread T0 05c0:fixme:file:server_get_file_info Unsupported info class e #0 0x6ffff7b33f82 in xmlreader_GetProperty .../wine/dlls/xmllite/reader.c:2807:20 #1 0x000140002254 in IXmlReader_GetProperty .../obj\include\xmllite.h:331:12 #2 0x000140002254 in test_reader_create .../wine/dlls/xmllite/tests/reader.c:582:10 #3 0x000140002254 in func_reader .../wine/dlls/xmllite/tests/reader.c:2676:5 #4 0x00014006bad1 in run_test .../wine/include/wine/test.h:765:5 #5 0x00014006bad1 in main .../wine/include/wine/test.h:884:12 #6 0x00014006d94f in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:58:11 #7 0x6ffffbdc4808 in BaseThreadInitThunk .../wine/dlls/kernel32\thread.c:61:5 #8 0x6ffffad1fa1a in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17000fa1a) Address 0x7ffffe1ff8c0 is located in stack of thread T0 at offset 2784 in frame #0 0x00014000100f in func_reader .../wine/dlls/xmllite/tests/reader.c:2675 This frame has 113 object(s): [32, 36) 'd.i439.i' (line 824) [48, 52) 'd.i412.i' (line 824) [64, 68) 'd.i385.i' (line 824) [80, 84) 'd.i358.i' (line 824) ... [2672, 2676) 'nodetype.i2' (line 620) [2688, 2696) 'resolver.i' (line 515) [2720, 2728) 'unk.i' (line 516) [2752, 2760) 'reader.i' (line 517) [2784, 2788) 'dtd.i' (line 518) <== Memory access at offset 2784 partially overflows this variable [2800, 2804) 'nodetype.i' (line 519) HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp, SEH and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow .../wine/dlls/xmllite/reader.c:2807:20 in xmlreader_GetProperty Shadow bytes around the buggy address: 0x7ffffe1ff600: f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 0x7ffffe1ff680: f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 0x7ffffe1ff700: f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 f8 f2 f8 f2 0x7ffffe1ff780: f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 0x7ffffe1ff800: f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 00 f2 f2 f2 =>0x7ffffe1ff880: 00 f2 f2 f2 00 f2 f2 f2[04]f2 04 f3 00 00 00 00 0x7ffffe1ff900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ff980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==560==ABORTING 05c0:fixme:kernelbase:AppPolicyGetProcessTerminationMethod FFFFFFFFFFFFFFFA, 00007FFFFEA8FE80 make: *** [Makefile:471569: dlls/xmllite/tests/x86_64-windows/reader.ok] Fehler 1 ``` -- v4: xmllite/tests: Avoid buffer overflow by using LONG_PTR. (ASan) https://gitlab.winehq.org/wine/wine/-/merge_requests/7047

2 3

[PATCH 0/1] MR7034: win32u: Update Vulkan surfaces when reparenting window.
by Paul Gofman (＠gofman) 19 Dec '24

19 Dec '24

That is, in particular, needed for Disgaea 5 complete to render movies with 'MovieType=1' settings (that settings is auto selected initially by the game based on GPU). Movie render window is initially a top level window, then the game reparents movie rendering window to the main window with SetParent() after 3d rendering to game window was already initialized earlier. The offscreen state for the window being rendered to (child in this case) is updated during presentation, but the parent does not (the same issue would be for the things going other way around, presenting to parent window when the child is never presented after reparenting). This part is not enough to fix these cases though since the recent commit 786d9d1685ac220081b10cc779d4d331ddd2fc52 . When parent is not presented but the child is, the child image should appear in the window regardless of the fact that the parent has no WS_CLIPCHILDREN attribute. I know that commit is fixing regression Bug 57503, but due to these reasons the commit doesn't look right. And it is not clear to me from bug description what was actually wrong with "World in conflict" rendering when parent window offscreening took place: that alone is not supposed to be breaking the rendering (and if it would that would probably be a blocker for implementing child windows the way they are implemented?), I suspect there might be a bug elsewhere (just e. g., some other missing case of synchronizing window config state which ends up in child window not being properly offscreened in that case). -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7034

