March 2025 - Wine-gitlab - list.winehq.org

[PATCH v3 0/1] MR7544: ieframe: Enter reallocation path one position earlier (ASan).
by Bernhard Übelacker 13 Mar '25

13 Mar '25

Trying to browse through the debugger.chm from an old windbg version with hh.exe, I encountered below ASan message. The reallocation path was not entered when `This->travellog.size < This->travellog.position+1`, with e.g. size == 4 and position == 3. Unfortunately the increment of position takes place a few lines later, therefore writing at index 4 of array with size 4. ``` ================================================================= ==hh.exe==316==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7e99833c9a80 at pc 0x6ffffe8490da bp 0x7ffffe1fea70 sp 0x7ffffe1feab0 WRITE of size 16 at 0x7e99833c9a80 thread T0 #0 0x6ffffe8490d9 in __asan_memset /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt\lib/asan/asan_interceptors_memintrinsics.cpp:67:3 #1 0x6ffffa7cb968 in update_travellog /home/bernhard/data/entwicklung/2025/wine\wine/dlls/ieframe/dochost.c:471:59 #2 0x6ffffa7caf09 in ClOleCommandTarget_Exec /home/bernhard/data/entwicklung/2025/wine\wine/dlls/ieframe/dochost.c:780:13 #3 0x6ffff929b38a in IOleCommandTarget_Exec /home/bernhard/data/entwicklung/2025/wine/wine-build/llvm-newwow64-asan-pe/obj\include\docobj.h:848:12 #4 0x6ffff929ad8c in notify_travellog_update /home/bernhard/data/entwicklung/2025/wine\wine/dlls/mshtml/persist.c:71:9 #5 0x6ffff929a82b in set_current_mon /home/bernhard/data/entwicklung/2025/wine\wine/dlls/mshtml/persist.c:108:17 #6 0x6ffff923abb7 in navigate_proc /home/bernhard/data/entwicklung/2025/wine\wine/dlls/mshtml/navigate.c:2155:9 #7 0x6ffff92d43df in hidden_proc /home/bernhard/data/entwicklung/2025/wine\wine/dlls/mshtml/task.c:398:17 #8 0x6ffffd3f3c8e in WINPROC_wrapper /home/bernhard/data/entwicklung/2025/wine\wine/dlls/user32/winproc.c:86:12 #9 0x6ffffd3f28c8 in call_window_proc /home/bernhard/data/entwicklung/2025/wine\wine/dlls/user32/winproc.c:111:15 #10 0x6ffffd3f2ab2 in dispatch_win_proc_params /home/bernhard/data/entwicklung/2025/wine\wine/dlls/user32/winproc.c #11 0x6ffffd3df4fb in dispatch_message /home/bernhard/data/entwicklung/2025/wine\wine/dlls/user32/message.c:804:14 #12 0x6ffffd3df5a1 in DispatchMessageW /home/bernhard/data/entwicklung/2025/wine\wine/dlls/user32/message.c:890:16 #13 0x6ffffdc63d8e in doWinMain /home/bernhard/data/entwicklung/2025/wine\wine/dlls/hhctrl.ocx/hhctrl.c:580:9 #14 0x000140001036 in WinMain /home/bernhard/data/entwicklung/2025/wine\wine/programs/hh/main.c:34:12 #15 0x00014000118f in main /home/bernhard/data/entwicklung/2025/wine\wine/dlls/msvcrt/crt_winmain.c:53:12 #16 0x0001400010b5 in mainCRTStartup /home/bernhard/data/entwicklung/2025/wine\wine/dlls/msvcrt/crt_main.c:58:11 #17 0x6fffffc3565e in BaseThreadInitThunk /home/bernhard/data/entwicklung/2025/wine\wine/dlls/kernel32/thread.c:61:24 #18 0x6fffffdbba1a in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17004ba1a) 0x7e99833c9a80 is located 0 bytes after 64-byte region [0x7e99833c9a40,0x7e99833c9a80) allocated by thread T0 here: #0 0x6ffffe84a4a1 in malloc /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt\lib/asan/asan_malloc_win.cpp:80:3 #1 0x6ffffa7cb68b in update_travellog /home/bernhard/data/entwicklung/2025/wine\wine/dlls/ieframe/dochost.c:437:31 #2 0x6ffffa7caf09 in ClOleCommandTarget_Exec /home/bernhard/data/entwicklung/2025/wine\wine/dlls/ieframe/dochost.c:780:13 #3 0x6ffff929b38a in IOleCommandTarget_Exec /home/bernhard/data/entwicklung/2025/wine/wine-build/llvm-newwow64-asan-pe/obj\include\docobj.h:848:12 #4 0x6ffff929ad8c in notify_travellog_update /home/bernhard/data/entwicklung/2025/wine\wine/dlls/mshtml/persist.c:71:9 #5 0x6ffff929a82b in set_current_mon /home/bernhard/data/entwicklung/2025/wine\wine/dlls/mshtml/persist.c:108:17 #6 0x6ffff923abb7 in navigate_proc /home/bernhard/data/entwicklung/2025/wine\wine/dlls/mshtml/navigate.c:2155:9 #7 0x6ffff92d43df in hidden_proc /home/bernhard/data/entwicklung/2025/wine\wine/dlls/mshtml/task.c:398:17 #8 0x6ffffd3f3c8e in WINPROC_wrapper /home/bernhard/data/entwicklung/2025/wine\wine/dlls/user32/winproc.c:86:12 #9 0x6ffffd3f28c8 in call_window_proc /home/bernhard/data/entwicklung/2025/wine\wine/dlls/user32/winproc.c:111:15 #10 0x6ffffd3f2ab2 in dispatch_win_proc_params /home/bernhard/data/entwicklung/2025/wine\wine/dlls/user32/winproc.c #11 0x6ffffd3df4fb in dispatch_message /home/bernhard/data/entwicklung/2025/wine\wine/dlls/user32/message.c:804:14 #12 0x6ffffd3df5a1 in DispatchMessageW /home/bernhard/data/entwicklung/2025/wine\wine/dlls/user32/message.c:890:16 #13 0x6ffffdc63d8e in doWinMain /home/bernhard/data/entwicklung/2025/wine\wine/dlls/hhctrl.ocx/hhctrl.c:580:9 #14 0x000140001036 in WinMain /home/bernhard/data/entwicklung/2025/wine\wine/programs/hh/main.c:34:12 #15 0x00014000118f in main /home/bernhard/data/entwicklung/2025/wine\wine/dlls/msvcrt/crt_winmain.c:53:12 #16 0x0001400010b5 in mainCRTStartup /home/bernhard/data/entwicklung/2025/wine\wine/dlls/msvcrt/crt_main.c:58:11 #17 0x6fffffc3565e in BaseThreadInitThunk /home/bernhard/data/entwicklung/2025/wine\wine/dlls/kernel32/thread.c:61:24 #18 0x6fffffdbba1a in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17004ba1a) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bernhard/data/entwicklung/2025/wine\wine/dlls/ieframe/dochost.c:471:59 in update_travellog Shadow bytes around the buggy address: 0x7e99833c9800: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd 0x7e99833c9880: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd 0x7e99833c9900: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa 0x7e99833c9980: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd 0x7e99833c9a00: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 00 =>0x7e99833c9a80:[fa]fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa 0x7e99833c9b00: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd 0x7e99833c9b80: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 fa 0x7e99833c9c00: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa 0x7e99833c9c80: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd 0x7e99833c9d00: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ``` -- v3: ieframe: Enter reallocation path one position earlier (ASan). https://gitlab.winehq.org/wine/wine/-/merge_requests/7544

