January 2018 - Wine-Bugs - list.winehq.org

[Bug 35127] Gamehall (Chinese game client) crashes in comctl32

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=35127 --- Comment #20 from Zhiyi Zhang <yi.gd.cn(a)gmail.com> --- (In reply to Zhiyi Zhang from comment #19) > (In reply to Zhiyi Zhang from comment #18) > > Further experiment on Windows by calling related api and dumping the memory > > pointed by HTREEITEM, $HTREEITEM+0x1a is the textWidth member. And since the > > content 2 bytes before and after $HTREEITEM+0x1a is not zero, and don't > > change with the text of the item. It's reasonable to believe that textWidth > > is not a LONG but a WORD. > > Sorry, I was wrong. 2 bytes after $HTREEITEM+0x1a is zero. So it's possible > that textWidth is a LONG member but aligned to 2 bytes boundary, which means > there is WORD before textWidth. But since $HTREEITEM+0x1a is aligned to 2 bytes boundary, I am putting my money on textWidth is WORD and there is a another WORD before it. Unless struct __TREEITEM used packed(2) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

Jan. 18, 2018

[Bug 44360] Can't play Diablo 2 LOD via Battle.net

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=44360 diavolo(a)seznam.cz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |diavolo(a)seznam.cz --- Comment #5 from diavolo(a)seznam.cz --- imho its duplicate of this bug https://bugs.winehq.org/show_bug.cgi?id=44178 Problem is new anticheat protection introduced in december with start of new ladder season. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

Jan. 18, 2018

[Bug 35127] Gamehall (Chinese game client) crashes in comctl32

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=35127 --- Comment #19 from Zhiyi Zhang <yi.gd.cn(a)gmail.com> --- (In reply to Zhiyi Zhang from comment #18) > Further experiment on Windows by calling related api and dumping the memory > pointed by HTREEITEM, $HTREEITEM+0x1a is the textWidth member. And since the > content 2 bytes before and after $HTREEITEM+0x1a is not zero, and don't > change with the text of the item. It's reasonable to believe that textWidth > is not a LONG but a WORD. Sorry, I was wrong. 2 bytes after $HTREEITEM+0x1a is zero. So it's possible that textWidth is a LONG member but aligned to 2 bytes boundary, which means there is WORD before textWidth. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

Jan. 18, 2018

[Bug 44245] Gray screen on OnePlus 3 / 3T

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=44245 --- Comment #10 from Alexandr <sasha01945(a)gmail.com> --- Today I updated OxygenOS to OP3T_0.2_Open_21. This update is not fix this. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

Jan. 18, 2018

[Bug 35127] Gamehall (Chinese game client) crashes in comctl32

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=35127 --- Comment #18 from Zhiyi Zhang <yi.gd.cn(a)gmail.com> --- Further experiment on Windows by calling related api and dumping the memory pointed by HTREEITEM, $HTREEITEM+0x1a is the textWidth member. And since the content 2 bytes before and after $HTREEITEM+0x1a is not zero, and don't change with the text of the item. It's reasonable to believe that textWidth is not a LONG but a WORD. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

Jan. 18, 2018

[Bug 35127] Gamehall (Chinese game client) crashes in comctl32

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=35127 --- Comment #17 from Zhiyi Zhang <yi.gd.cn(a)gmail.com> --- When watchpoint trigger, backtrace showed that the offending code is in the application itself Stopped on watchpoint 2 at 0x004f106a new value 52004e Wine-dbg>bt bt Backtrace: =>0 0x004f106a in gamehall (+0xf106a) (0x00c5ee00) 1 0x00000001 (0x006b96e4) 2 0x0046be70 in gamehall (+0x6be6f) (0x004efa20) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

Jan. 18, 2018

[Bug 44365] armel build fails: selected processor does not support `strd r4,[sp]' in ARM mode

