April 2025 - Wine-gitlab - list.winehq.org

[PATCH v5 0/2] MR7676: winegstreamer: Make sure WMSyncReader never reads in the background.
by Yuxuan Shui (＠yshui) 23 Apr '25

23 Apr '25

WMSyncReader starts a background read thread that reads from the IStream passed to IWMSyncReader::OpenStream. This means it could use the IStream in the background even when no IWMSyncReader methods are being called. For well-behaved applications, this is probably OK. However, AQUARIUM (Steam 2515070) frees the IStream it passes to WMSyncReader _before_ it calls IWMSyncReader::Close, which stops the read thread. This causes the read thread to access freed memory. This is improper, but not unreasonable, as IWMSyncReader is supposed to be a synchronous interface, so one might assume when they weren't calling into IWMSyncReader methods, the IStream won't be used. This commit adds a `wg_parser_dont_read` function, which can be used to stop wg_parser from issuing read requests. This is used by IWMSyncReader to make sure read requests are only issued when IWMSyncReader methods are being called. -- v5: DONT MERGE: winedebug in CI winegstreamer: Make sure WMSyncReader never reads in the background. https://gitlab.winehq.org/wine/wine/-/merge_requests/7676

2 2

[PATCH v4 0/1] MR7676: winegstreamer: Make sure WMSyncReader never reads in the background.
by Yuxuan Shui (＠yshui) 23 Apr '25

23 Apr '25

WMSyncReader starts a background read thread that reads from the IStream passed to IWMSyncReader::OpenStream. This means it could use the IStream in the background even when no IWMSyncReader methods are being called. For well-behaved applications, this is probably OK. However, AQUARIUM (Steam 2515070) frees the IStream it passes to WMSyncReader _before_ it calls IWMSyncReader::Close, which stops the read thread. This causes the read thread to access freed memory. This is improper, but not unreasonable, as IWMSyncReader is supposed to be a synchronous interface, so one might assume when they weren't calling into IWMSyncReader methods, the IStream won't be used. This commit adds a `wg_parser_dont_read` function, which can be used to stop wg_parser from issuing read requests. This is used by IWMSyncReader to make sure read requests are only issued when IWMSyncReader methods are being called. -- v4: winegstreamer: Make sure WMSyncReader never reads in the background. https://gitlab.winehq.org/wine/wine/-/merge_requests/7676

3 4

[PATCH v3 0/5] MR5068: win32u: Fix rendering of the rotated and scaled text.
by Dmitry Timoshkov (＠dmitry) 23 Apr '25

23 Apr '25

These patches make a test case attached to the bug https://bugs.winehq.org/show_bug.cgi?id=33190 work. -- v3: win32u: NtGdiExtTextOutW() should translate x,y from logical to device units at the last step. win32u: Fix device<->world width/height converters. gdi32/tests: Add some tests for rotated font metrics. win32u: Use slightly more readable names for DP/LP converters. win32u: Use correct helper for converting width to device units. https://gitlab.winehq.org/wine/wine/-/merge_requests/5068

3 9

[PATCH v4 0/1] MR7838: mfplat/tests: Don't assume video processor MFT can provide samples.
by Charlotte Pabst (＠CharlottePabst) 23 Apr '25

23 Apr '25

This fixes a test failure/crash on Windows 8.1 introduced by dd1d82728811c15716eefa0917eb3ecac4b9a85a. -- v4: mfplat/tests: Don't assume video processor MFT can provide samples. https://gitlab.winehq.org/wine/wine/-/merge_requests/7838

3 3

[PATCH 0/5] MR7883: PDB rewrite #11.
by eric pouech (＠epo) 23 Apr '25

23 Apr '25

This is serie #11 about PDB rewrite. It finishes the migration of the types management to the new PDB reader (also disabling remaining type handling in old PDB reader when using new PDB reader). It starts the handling in new PDB reader of functions and symbols: - it implements line information support in new PDB reader for inlined functions, - it uses (for all debug info backend) the opaque symref_t to refer to symbol's container (so that we can let backend decide how to store it). -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7883

2 5

[PATCH v4 0/2] MR7833: mf: Update state and start clock for both paused and stopped.
by Brendan McGrath (＠redmcg) 23 Apr '25

23 Apr '25

Previously, the paused state was not handled. -- v4: mf: Reset audio client on flush. mf: Update state and start clock for both paused and stopped. https://gitlab.winehq.org/wine/wine/-/merge_requests/7833