2 4

[PATCH v2 0/4] MR7541: comctl32/tests: Run LVM_GETORIGIN tests on v6.
by Nikolay Sivov (＠nsivov) 13 Mar '25

13 Mar '25

Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com> -- v2: comctl32/listview: Handle WM_VSCROLL(SB_TOP). comctl32/listview: Invert origin coordinate for LVM_GETORIGIN. comctl32/tests: Add a test for LVM_GETORIGIN returned coordinate. comctl32/tests: Run LVM_GETORIGIN tests on v6. https://gitlab.winehq.org/wine/wine/-/merge_requests/7541

3 6

[PATCH v6 0/3] MR7569: Draft: mfplat/tests: Add tests for Byte Stream Timestamps.
by Brendan McGrath (＠redmcg) 13 Mar '25

13 Mar '25

This MR adds tests to `mfplat` to illustrate the timestamp values output on the samples for the respective Byte Stream handlers. I have also included a fix for a bug in `winegstreamer` (and copied to `mfsrcsnk`) where a `NULL` value for the `pguidTimeFormat` parameter in `IMFMediaSource::Start` causes a segmentation fault. On Windows this is allowed. It is included in this MR as the `mfplat` tests pass NULL (so without this fix, the tests crash). -- v6: mfplat/tests: Add tests for Byte Stream Timestamps. https://gitlab.winehq.org/wine/wine/-/merge_requests/7569

2 3

[PATCH v5 0/3] MR7569: Draft: mfplat/tests: Add tests for Byte Stream Timestamps.
by Brendan McGrath (＠redmcg) 13 Mar '25

