December 2009 - Wine-Bugs - list.winehq.org

[Bug 20860] New: Read buffer overflow in INTERNET_SendCallback in wininet... calling strlen on non-nul-terminated buffer?
by wine-bugs＠winehq.org Dec. 4, 2009

Dec. 4, 2009

http://bugs.winehq.org/show_bug.cgi?id=20860 Summary: Read buffer overflow in INTERNET_SendCallback in wininet... calling strlen on non-nul-terminated buffer? Product: Wine Version: 1.1.33 Platform: PC OS/Version: Linux Status: NEW Keywords: download, source, testcase Severity: normal Priority: P2 Component: wininet AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com The sixth error in http://kegel.com/wine/valgrind/logs/2009-11-27-12.53/vg-urlmon_protocol.txt is Invalid read of size 2 at strlenW (unicode.h:216) by heap_strdupW (internet.h:65) by INTERNET_SendCallback (utility.c:313) by SendAsyncCallbackProc (utility.c:351) by INTERNET_WorkerThreadFunc (internet.c:3128) by worker_thread_proc (threadpool.c:114) Address 0x7f0ccac6 is 0 bytes after a block of size 14 alloc'd at RtlAllocateHeap (heap.c:1697) by SendAsyncCallback (utility.c:380) by FTP_Connect (ftp.c:2447) by INTERNET_InternetOpenUrlW (internet.c:2860) by AsyncInternetOpenUrlProc (internet.c:2946) by INTERNET_WorkerThreadFunc (internet.c:3128) It looks like wininet's INTERNET_SendCallback() function is using strlen when it shouldn't... it's even passed the length as a parameter? -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 20855] New: Appraise-It 8.3 installer fails to download redistributable packages
by wine-bugs＠winehq.org Dec. 4, 2009

Dec. 4, 2009

http://bugs.winehq.org/show_bug.cgi?id=20855 Summary: Appraise-It 8.3 installer fails to download redistributable packages Product: Wine Version: 1.1.33 Platform: PC URL: http://www.sfrep.com/dloads/appraise-it/ai8.3.exe OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: wininet AssignedTo: wine-bugs(a)winehq.org ReportedBy: arethusa26(a)gmail.com Created an attachment (id=24985) --> (http://bugs.winehq.org/attachment.cgi?id=24985) Appraise-it 8.3 redist installer +wininet trace With wine-1.1.33-404-gac85305, when the Appraise-It 8.3 installer attempts to download various redistributables from an FTP site, the installer fails with: "Extraction of installation data downloaded from the web has failed." The immediately pertinent fixmes are: fixme:wininet:FtpGetFileSize (0x2, 0x1cede78) fixme:wininet:INET_QueryOption Stub for 33 Using winetricks to install native wininet lets the installer actually begin the downloading process, although it seems to hang after retrieving all bytes for a particular redist file. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 20849] New: read buffer overflow in CRYPT_RemoveStringFromMultiString() triggered by crypt32/tests/oid.c
by wine-bugs＠winehq.org Dec. 4, 2009

Dec. 4, 2009

http://bugs.winehq.org/show_bug.cgi?id=20849 Summary: read buffer overflow in CRYPT_RemoveStringFromMultiString() triggered by crypt32/tests/oid.c Product: Wine Version: 1.1.33 Platform: PC OS/Version: Linux Status: NEW Keywords: source, testcase Severity: normal Priority: P2 Component: crypt32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com http://kegel.com/wine/valgrind/logs/2009-11-18-21.51/vg-crypt32_oid.txt says Invalid read of size 1 at memmove (mc_replace_strmem.c:613) by CRYPT_RemoveStringFromMultiString (oid.c:885) by CryptUnregisterDefaultOIDFunction (oid.c:1010) by test_registerDefaultOIDFunction (oid.c:437) by func_oid (oid.c:601) by run_test (test.h:535) by main (test.h:585) Address 0x7f040ed4 is 0 bytes after a block of size 44 alloc'd at notify_alloc (heap.c:279) by RtlAllocateHeap (heap.c:1521) by CryptMemAlloc (main.c:125) by CRYPT_GetDefaultOIDDlls (oid.c:930) by CryptUnregisterDefaultOIDFunction (oid.c:1009) by test_registerDefaultOIDFunction (oid.c:437) This is near the code changed in http://www.winehq.org/pipermail/wine-cvs/2009-November/061282.html The error persists with the latest wine sources. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 20787] New: Watchtower library 2008 (português): crashes when closing the application
by wine-bugs＠winehq.org Dec. 4, 2009