3 6

[PATCH v2 0/1] MR7781: combase: Add stub for RoOriginateErrorW.
by Louis Lenders (＠xe) 23 Apr '25

23 Apr '25

This is called by UniGetUi (https://github.com/marticliment/UniGetUI/releases/tag/3.1.8) (After choosing 'Install for all users' --> 'perform portable installation' otherwise the installer runs into other (shellfolder) related bugs) -- v2: combase: Add stub for RoOriginateErrorW. https://gitlab.winehq.org/wine/wine/-/merge_requests/7781

3 2

[PATCH 0/1] MR7859: gdi32/tests: Fix NtGdiMakeFontDir test to adopt newer Windows behavior.
by Bernhard Übelacker 23 Apr '25

23 Apr '25

Followup of 5a6a75a5ff. [Link to the pattern page.](https://test.winehq.org/data/patterns.html#gdi32:font) [A testbot run with this patch.](https://testbot.winehq.org/JobDetails.pl?Key=157999) -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7859

2 2

[PATCH 0/1] MR7857: winewayland: Don't update constraints without wl_pointer.
by Attila Fidan (＠atticf) 23 Apr '25

23 Apr '25

If ClipCursor is called while the seat doesn't have a pointer and the call qualifies for locking the pointer, it would have tried to lock a null wl_pointer. For example, I'm launching a fullscreen application (which causes ClipCursor calls on startup) in a headless compositor before I launch my virtual keyboard/pointer client. While the pointer is deinitialized and there cannot be a focused hwnd, the cursor wl_surface will not be set, making it qualify for pointer locking. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7857

3 2

[PATCH v2 0/1] MR7798: spoolss: Avoid buffer-overflow when setting numentries. (ASan)
by Bernhard Übelacker 23 Apr '25

23 Apr '25

BuildOtherNamesFromMachineName writes sizeof(LPVOID) bytes but the test reserved just sizeof(DWORD), which makes a difference at amd64 and gets detected by ASan. <details> <summary>ASan output</summary> ``` ================================================================= ==spoolss_test.exe==700==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffe1ffba0 at pc 0x6ffffdc53e38 bp 0x7ffffe1ffa40 sp 0x7ffffe1ffa88 WRITE of size 8 at 0x7ffffe1ffba0 thread T0 #0 0x6ffffdc53e37 in BuildOtherNamesFromMachineName .../wine/dlls/spoolss/spoolss_main.c:99:11 #1 0x00014000170e in test_BuildOtherNamesFromMachineName .../wine/dlls/spoolss/tests/spoolss.c:131:11 #2 0x000140001030 in func_spoolss .../wine/dlls/spoolss/tests/spoolss.c:218:5 #3 0x000140003ede in run_test .../wine/include/wine/test.h:765:5 #4 0x000140003a8e in main .../wine/include/wine/test.h #5 0x000140004963 in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:58:11 #6 0x6fffffc3565e in BaseThreadInitThunk .../wine/dlls/kernel32/thread.c:61:24 #7 0x6fffffdbbcc2 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17004bcc2) Address 0x7ffffe1ffba0 is located in stack of thread T0 at offset 64 in frame #0 0x00014000164f in test_BuildOtherNamesFromMachineName .../wine/dlls/spoolss/tests/spoolss.c:122 This frame has 2 object(s): [32, 40) 'buffers' (line 123) [64, 68) 'numentries' (line 124) <== Memory access at offset 64 partially overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp, SEH and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow .../wine/dlls/spoolss/spoolss_main.c:99:11 in BuildOtherNamesFromMachineName Shadow bytes around the buggy address: 0x7ffffe1ff900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ff980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffb00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 =>0x7ffffe1ffb80: 00 f2 f2 f2[04]f3 f3 f3 00 00 00 00 00 00 00 00 0x7ffffe1ffc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffc80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f8 f8 f8 0x7ffffe1ffd00: f8 f8 f8 f8 f3 f3 f3 f3 00 00 00 00 00 00 00 00 0x7ffffe1ffd80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 0x7ffffe1ffe00: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==spoolss_test.exe==700==ABORTING ``` </details> -- v2: spoolss: Avoid buffer-overflow when setting numentries. (ASan) https://gitlab.winehq.org/wine/wine/-/merge_requests/7798

2 4