November 2019 - Wine-Bugs - list.winehq.org

[Bug 46127] New: aria2 1.34 fails to connect, reports 'WinTLS: Channel setup failed. Schannel provider did not fulfill requested flags. Excepted : 33180 Actual: 33052'
by wine-bugs＠winehq.org July 18, 2021

July 18, 2021

https://bugs.winehq.org/show_bug.cgi?id=46127 Bug ID: 46127 Summary: aria2 1.34 fails to connect, reports 'WinTLS: Channel setup failed. Schannel provider did not fulfill requested flags. Excepted: 33180 Actual: 33052' Product: Wine Version: 3.20 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: secur32 Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, as it says. Website: https://aria2.github.io/ --- quote --- aria2 is a lightweight multi-protocol & multi-source command-line download utility. It supports HTTP/HTTPS, FTP, SFTP, BitTorrent and Metalink. aria2 can be manipulated via built-in JSON-RPC and XML-RPC interfaces. --- quote --- Also reported on their Github, but likely with old Wine version which suffered at that time from another insufficiency in related area. https://github.com/aria2/aria2/issues/348 --- quote --- You could always build aria2 on your own using the OpenSSL or GnuTLS TLS backend instead of WinTLS... Or use a linux build in the first place... It seems to me that wine's Schannel implementation is incomplete or buggy, and seeing that this affects the context state flags, working around this would require not checking the channel integrity at all... Which might be actually an option for the --check-certificate=false case. Need to ponder on this. --- quote --- Trace log: --- snip --- $ WINEDEBUG=+seh,+relay,+bcrypt,+secur32 wine64 ./aria2c_x64.exe "https://uup.rg-adguard.net/api/GetFiles?id=foobar" >>log.txt 2>&1 ... 002e:Call secur32.InitializeSecurityContextA(008f3710,00000000,008f3570 "uup.rg-adguard.net",0000819c,00000000,00000000,00000000,69cb2f8700000000,008e5570,0033efd0,0033ef6c,00000000) ret=00466d4b 002e:trace:secur32:InitializeSecurityContextA 0x8f3710 (nil) "uup.rg-adguard.net" 0x0000819c 0 0 (nil) 0 0x8e5570 0x33efd0 0x33ef6c (nil) 002e:trace:secur32:schan_InitializeSecurityContextA 0x8a320 (nil) "uup.rg-adguard.net" 33180 0 0 (nil) 0 0x33ed40 0x33efd0 0x33ef6c (nil) ... 002e:trace:secur32:schan_InitializeSecurityContextW 0x8a320 (nil) L"uup.rg-adguard.net" 0x0000819c 0 0 (nil) 0 0x33ed40 0x33efd0 0x33ef6c (nil) 002e:trace:secur32:dump_buffer_desc Buffer desc 0x33efd0: 002e:trace:secur32:dump_buffer_desc buffer 0: cbBuffer 0, BufferType 0 pvBuffer (nil) ... 002e:trace:secur32:schan_imp_create_session Using "NORMAL:%LATEST_RECORD_VERSION:+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:-VERS-SSL3.0" priority 002e:trace:secur32:schan_gnutls_log <2> added 5 protocols, 29 ciphersuites, 15 sig algos and 9 groups into priority list ... 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: Adv. version: 3.3 ... 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: CLIENT HELLO was queued [220 bytes] 002e:trace:secur32:schan_push Push 225 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 0, BufferType 0x2, pvBuffer (nil) 002e:Call ntdll.RtlAllocateHeap(00010000,00000000,00000100) ret=7f1c611a498b 002e:Ret ntdll.RtlAllocateHeap() retval=0008b300 ret=7f1c611a498b 002e:trace:secur32:schan_push Wrote 225 bytes 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[get_last_packet]:1171 002e:trace:secur32:schan_pull Pull 5 bytes 002e:trace:secur32:schan_get_buffer No desc 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[_gnutls_io_read_buffered]:589 002e:trace:secur32:schan_imp_handshake Continue... ... 002e:Ret secur32.InitializeSecurityContextA() retval=00090312 ret=00466d4b ... 002e:Call secur32.InitializeSecurityContextA(008f3710,008e5570,008f3570 "uup.rg-adguard.net",0000819c,00000000,00000000,0033ef70,00000000,00000000,0033ef80,0033ef6c,00000000) ret=00467035 002e:trace:secur32:InitializeSecurityContextA 0x8f3710 0x8e5570 "uup.rg-adguard.net" 0x0000819c 0 0 0x33ef70 0 (nil) 0x33ef80 0x33ef6c (nil) 002e:trace:secur32:schan_InitializeSecurityContextA 0x8a320 0x8a350 "uup.rg-adguard.net" 33180 0 0 0x33ef70 0 (nil) 0x33ef80 0x33ef6c (nil) ... 