Dec. 4, 2009

http://bugs.winehq.org/show_bug.cgi?id=20787 Summary: Watchtower library 2008 (português): crashes when closing the application Product: Wine Version: 1.1.33 Platform: PC OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: devnulljk(a)yopmail.com Created an attachment (id=24886) --> (http://bugs.winehq.org/attachment.cgi?id=24886) Wine app crash report window Wine crashes when I try to close the application either by clicking on the window close bottom or by selection the option 'close' in the 'Library' menu. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 8

[Bug 20774] New: Vampire: The Masquerade - Bloodlines: broken fonts
by wine-bugs＠winehq.org Dec. 4, 2009

Dec. 4, 2009

http://bugs.winehq.org/show_bug.cgi?id=20774 Summary: Vampire: The Masquerade - Bloodlines: broken fonts Product: Wine Version: 1.1.26 Platform: PC OS/Version: Linux Status: UNCONFIRMED Severity: minor Priority: P4 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: twee(a)tweedle-dee.org Created an attachment (id=24870) --> (http://bugs.winehq.org/attachment.cgi?id=24870) Screenshot displaying incorrect fonts After installation from CD, game render fonts very badly, as shown on attachment (taken on Slackware 12 with wine-1.1.26). -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[Bug 20764] New: Reason 4 application aborts with "unexpected error" dialog after installation
by wine-bugs＠winehq.org Dec. 4, 2009

Dec. 4, 2009

http://bugs.winehq.org/show_bug.cgi?id=20764 Summary: Reason 4 application aborts with "unexpected error" dialog after installation Product: Wine Version: 1.1.33 Platform: PC URL: http://dl.propellerheads.se/propellerhead/ReasonDemo_w in.zip OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: ntdll AssignedTo: wine-bugs(a)winehq.org ReportedBy: arethusa26(a)gmail.com With wine-1.1.33-259-g7782ebe, after installing Reason 4, when attempting to launch it, a message box appears: "The application can not run because of an unexpected error." Since Reason 4 started in wine-1.1.29, a regression test was performed, which showed: 1cf1a3f211f9dbbcfff2ef92f53181f540e9ac32 is first bad commit commit 1cf1a3f211f9dbbcfff2ef92f53181f540e9ac32 Author: Alexandre Julliard <julliard(a)winehq.org> Date: Tue Sep 22 17:05:02 2009 +0200 ntdll: Only create the CPU registry keys on first run. :040000 040000 ee7ec1d8aab6722caac42a212b2f16df9e89b527 51a00bde240032ad9d4d0ec3661edea167b91f32 M dlls >From +relay,+seh log: 0009:Call advapi32.RegOpenKeyExW(80000002,02210cb8 L"Hardware\\Description\\System\\CentralProcessor",00000000,00020019,0032da00) ret=0173a6e0 0009:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=0173a6e0 0009:Call advapi32.RegCloseKey(000000a0) ret=0173a6ed 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=0173a6ed ... 0009:Call advapi32.RegCreateKeyExW(80000002,02210cb8 L"Hardware\\Description\\System\\CentralProcessor",00000000,00000000,00000000,00020019,00000000,0032da80,0032d9f8) ret=0173a685 0009:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=0173a685 ... 0009:Call advapi32.RegOpenKeyExW(000000a0,0032da3c L"0",00000000,00020019,0032da00) ret=0173a6e0 0009:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=0173a6e0 0009:Call advapi32.RegCloseKey(000000a4) ret=0173a6ed 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=0173a6ed ... 0009:Call advapi32.RegCreateKeyExW(000000a0,0032da3c L"0",00000000,00000000,00000000,00020019,00000000,0032daa4,0032d9f8) ret=0173a685 0009:Ret advapi32.RegCreateKeyExW() retval=000003fd ret=0173a685 ... 0009:Call KERNEL32.RaiseException(e06d7363,00000001,00000003,0032d9c4) ret=01750372 0009:trace:seh:raise_exception code=e06d7363 flags=1 addr=0x7b8439c3 ip=7b8439c3 tid=0009 RegCreateKeyExW returns ERROR_CHILD_MUST_BE_VOLATILE, so presumably Reason 4 isn't expecting the registry key to be volatile. I also note that once Reason 4 is made to start in an earlier Wine version, Reason 4 will launch in newer Wine versions. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 20760] New: Write buffer overrun in CreateFileMoniker()
by wine-bugs＠winehq.org Dec. 4, 2009