4 7

Re: [PATCH v3 0/1] MR7047: xmllite/tests: Avoid buffer overflow by using LONG_PTR. (ASan)
by Alfred Agrell (＠Alcaro) 19 Dec '24

19 Dec '24

I'd change line 581 to something with the high half nonzero (-1, for example), to verify how many bytes native actually writes. (It writes a LONG_PTR, I checked.) -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7047#note_90899

1 0

Re: [PATCH v3 0/1] MR7047: xmllite/tests: Avoid buffer overflow by using LONG_PTR. (ASan)
by Bernhard Übelacker 19 Dec '24

19 Dec '24

v2: - Instead of casting to the smaller enum type do reserve memory of size LONG_PTR in the test. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7047#note_90898

1 0

[PATCH v2 0/1] MR7047: xmllite/tests: Avoid buffer overflow by using LONG_PTR. (ASan)
by Bernhard Übelacker 19 Dec '24

19 Dec '24

This appeared by running tests with PE-side ASan enabled, just with x86_64. The enum DtdProcessing seems to have just a size of four bytes, but dereferencing `LONG_PTR *value` writes 8 bytes. ``` ================================================================= ==560==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffe1ff8c0 at pc 0x6ffff7b33f83 bp 0x7ffffe1fed00 sp 0x7ffffe1fed48 WRITE of size 8 at 0x7ffffe1ff8c0 thread T0 05c0:fixme:file:server_get_file_info Unsupported info class e #0 0x6ffff7b33f82 in xmlreader_GetProperty .../wine/dlls/xmllite/reader.c:2807:20 #1 0x000140002254 in IXmlReader_GetProperty .../obj\include\xmllite.h:331:12 #2 0x000140002254 in test_reader_create .../wine/dlls/xmllite/tests/reader.c:582:10 #3 0x000140002254 in func_reader .../wine/dlls/xmllite/tests/reader.c:2676:5 #4 0x00014006bad1 in run_test .../wine/include/wine/test.h:765:5 #5 0x00014006bad1 in main .../wine/include/wine/test.h:884:12 #6 0x00014006d94f in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:58:11 #7 0x6ffffbdc4808 in BaseThreadInitThunk .../wine/dlls/kernel32\thread.c:61:5 #8 0x6ffffad1fa1a in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17000fa1a) Address 0x7ffffe1ff8c0 is located in stack of thread T0 at offset 2784 in frame #0 0x00014000100f in func_reader .../wine/dlls/xmllite/tests/reader.c:2675 This frame has 113 object(s): [32, 36) 'd.i439.i' (line 824) [48, 52) 'd.i412.i' (line 824) [64, 68) 'd.i385.i' (line 824) [80, 84) 'd.i358.i' (line 824) ... [2672, 2676) 'nodetype.i2' (line 620) [2688, 2696) 'resolver.i' (line 515) [2720, 2728) 'unk.i' (line 516) [2752, 2760) 'reader.i' (line 517) [2784, 2788) 'dtd.i' (line 518) <== Memory access at offset 2784 partially overflows this variable [2800, 2804) 'nodetype.i' (line 519) HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp, SEH and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow .../wine/dlls/xmllite/reader.c:2807:20 in xmlreader_GetProperty Shadow bytes around the buggy address: 0x7ffffe1ff600: f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 0x7ffffe1ff680: f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 0x7ffffe1ff700: f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 f8 f2 f8 f2 0x7ffffe1ff780: f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 0x7ffffe1ff800: f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 00 f2 f2 f2 =>0x7ffffe1ff880: 00 f2 f2 f2 00 f2 f2 f2[04]f2 04 f3 00 00 00 00 0x7ffffe1ff900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ff980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==560==ABORTING 05c0:fixme:kernelbase:AppPolicyGetProcessTerminationMethod FFFFFFFFFFFFFFFA, 00007FFFFEA8FE80 make: *** [Makefile:471569: dlls/xmllite/tests/x86_64-windows/reader.ok] Fehler 1 ``` -- v2: xmllite/tests: Avoid buffer overflow by using LONG_PTR. (ASan) https://gitlab.winehq.org/wine/wine/-/merge_requests/7047