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=44365 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |3e26caf0d85caa4256edb011a63 | |11e00cf893e3b Status|UNCONFIRMED |RESOLVED Resolution|--- |FIXED --- Comment #1 from Alexandre Julliard <julliard(a)winehq.org> --- It should be fixed by 3e26caf0d85caa4256edb011a6311e00cf893e3b. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

Jan. 18, 2018

[Bug 35127] Gamehall (Chinese game client) crashes in comctl32

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=35127 --- Comment #16 from Zhiyi Zhang <yi.gd.cn(a)gmail.com> --- forgot to mention. I used $ LANG=zh_CN.UTF-8 WINEDEBUG=+treeview ./wine ~/.wine/drive_c/Program\ Files/GameChannel/GameHall.exe to launch the debugger -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

Jan. 18, 2018

[Bug 35127] Gamehall (Chinese game client) crashes in comctl32

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=35127 --- Comment #15 from Zhiyi Zhang <yi.gd.cn(a)gmail.com> --- This is due to the application try to write to internal structure. $ winedbg winedbg>break TREEVIEW_SendCustomDrawItemNotify winedbg>c winedbg>watch * (value of item + 0x18) winedbg>c watchpoint should now be triggered Using 'info reg',you should see that ESI points to item，and the instruction tried to write to $item+0x1a. Wine-dbg>disas 0x004f1040,0x004f1080 disas 0x004f1040,0x004f1080 0x004f1040: jl 0x004f1066 0x004f1042: orb %dl,0xffffff8b(%edi) 0x004f1045: pushl %ecx 0x004f1046: clc 0x004f1047: pushl %edx 0x004f1048: movl 0x8(%eax),%edx 0x004f104b: pushl %ecx 0x004f104c: pushl %edx 0x004f104d: call *0x6b3234 -> 0x7eaed64c GetTextExtentPoint32A [/home/eric/source/wine/wine/dlls/gdi32/font.c:1140] in gdi32 0x004f1053: movl 0x8(%esp),%eax <- 0x8(%esp) is 0x0000004e 0x004f1057: leal 0x24(%esp),%ecx 0x004f105b: addl $4,%eax <- +4, then %eax is the written value 0x004f105e: movl $0xffffffff,0x18(%esp) 0x004f1066: movw %ax,0x1a(%esi) <- corrupts item->pszText，accordding to calling GetTextExtentPoint32A，the application is trying to write to item->textWidth directly. You can also verify this by print out value of textWidth and written value. They should be off by 4. 0x004f106a: andl $0xffff,%eax 0x004f106f: movl %eax,%esi 0x004f1071: call 0x00687e76 0x004f1076: movl 0x10(%esp),%ecx 0x004f107a: movl %esi,%eax 0x004f107c: popl %edi 0x004f107d: popl %esi 0x004f107e: movl %ecx,%fs:0x00000000 Wine-dbg>x 0x0033e268 0x8(%esp) x 0x0033e268 0000004e However in comctl32/treeview.c#L139 struct _TREEITEM. In struct _TREEITEM, $item+0x1a points to none of the members, because they are all 4 bytes aligned. By writing to $item+0x1a, item->pszText gets corrupted. By adding a 2 bytes padding before item->pszText to workground this. The application runs. Since the application expect textWidth to be at $item+0x1a and textWidth to be 2 bytes long, try move the position of textWidth also works. However, textWidth now is 4 bytes.Moving textWidth also make it corrupted. But it seems that the application still runs. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

Jan. 18, 2018

[Bug 38274] White water in Heroes VI (DXTn volume textures)

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=38274 --- Comment #48 from mo78(a)abv.bg --- Created attachment 60275 --> https://bugs.winehq.org/attachment.cgi?id=60275 Very dark textures with white water. Wine 2.21 staging and Wine 3.0 RC6 Very dark textures with white water. Wine 2.21 staging and Wine 3.0 RC6. When you try a level without water, all the graphics seem to work properly. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

Jan. 18, 2018