Dec. 4, 2009

http://bugs.winehq.org/show_bug.cgi?id=20760 Summary: Write buffer overrun in CreateFileMoniker() Product: Wine Version: 1.1.33 Platform: PC OS/Version: Linux Status: NEW Keywords: source, testcase Severity: normal Priority: P2 Component: ole32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com http://kegel.com/wine/valgrind/logs/2009-11-18-21.51/diff-hlink_hlink.txt http://kegel.com/wine/valgrind/logs/2009-11-18-21.51/vg-hlink_hlink.txt shows a new error thanks to the heap tail check. Looks like a level-of-indirection-during-allocation error, 1039 strgtable = CoTaskMemAlloc(len*sizeof(WCHAR)); should be 1039 strgtable = CoTaskMemAlloc(len*sizeof(WCHAR *)); Ulrich, you were in there last, could you have a look? Invalid write of size 4 at FileMonikerImpl_DecomposePath (filemoniker.c:1056) by FileMonikerImpl_Construct (filemoniker.c:1375) by CreateFileMoniker (filemoniker.c:1443) by FileMoniker_CreateFromDisplayName (filemoniker.c:1484) by MkParseDisplayName (moniker.c:1130) by HlinkCreateFromString (hlink_main.c:124) by test_persist (hlink.c:479) by func_hlink (hlink.c:1122) by run_test (test.h:535) by main (test.h:585) Address 0x7f04416c is 4 bytes inside a block of size 6 alloc'd at notify_alloc (heap.c:279) by RtlAllocateHeap (heap.c:1521) by IMalloc_fnAlloc (ifs.c:186) by CoTaskMemAlloc (ifs.c:562) by FileMonikerImpl_DecomposePath (filemoniker.c:1039) by FileMonikerImpl_Construct (filemoniker.c:1375) by CreateFileMoniker (filemoniker.c:1443) by FileMoniker_CreateFromDisplayName (filemoniker.c:1484) by MkParseDisplayName (moniker.c:1130) by HlinkCreateFromString (hlink_main.c:124) by test_persist (hlink.c:479) This can be reproduced locally by setting up valgrind as described in http://wiki.winehq.org/Valgrind and applying the heap tail check patch to wine, starting winemine (to avoid valgrinding services), then running cd dlls/ole32/tests WINETEST_PLATFORM=wine WINE_HEAP_REDZONE=16 valgrind --trace-children=yes --track-origins=yes --num-callers=30 wine ole32_test.exe.so moniker although when I do that with today's sources, I get the slightly different error Invalid write of size 4 at FileMonikerImpl_DecomposePath (filemoniker.c:1087) by FileMonikerImpl_Construct (filemoniker.c:1375) by FileMonikerCF_CreateInstance (filemoniker.c:1593) by CoCreateInstance (compobj.c:2502) by get_unmarshaler_from_stream (marshal.c:1575) by CoReleaseMarshalData (marshal.c:1882) by rot_entry_delete (moniker.c:182) by RunningObjectTableImpl_Revoke (moniker.c:595) by test_ROT (moniker.c:632) by func_moniker (moniker.c:1943) Address 0x7f03fcb0 is 0 bytes after a block of size 0 alloc'd at notify_alloc (heap.c:279) by RtlAllocateHeap (heap.c:1521) by IMalloc_fnAlloc (ifs.c:186) by CoTaskMemAlloc (ifs.c:562) by FileMonikerImpl_DecomposePath (filemoniker.c:1039) by FileMonikerImpl_Construct (filemoniker.c:1375) by FileMonikerCF_CreateInstance (filemoniker.c:1593) by CoCreateInstance (compobj.c:2502) by get_unmarshaler_from_stream (marshal.c:1575) by CoReleaseMarshalData (marshal.c:1882) by rot_entry_delete (moniker.c:182) by RunningObjectTableImpl_Revoke (moniker.c:595) by test_ROT (moniker.c:632) by func_moniker (moniker.c:1943) There's a simpler, similar looking error later on: Invalid write of size 4 at 0xD876677: FileMonikerImpl_DecomposePath (filemoniker.c:1087) by 0xD8771E0: FileMonikerImpl_Construct (filemoniker.c:1375) by 0xD877514: CreateFileMoniker (filemoniker.c:1443) by 0xCF306BC: test_file_moniker (moniker.c:1387) by 0xCF30A50: test_file_monikers (moniker.c:1448) by 0xCF333FC: func_moniker (moniker.c:1947) Address 0x7f045468 is 8 bytes inside a block of size 10 alloc'd at 0xCC8463B: notify_alloc (heap.c:279) by 0xCC844D9: RtlAllocateHeap (heap.c:1521) by 0xD87B372: IMalloc_fnAlloc (ifs.c:186) by 0xD87C38E: CoTaskMemAlloc (ifs.c:562) by 0xD8764EA: FileMonikerImpl_DecomposePath (filemoniker.c:1039) by 0xD8771E0: FileMonikerImpl_Construct (filemoniker.c:1375) by 0xD877514: CreateFileMoniker (filemoniker.c:1443) by 0xCF306BC: test_file_moniker (moniker.c:1387) -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 20759] New: Read buffer overflow in NdrConformantArrayMarshall?
by wine-bugs＠winehq.org Dec. 4, 2009