002e:trace:secur32:schan_InitializeSecurityContextW 0x8a320 0x8a350 L"uup.rg-adguard.net" 0x0000819c 0 0 0x33ef70 0 (nil) 0x33ef80 0x33ef6c (nil) 002e:trace:secur32:dump_buffer_desc Buffer desc 0x33ef70: 002e:trace:secur32:dump_buffer_desc buffer 0: cbBuffer 3187, BufferType 0x2 pvBuffer 0x8e66c0 002e:trace:secur32:dump_buffer_desc buffer 1: cbBuffer 0, BufferType 0 pvBuffer (nil) 002e:trace:secur32:dump_buffer_desc Buffer desc 0x33ef80: 002e:trace:secur32:dump_buffer_desc buffer 0: cbBuffer 0, BufferType 0x2 pvBuffer (nil) 002e:trace:secur32:dump_buffer_desc buffer 1: cbBuffer 0, BufferType 0x11 pvBuffer (nil) 002e:trace:secur32:schan_InitializeSecurityContextW Using expected_size 3187. 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[get_last_packet]:1171 002e:trace:secur32:schan_pull Pull 5 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 3187, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 5 bytes 002e:trace:secur32:schan_pull Pull 65 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 3187, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 65 bytes 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: SERVER HELLO (2) was received. Length 61[61], frag offset 0, frag length: 61, sequence: 0 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[get_last_packet]:1162 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[_gnutls_handshake_io_recv_int]:1413 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: Server's version: 3.3 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: SessionID length: 0 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: SessionID: c0 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: Selected cipher suite: GNUTLS_ECDHE_RSA_AES_128_GCM_SHA256 002e:trace:secur32:schan_gnutls_log <4> EXT[0x7d673980]: Parsing extension 'Server Name Indication/0' (0 bytes) 002e:trace:secur32:schan_gnutls_log <4> EXT[0x7d673980]: Parsing extension 'Safe Renegotiation/65281' (1 bytes) 002e:trace:secur32:schan_gnutls_log <4> EXT[0x7d673980]: Parsing extension 'Supported EC Point Formats/11' (4 bytes) 002e:trace:secur32:schan_gnutls_log <4> EXT[0x7d673980]: Parsing extension 'Session Ticket/35' (0 bytes) 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: Safe renegotiation succeeded 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[get_last_packet]:1171 002e:trace:secur32:schan_pull Pull 5 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 3187, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 5 bytes 002e:trace:secur32:schan_pull Pull 2765 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 3187, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 2765 bytes 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: CERTIFICATE (11) was received. Length 2761[2761], frag offset 0, frag length: 2761, sequence: 0 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[get_last_packet]:1171 002e:trace:secur32:schan_pull Pull 5 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 3187, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 5 bytes 002e:trace:secur32:schan_pull Pull 333 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 3187, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 333 bytes 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: SERVER KEY EXCHANGE (12) was received. Length 329[329], frag offset 0, frag length: 329, sequence: 0 002e:trace:secur32:schan_gnutls_log <2> received curve SECP256R1 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: Selected group SECP256R1 (2) 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: verify TLS 1.2 handshake data: using RSA-SHA512 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[get_last_packet]:1171 002e:trace:secur32:schan_pull Pull 5 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 3187, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 