1 1

[PATCH 0/1] MR7048: dinput: Copy the device format if the user format is a subset of it.
by Rémi Bernon 19 Dec '24

19 Dec '24

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52738 -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7048

1 1

[PATCH 0/1] MR7046: mshtml: Ignore Gecko events on detached nodes.
by Jacek Caban (＠jacek) 19 Dec '24

19 Dec '24

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57248 -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7046

3 2

[PATCH 0/1] MR7047: xmllite: Avoid buffer overflow by casting to DtdProcessing. (ASan)
by Bernhard Übelacker 19 Dec '24

19 Dec '24

This appeared by running tests with PE-side ASan enabled, just with x86_64. The enum DtdProcessing seems to have just a size of four bytes, but dereferencing `LONG_PTR *value` writes 8 bytes. ``` ================================================================= ==560==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffe1ff8c0 at pc 0x6ffff7b33f83 bp 0x7ffffe1fed00 sp 0x7ffffe1fed48 WRITE of size 8 at 0x7ffffe1ff8c0 thread T0 05c0:fixme:file:server_get_file_info Unsupported info class e #0 0x6ffff7b33f82 in xmlreader_GetProperty .../wine/dlls/xmllite/reader.c:2807:20 #1 0x000140002254 in IXmlReader_GetProperty .../obj\include\xmllite.h:331:12 #2 0x000140002254 in test_reader_create .../wine/dlls/xmllite/tests/reader.c:582:10 #3 0x000140002254 in func_reader .../wine/dlls/xmllite/tests/reader.c:2676:5 #4 0x00014006bad1 in run_test .../wine/include/wine/test.h:765:5 #5 0x00014006bad1 in main .../wine/include/wine/test.h:884:12 #6 0x00014006d94f in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:58:11 #7 0x6ffffbdc4808 in BaseThreadInitThunk .../wine/dlls/kernel32\thread.c:61:5 #8 0x6ffffad1fa1a in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17000fa1a) Address 0x7ffffe1ff8c0 is located in stack of thread T0 at offset 2784 in frame #0 0x00014000100f in func_reader .../wine/dlls/xmllite/tests/reader.c:2675 This frame has 113 object(s): [32, 36) 'd.i439.i' (line 824) [48, 52) 'd.i412.i' (line 824) [64, 68) 'd.i385.i' (line 824) [80, 84) 'd.i358.i' (line 824) ... [2672, 2676) 'nodetype.i2' (line 620) [2688, 2696) 'resolver.i' (line 515) [2720, 2728) 'unk.i' (line 516) [2752, 2760) 'reader.i' (line 517) [2784, 2788) 'dtd.i' (line 518) <== Memory access at offset 2784 partially overflows this variable [2800, 2804) 'nodetype.i' (line 519) HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp, SEH and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow .../wine/dlls/xmllite/reader.c:2807:20 in xmlreader_GetProperty Shadow bytes around the buggy address: 0x7ffffe1ff600: f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 0x7ffffe1ff680: f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 0x7ffffe1ff700: f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 f8 f2 f8 f2 0x7ffffe1ff780: f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 0x7ffffe1ff800: f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 00 f2 f2 f2 =>0x7ffffe1ff880: 00 f2 f2 f2 00 f2 f2 f2[04]f2 04 f3 00 00 00 00 0x7ffffe1ff900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ff980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==560==ABORTING 05c0:fixme:kernelbase:AppPolicyGetProcessTerminationMethod FFFFFFFFFFFFFFFA, 00007FFFFEA8FE80 make: *** [Makefile:471569: dlls/xmllite/tests/x86_64-windows/reader.ok] Fehler 1 ``` -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7047

2 2

[PATCH v2 0/1] MR7042: dwrite/tests: Avoid stack-use-after-scope in test_GetOverhangMetrics. (ASan)
by Bernhard Übelacker 19 Dec '24