Dec. 4, 2009

http://bugs.winehq.org/show_bug.cgi?id=20759 Summary: Read buffer overflow in NdrConformantArrayMarshall? Product: Wine Version: 1.1.33 Platform: PC OS/Version: Linux Status: NEW Keywords: source, testcase Severity: normal Priority: P2 Component: rpc AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com http://kegel.com/wine/valgrind/logs/2009-11-18-21.51/vg-ole32_marshal.txt contains a new warning thanks to the heap tail check: Invalid read of size 1 at memcpy (mc_replace_strmem.c:482) by safe_copy_to_buffer (ndr_marshall.c:707) by array_write_variance_and_marshall (ndr_marshall.c:1926) by NdrConformantArrayMarshall (ndr_marshall.c:3626) by PointerMarshall (ndr_marshall.c:816) by NdrPointerMarshall (ndr_marshall.c:1488) by PointerMarshall (ndr_marshall.c:816) by NdrPointerMarshall (ndr_marshall.c:1488) by IRemUnknown_RemQueryInterface_Stub (dcom_p.c:386) by CStdStubBuffer_Invoke (cstub.c:475) by RPC_ExecuteCall (rpc.c:1392) by apartment_wndproc (compobj.c:885) by ??? (library.h:159) by call_window_proc (winproc.c:469) by WINPROC_CallProcAtoW (winproc.c:1023) by WINPROC_call_window (winproc.c:2225) by DispatchMessageA (message.c:3089) by host_object_proc (marshal.c:253) by ??? (signal_i386.c:2312) by call_thread_entry_point (signal_i386.c:2338) Address 0x7f04822f is 3 bytes after a block of size 44 alloc'd at notify_alloc (heap.c:279) by RtlAllocateHeap (heap.c:1521) by IMalloc_fnAlloc (ifs.c:186) by CoTaskMemAlloc (ifs.c:562) by RemUnknown_RemQueryInterface (stubmanager.c:657) by IRemUnknown_RemQueryInterface_Stub (dcom_p.c:370) by CStdStubBuffer_Invoke (cstub.c:475) by RPC_ExecuteCall (rpc.c:1392) by apartment_wndproc (compobj.c:885) by ??? (library.h:159) by call_window_proc (winproc.c:469) by WINPROC_CallProcAtoW (winproc.c:1023) by WINPROC_call_window (winproc.c:2225) by DispatchMessageA (message.c:3089) by host_object_proc (marshal.c:253) by ??? (signal_i386.c:2312) by call_thread_entry_point (signal_i386.c:2338) by start_thread (thread.c:469) by start_thread (pthread_create.c:297) by clone (clone.S:130) This can be reproduced locally by setting up valgrind as described in http://wiki.winehq.org/Valgrind and applying the heap tail check patch to wine, starting winemine (to avoid valgrinding services), then running WINETEST_PLATFORM=wine WINE_HEAP_REDZONE=16 valgrind --trace-children=yes --track-origins=yes --num-callers=30 wine ole32_test.exe.so marshal (And, bonus deal, there's a null ptr crash in the same log file later down: Backtrace: =>0 test_local_server+0x5e4() [dlls/ole32/tests/marshal.c:2711] in ole32_test 1 func_marshal+0x1ab() [dlls/ole32/tests/marshal.c:3092] in ole32_test ... 