5 bytes 002e:trace:secur32:schan_pull Pull 4 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 3187, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 4 bytes 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: SERVER HELLO DONE (14) was received. Length 0[0], frag offset 0, frag length: 0, sequence: 0 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[get_last_packet]:1162 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[_gnutls_handshake_io_recv_int]:1413 002e:trace:secur32:schan_gnutls_log <3> ASSERT: mpi.c[wrap_nettle_mpi_print]:60 002e:trace:secur32:schan_gnutls_log <3> ASSERT: mpi.c[wrap_nettle_mpi_print]:60 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: CLIENT KEY EXCHANGE was queued [70 bytes] 002e:trace:secur32:schan_gnutls_log <4> REC[0x7d673980]: Sent ChangeCipherSpec 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: Cipher Suite: GNUTLS_ECDHE_RSA_AES_128_GCM_SHA256 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: Initializing internal [write] cipher sessions 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: recording tls-unique CB (send) 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: FINISHED was queued [16 bytes] 002e:trace:secur32:schan_push Push 75 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 0, BufferType 0x2, pvBuffer (nil) 002e:Call ntdll.RtlAllocateHeap(00010000,00000000,00000080) ret=7f1c611a498b 002e:Ret ntdll.RtlAllocateHeap() retval=0008b300 ret=7f1c611a498b 002e:trace:secur32:schan_push Wrote 75 bytes 002e:trace:secur32:schan_push Push 6 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 128, BufferType 0x2, pvBuffer 0x8b300 002e:trace:secur32:schan_push Wrote 6 bytes 002e:trace:secur32:schan_push Push 45 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 128, BufferType 0x2, pvBuffer 0x8b300 002e:trace:secur32:schan_push Wrote 45 bytes 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[get_last_packet]:1171 002e:trace:secur32:schan_pull Pull 5 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 3187, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_get_buffer No next buffer 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[_gnutls_io_read_buffered]:589 002e:trace:secur32:schan_imp_handshake Continue... ... 002e:Ret secur32.InitializeSecurityContextA() retval=00090312 ret=00467035 ... 002e:Call secur32.InitializeSecurityContextA(008f3710,008e5570,008f3570 "uup.rg-adguard.net",0000819c,00000000,00000000,0033ef70,00000000,00000000,0033ef80,0033ef6c,00000000) ret=00467035 002e:trace:secur32:InitializeSecurityContextA 0x8f3710 0x8e5570 "uup.rg-adguard.net" 0x0000819c 0 0 0x33ef70 0 (nil) 0x33ef80 0x33ef6c (nil) 002e:trace:secur32:schan_InitializeSecurityContextA 0x8a320 0x8a350 "uup.rg-adguard.net" 33180 0 0 0x33ef70 0 (nil) 0x33ef80 0x33ef6c (nil) ... 002e:trace:secur32:schan_InitializeSecurityContextW 0x8a320 0x8a350 L"uup.rg-adguard.net" 0x0000819c 0 0 0x33ef70 0 (nil) 0x33ef80 0x33ef6c (nil) 002e:trace:secur32:dump_buffer_desc Buffer desc 0x33ef70: 002e:trace:secur32:dump_buffer_desc buffer 0: cbBuffer 258, BufferType 0x2 pvBuffer 0x8e66c0 002e:trace:secur32:dump_buffer_desc buffer 1: cbBuffer 0, BufferType 0 pvBuffer (nil) 002e:trace:secur32:dump_buffer_desc Buffer desc 0x33ef80: 002e:trace:secur32:dump_buffer_desc buffer 0: cbBuffer 0, BufferType 0x2 pvBuffer (nil) 002e:trace:secur32:dump_buffer_desc buffer 1: cbBuffer 0, BufferType 0x11 pvBuffer (nil) 002e:trace:secur32:schan_InitializeSecurityContextW Using expected_size 258. 