19 Dec '24

This moves the stack variable to the outer scope, because it gets accessed in the call to `IDWriteTextLayout_Release` a few lines below. ``` ================================================================= ==1792==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffffe1fd0c0 at pc 0x6ffff84f74f6 bp 0x7ffffe1fcad0 sp 0x7ffffe1fcb18 READ of size 8 at 0x7ffffe1fd0c0 thread T0 0704:fixme:file:server_get_file_info Unsupported info class e #0 0x6ffff84f74f5 in IDWriteInlineObject_Release .../wine-build/build-asan-pe/64/obj\include\dwrite.h:2815:18 #1 0x6ffff84f74f5 in free_layout_range .../wine/dlls/dwrite/layout.c:2487:13 #2 0x6ffff84f74f5 in free_layout_ranges_list .../wine/dlls/dwrite/layout.c:2514:9 #3 0x6ffff84f74f5 in dwritetextlayout_Release .../wine/dlls/dwrite/layout.c:2949:9 #4 0x0001400ec179 in IDWriteTextLayout_Release .../wine-build/build-asan-pe/64/obj\include\dwrite.h:4211:12 #5 0x0001400ec179 in test_GetOverhangMetrics .../wine/dlls/dwrite/tests/layout.c:6288:5 #6 0x0001400ec179 in func_layout .../wine/dlls/dwrite/tests/layout.c:7118:5 #7 0x00014013a4bc in run_test .../wine/include/wine/test.h:765:5 #8 0x00014013a4bc in main .../wine/include/wine/test.h:884:12 #9 0x00014013c36f in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:58:11 #10 0x6ffffbdc4808 in BaseThreadInitThunk /usr/src/packages/BUILD\dlls/kernel32\thread.c:61:5 #11 0x6ffffaeffa1a in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17000fa1a) Address 0x7ffffe1fd0c0 is located in stack of thread T0 at offset 1280 in frame #0 0x0001400a823f in func_layout .../wine/dlls/dwrite/tests/layout.c:7069 This frame has 224 object(s): [32, 392) 'metrics.i6891' (line 6965) [464, 472) 'inlineobj.i6892' (line 6966) [496, 520) 'line.i' (line 6967) [560, 568) 'format.i6893' (line 6968) ... [1136, 1144) 'layout.i5988' (line 6239) [1168, 1184) 'overhang_metrics.i' (line 6254) [1200, 1236) 'metrics.i5989' (line 6256) [1280, 1320) 'obj.i' (line 6257) <== Memory access at offset 1280 is inside this variable [1360, 1368) 'format2.i5721' (line 6136) [1392, 1400) 'layout.i5722' (line 6137) [1424, 1432) 'format.i5723' (line 6138) [1456, 1476) 'spacing.i5724' (line 6176) ... [10320, 10328) 'format.i' (line 1269) [10352, 10360) 'layout1.i' (line 1335) [10384, 10392) 'format1.i' (line 1336) [10416, 10424) 'format117.i' (line 1337) HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp, SEH and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-use-after-scope .../wine-build/build-asan-pe/64/obj\include\dwrite.h:2815:18 in IDWriteInlineObject_Release Shadow bytes around the buggy address: 0x7ffffe1fce00: f2 f2 f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 f2 f2 0x7ffffe1fce80: f8 f2 f2 f2 f8 f8 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 0x7ffffe1fcf00: f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 0x7ffffe1fcf80: f8 f8 f8 f8 f2 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 0x7ffffe1fd000: f8 f2 00 f2 f2 f2 00 f2 f2 f2 f8 f8 f2 f2 f8 f8 =>0x7ffffe1fd080: f8 f8 f8 f2 f2 f2 f2 f2[f8]f8 f8 f8 f8 f2 f2 f2 0x7ffffe1fd100: f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f8 0x7ffffe1fd180: f8 f2 f2 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 0x7ffffe1fd200: f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f8 0x7ffffe1fd280: f8 f8 f2 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 0x7ffffe1fd300: f8 f8 f8 f2 f2 f2 f2 f2 f8 f2 f2 f2 f8 f8 f8 f8 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1792==ABORTING make: *** [Makefile:162532: dlls/dwrite/tests/x86_64-windows/layout.ok] Fehler 1 ``` -- v2: dwrite/tests: Allocate test inline objects dynamically. https://gitlab.winehq.org/wine/wine/-/merge_requests/7042

3 4