2711 IClassFactory_Release(cf); but I suppose that might be a different bug.) -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 20754] New: QIP Infium not start with 1.1.33 [regression]
by wine-bugs＠winehq.org Dec. 4, 2009

Dec. 4, 2009

http://bugs.winehq.org/show_bug.cgi?id=20754 Summary: QIP Infium not start with 1.1.33 [regression] Product: Wine Version: 1.1.33 Platform: PC URL: http://qip.ru OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: landy2005(a)gmail.com Versions: OS: Linux Ubintu karmic i386 Wine: 1.1.33 Repo: https://launchpad.net/~ubuntu-wine/ QIP: Infium (Build 9032 RC4) QIP Infium does not start after upgrading to wine version 1.1.33. With previous versions of wine it works fine. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 20745] New: WinZip 12.1 installer subprocess crashes during installation
by wine-bugs＠winehq.org Dec. 4, 2009

Dec. 4, 2009

http://bugs.winehq.org/show_bug.cgi?id=20745 Summary: WinZip 12.1 installer subprocess crashes during installation Product: Wine Version: 1.1.33 Platform: PC URL: http://download.winzip.com/wzd/winzip121.exe OS/Version: Linux Status: UNCONFIRMED Severity: minor Priority: P2 Component: ole32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: arethusa26(a)gmail.com Created an attachment (id=24813) --> (http://bugs.winehq.org/attachment.cgi?id=24813) WinZip 12.1 installer standard error With wine-1.1.33-150-g4990ca0, during the WinZip 12.1 installation process, the installer invokes the installed winzip32.exe at a certain point in the installation, resulting in: Backtrace: =>0 0x00a7d046 (0x0033fd04) 1 0x7e6fcbca apartment_release+0x15a(apt=0x157818) [/home/andrew/wine-git/dlls/ole32/compobj.c:597] in ole32 (0x0033fd44) 2 0x7e6fd9e2 CoUninitialize+0x152() [/home/andrew/wine-git/dlls/ole32/compobj.c:1385] in ole32 (0x0033fd74) 3 0x7e7254b7 OleUninitialize+0x67() [/home/andrew/wine-git/dlls/ole32/ole2.c:263] in ole32 (0x0033fd94) 4 0x004523e6 in winzip32 (+0x523e6) (0x0033fd9c) ... The standard error output is attached. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6