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[get_last_packet]:1171 002e:trace:secur32:schan_pull Pull 5 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 258, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 5 bytes 002e:trace:secur32:schan_pull Pull 202 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 258, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 202 bytes 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: NEW SESSION TICKET (4) was received. Length 198[198], frag offset 0, frag length: 198, sequence: 0 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: received session ticket 002e:trace:secur32:schan_pull Pull 5 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 258, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 5 bytes 002e:trace:secur32:schan_pull Pull 1 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 258, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 1 bytes 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: Cipher Suite: GNUTLS_ECDHE_RSA_AES_128_GCM_SHA256 002e:trace:secur32:schan_gnutls_log <3> ASSERT: buffers.c[get_last_packet]:1171 002e:trace:secur32:schan_pull Pull 5 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 258, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 5 bytes 002e:trace:secur32:schan_pull Pull 40 bytes 002e:trace:secur32:schan_get_buffer Using buffer 0: cbBuffer 258, BufferType 0x2, pvBuffer 0x8e66c0 002e:trace:secur32:schan_pull Read 40 bytes 002e:trace:secur32:schan_gnutls_log <4> HSK[0x7d673980]: FINISHED (20) was received. Length 12[12], frag offset 0, frag length: 12, sequence: 0 002e:trace:secur32:schan_imp_handshake Handshake completed 002e:Call ntdll.RtlFreeHeap(00010000,00000000,0008aea0) ret=7f1c611a3d55 002e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7f1c611a3d55 002e:Ret secur32.InitializeSecurityContextA() retval=00000000 ret=00467035 ... 002e:Call msvcrt.strlen(008f35a0 "WinTLS: Channel setup failed. Schannel provider did not fulfill requested flags. Excepted: 33180 Actual: 33052") ret=006b27b5 --- snip --- App source: https://github.com/aria2/aria2/blob/475e6c59970c95561ca9eb6b4a02fb54ec4a91f… --- snip --- static const ULONG kReqFlags = ISC_REQ_SEQUENCE_DETECT | ISC_REQ_REPLAY_DETECT | ISC_REQ_CONFIDENTIALITY | ISC_REQ_ALLOCATE_MEMORY | ISC_REQ_USE_SUPPLIED_CREDS | ISC_REQ_STREAM; static const ULONG kReqAFlags = ASC_REQ_SEQUENCE_DETECT | ASC_REQ_REPLAY_DETECT | ASC_REQ_CONFIDENTIALITY | ASC_REQ_EXTENDED_ERROR | ASC_REQ_ALLOCATE_MEMORY | ASC_REQ_STREAM; ... int WinTLSSession::tlsConnect(const std::string& hostname, TLSVersion& version, std::string& handshakeErr) { // Handshaking will require sending multiple read/write exchanges until the // handshake is actually done. The client will first generate the initial // handshake message, then write that to the server, read the response // message, and write and/or read additional messages until the handshake is // either complete and successful, or something went wrong. // The server works analog to that. A2_LOG_DEBUG("WinTLS: Starting/Resuming TLS Connect"); ULONG flags = 0; ... if (side_ == TLS_CLIENT) { SEC_CHAR* host = hostname_.empty() ? nullptr : const_cast<SEC_CHAR*>(hostname_.c_str()); status_ = ::InitializeSecurityContext(cred_, &handle_, host, kReqFlags, 0, 0, &indesc, 0, nullptr, &outdesc, &flags, nullptr); } else { status_ = ::AcceptSecurityContext( cred_, state_ == st_initialized ? nullptr : &handle_, &indesc, kReqAFlags, 0, state_ == st_initialized ? &handle_ : nullptr, &outdesc, &flags, nullptr); } ... // Need to read additional messages? if (status_ == SEC_I_CONTINUE_NEEDED) { A2_LOG_DEBUG("WinTLS: Continuing with handshake"); goto restart; } if (side_ == TLS_CLIENT && flags != kReqFlags) { A2_LOG_ERROR(fmt("WinTLS: Channel setup failed. Schannel provider did " "not fulfill requested flags. " "Excepted: %lu Actual: %lu", kReqFlags, flags)); status_ = SEC_E_INTERNAL_ERROR; state_ = st_error; return TLS_ERR_ERROR; } ... --- snip --- >From out flags missing: 'ISC_REQ_USE_SUPPLIED_CREDS' Wine source: https://source.winehq.org/git/wine.git/blob/HEAD:/include/sspi.h#l330 https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/secur32/schannel.c#l… $ sha1sum aria2_install.zip 105e5b3f46c482ded5b6cfa5ae94cd2af353b07a aria2_install.zip $ du -sh aria2_install.zip 4.0M aria2_install.zip $ wine --version wine-3.20-7-ga0a7090301 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 6