13 Mar '25

This MR adds tests to `mfplat` to illustrate the timestamp values output on the samples for the respective Byte Stream handlers. I have also included a fix for a bug in `winegstreamer` (and copied to `mfsrcsnk`) where a `NULL` value for the `pguidTimeFormat` parameter in `IMFMediaSource::Start` causes a segmentation fault. On Windows this is allowed. It is included in this MR as the `mfplat` tests pass NULL (so without this fix, the tests crash). -- v5: mfplat/tests: Add tests for Byte Stream Timestamps. https://gitlab.winehq.org/wine/wine/-/merge_requests/7569

2 3

[PATCH v4 0/3] MR7569: Draft: mfplat/tests: Add tests for Byte Stream Timestamps.
by Brendan McGrath (＠redmcg) 13 Mar '25

13 Mar '25

This MR adds tests to `mfplat` to illustrate the timestamp values output on the samples for the respective Byte Stream handlers. I have also included a fix for a bug in `winegstreamer` (and copied to `mfsrcsnk`) where a `NULL` value for the `pguidTimeFormat` parameter in `IMFMediaSource::Start` causes a segmentation fault. On Windows this is allowed. It is included in this MR as the `mfplat` tests pass NULL (so without this fix, the tests crash). -- v4: mfplat/tests: Add tests for Byte Stream Timestamps. https://gitlab.winehq.org/wine/wine/-/merge_requests/7569

2 3

[PATCH v2 0/1] MR7566: wintypes: Add IBufferFactory stub.
by Mohamad Al-Jaf (＠maljaf) 13 Mar '25

13 Mar '25

Needed for ISystemIdentificationInfo::get_Id(). -- v2: wintypes: Add IBufferFactory stub. https://gitlab.winehq.org/wine/wine/-/merge_requests/7566

3 3

[PATCH 0/1] MR7567: include: Add robuffer.idl.
by Mohamad Al-Jaf (＠maljaf) 13 Mar '25

13 Mar '25

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/7567

3 2

[PATCH v3 0/7] MR7212: Improvement to winedump for debug information files.
by eric pouech (＠epo) 13 Mar '25

13 Mar '25

This series contain fixes for winedump for debug information: - it fixes a bunch of incorrect information dumping, - it fixes a case of crash for .DBG files, - it allows dumping very large PDB files (>4G) Note: for the later item, current tools' read_file() doesn't work with such large files. Instead of fixing read_file(), I opted for letting a dumper for a given file format to only use a fd to the target file, instead of forcing all dumpers to work from a full in-memory image of the target file. This is useful for PDB files, as their underlying storage requires to reassemble non-contiguous blocks, so this saves memory (the in-memory image of the target file) and one copy of the whole file. This means that all functions to guess the file format now uses a fd instead of the full image. -- v3: tools/winedump: Support dumping large PDB files (>4G). winedump,dbghelp: Remove flexible array member from PDB JG header. tools/winedump: Support more than 64K files in PDB DBI module source substream. tools/winedump: Don't miss hash entries in PDB files. tools/winedump: Don't miss PDB_SYMBOL_RANGE* in PDB files. tools/winedump: Use correct field when dumping CodeView symbols. tools/winedump: Use correct computation for first section out of a .DBG file. https://gitlab.winehq.org/wine/wine/-/merge_requests/7212

2 8

[PATCH v3 0/3] MR7569: Draft: mfplat/tests: Add tests for Byte Stream Timestamps.
by Brendan McGrath (＠redmcg) 13 Mar '25

13 Mar '25

This MR adds tests to `mfplat` to illustrate the timestamp values output on the samples for the respective Byte Stream handlers. I have also included a fix for a bug in `winegstreamer` (and copied to `mfsrcsnk`) where a `NULL` value for the `pguidTimeFormat` parameter in `IMFMediaSource::Start` causes a segmentation fault. On Windows this is allowed. It is included in this MR as the `mfplat` tests pass NULL (so without this fix, the tests crash). -- v3: mfplat/tests: Add tests for Byte Stream Timestamps. https://gitlab.winehq.org/wine/wine/-/merge_requests/7569

2 3

[PATCH v2 0/3] MR7569: Draft: mfplat/tests: Add tests for Byte Stream Timestamps.
by Brendan McGrath (＠redmcg) 13 Mar '25

13 Mar '25

This MR adds tests to `mfplat` to illustrate the timestamp values output on the samples for the respective Byte Stream handlers. I have also included a fix for a bug in `winegstreamer` (and copied to `mfsrcsnk`) where a `NULL` value for the `pguidTimeFormat` parameter in `IMFMediaSource::Start` causes a segmentation fault. On Windows this is allowed. It is included in this MR as the `mfplat` tests pass NULL (so without this fix, the tests crash). -- v2: mfplat/tests: Add tests for Byte Stream Timestamps. https://gitlab.winehq.org/wine/wine/-/merge_requests/7569

2 3