[Bug 33978] New: Bug in converting/rendering Windows Metafile (SetWinMetaFileBits etc.)
by wine-bugs＠winehq.org July 18, 2021

July 18, 2021

http://bugs.winehq.org/show_bug.cgi?id=33978 Bug #: 33978 Summary: Bug in converting/rendering Windows Metafile (SetWinMetaFileBits etc.) Product: Wine Version: 1.6-rc4 Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: gdi32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: pavelkok(a)gmail.com Classification: Unclassified Created attachment 45135 --> http://bugs.winehq.org/attachment.cgi?id=45135 input WMF-file I attached metafile (input.wmf) that is renders incorectly under Wine. It is Windows Metafile, not Enhanced Metafile. Bug exist in all programs that use WinApi (SetWinMetaFileBits etc.). I also tested this WMF file in IrfanView. I wrote sample program (wmf2bmp.exe) for demonstration. It renders/converts input WMF file to BMP and EMF files. No error/warnings during run (except irrelevant fixme:heap:HeapSetInformation). ~/build2/wine-git/wine --version wine-1.6-rc4-52-g9a0b434 Thanks for any help! -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 17

[Bug 24597] New: EEP5 crashes on startup
by wine-bugs＠winehq.org July 18, 2021

July 18, 2021

http://bugs.winehq.org/show_bug.cgi?id=24597 Summary: EEP5 crashes on startup Product: Wine Version: 1.1.32 Platform: x86-64 URL: http://www.eepshopping.de/index.php?view=program_detai l&ID_NODE_AKTIV=1&ID_PROGRAM=3078 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: debian(a)carbon-project.org Created an attachment (id=31062) --> (http://bugs.winehq.org/attachment.cgi?id=31062) Crash with Wine 1.3.0 EEP5, a train simulator (long name "Eisenbahn.exe Professional 5.0"), with patch 2 [0], crashes on every startup with the attached output. The output was generated by Wine 1.3.0 (packages from [1]), but the first version I tried was 1.1.32. The system is an otherwise unaltered Debian Squeeze 6.0. Please note that this is a report for a relative of mine and requests for further information may take a little bit longer than normal to process. Kind regards, Kai Wasserbäch [0] http://www.eepshopping.de/dskript_aktion_gratis.php?ID_PROGRAM_GRATIS=3431 [1] http://dev.carbon-project.org/debian/wine-unstable/ -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 9

[Bug 12703] New: SnagIt 8.x -- HTML-based functions not working on Wine 9. 60
by wine-bugs＠winehq.org July 18, 2021

July 18, 2021

http://bugs.winehq.org/show_bug.cgi?id=12703 Summary: SnagIt 8.x -- HTML-based functions not working on Wine 9.60 Product: Wine Version: 0.9.60 Platform: Other OS/Version: Linux Status: UNCONFIRMED Severity: enhancement Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: eric(a)mrrena.com As reported at http://appdb.winehq.org/objectManager.php?sClass=version&iId=5781&iTestingI…, the Text Tool, Callout Tool, and Option menu items do not function properly in SnagIt 8.2.3, in spite of nearly flawless performance otherwise. This may be related to the Gecko-rendering engine. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 20

[Bug 33502] New: SnagIt 8.x writes incomplete HKLM\\System\\CurrentControlSet\\Control\\Print\\Printers entry, causing loader failures for apps that depend on winspool.drv
by wine-bugs＠winehq.org July 18, 2021

July 18, 2021

http://bugs.winehq.org/show_bug.cgi?id=33502 Bug #: 33502 Summary: SnagIt 8.x writes incomplete HKLM\\System\\CurrentControlSet\\Control\\Print\\Print ers entry, causing loader failures for apps that depend on winspool.drv Product: Wine Version: 1.5.29 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello folks, split off from bug 12703 @Bruno --- quote --- The program still does not run. The error in console is: err:module:attach_process_dlls "winspool.drv" failed to initialize, aborting err:module:LdrInitializeThunk Main exe initialization for L"C:\\Program Files\\TechSmith\\SnagIt 8\\SnagIt32.exe" failed, status c0000005 I don't know how to circumvent that. --- quote --- It seems the app installs it's own printer but with incomplete data. Wine's builtin winspool.drv reads the registry data upon initialization. Unfortunately it doesn't expect incomplete entry, crashing in dll entry point. Nasty to debug. This also breaks all Wine builtin apps that have "winspool.drv" dependency ("winecfg", "notepad" etc.), failing them to start. --- snip --- ... 000d:Call PE DLL (proc=0x7dfc22d8,module=0x7dfa0000 L"winspool.drv",reason=PROCESS_ATTACH,res=0x1) 000d:Call KERNEL32.DisableThreadLibraryCalls(7dfa0000) ret=7dfc22b7 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7dfc22b7 000d:trace:winspool:load_cups 0x7d530240: libcups.so.2 loaded 000d:Call KERNEL32.CreateMutexW(00000000,00000001,7dfc3c00 L"__WINE_WINSPOOL_MUTEX__") ret=7dfa996b 000d:Ret KERNEL32.CreateMutexW() retval=0000007c ret=7dfa996b ... 000d:trace:winspool:WINSPOOL_EnumPrintersW Found 1 printers 000d:Call advapi32.RegEnumKeyW(00000080,00000000,0032f6b6,000000ff) ret=7dfb4771 000d:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7dfb4771 000d:trace:winspool:WINSPOOL_EnumPrintersW Printer 0 is L"SnagIt 8" 000d:Call advapi32.RegOpenKeyW(00000080,0032f6b6 L"SnagIt 8",0032f8b4) ret=7dfb4861 000d:Ret advapi32.RegOpenKeyW() retval=00000000 ret=7dfb4861 000d:Call advapi32.RegQueryValueExW(00000088,7dfc3462 L"Name",00000000,0032f604,0015c04c,0032f608) ret=7dfb2db5 000d:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7dfb2db5 000d:trace:winspool:WINSPOOL_GetStringFromReg L"Name": L"SnagIt 8" 000d:Call advapi32.RegQueryValueExW(00000088,7dfc34a8 L"Port",00000000,0032f604,0015c060,0032f608) ret=7dfb2db5 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7dfb2db5 000d:warn:winspool:WINSPOOL_GetStringFromReg Got ret = 2 000d:Call advapi32.RegQueryValueExW(00000088,7dfc32c0 L"Attributes",00000000,0032f604,0032f600,0032f608) ret=7dfa5a9a 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7dfa5a9a 000d:warn:winspool:get_dword_from_reg Got ret = 2 on name L"Attributes" 000d:Call advapi32.RegQueryValueExW(00000088,7dfc33d8 L"dnsTimeout",00000000,0032f604,0032f600,0032f608) ret=7dfa5a9a 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7dfa5a9a 000d:warn:winspool:get_dword_from_reg Got ret = 2 on name L"dnsTimeout" 000d:Call advapi32.RegQueryValueExW(00000088,7dfc35d8 L"txTimeout",00000000,0032f604,0032f600,0032f608) ret=7dfa5a9a 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7dfa5a9a 000d:warn:winspool:get_dword_from_reg Got ret = 2 on name L"txTimeout" 000d:Call advapi32.RegCloseKey(00000088) ret=7dfb4ae6 000d:Ret advapi32.RegCloseKey() retval=00000000 ret=7dfb4ae6 000d:Call advapi32.RegCloseKey(00000080) ret=7dfb4b07 000d:Ret advapi32.RegCloseKey() retval=00000000 ret=7dfb4b07 000d:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7dfa5219 ip=7dfa5219 tid=000d 000d:trace:seh:raise_exception info[0]=00000000 000d:trace:seh:raise_exception info[1]=00000000 000d:trace:seh:raise_exception eax=00000000 ebx=7dfcb154 ecx=00000005 edx=7dfc3680 esi=7ffdf000 edi=7ffd8000 000d:trace:seh:raise_exception ebp=0032f968 esp=0032f968 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010202 000d:trace:seh:call_stack_handlers calling handler at 0x7bc983b2 code=c0000005 flags=0 --- snip --- NOTE: no "Port" value. Source: http://source.winehq.org/git/wine.git/blob/f63d59d640f48f5c734e09c5f0c4e322… --- snip --- 1544 static void old_printer_check( BOOL delete_phase ) 1545 { 1546 PRINTER_INFO_5W* pi; 1547 DWORD needed, type, num, delete, i, size; 1548 const DWORD one = 1; 1549 HKEY key; 1550 HANDLE hprn; 1551 1552 EnumPrintersW( PRINTER_ENUM_LOCAL, NULL, 5, NULL, 0, &needed, &num ); 1553 if (GetLastError() != ERROR_INSUFFICIENT_BUFFER) return; 1554 1555 pi = HeapAlloc( GetProcessHeap(), 0, needed ); 1556 EnumPrintersW( PRINTER_ENUM_LOCAL, NULL, 5, (LPBYTE)pi, needed, &needed, &num ); 1557 for (i = 0; i < num; i++) 1558 { 1559 if (strncmpW( pi[i].pPortName, CUPS_Port, strlenW(CUPS_Port) ) && 1560 strncmpW( pi[i].pPortName, LPR_Port, strlenW(LPR_Port) )) 1561 continue; 1562 1563 if (open_printer_reg_key( pi[i].pPrinterName, &key )) continue; ... --- snip --- If the printer entry doesn't contain "Port" strncmpW() will cause a crash due to null pointer. Printer info members that are not present in registry are zero-initialized. Wine should be able to cope with incomplete data. $ du -sh SnagIt823.exe 14M SnagIt823.exe $ sha1sum SnagIt823.exe 6314a99f2378de9d072c174ea894d9697a08a546 SnagIt823.exe $ wine --version wine-1.5.29-38-g8e4317c Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 16

[Bug 23467] New: SnagIt: needs GdipEnumerateMetafileDestRect
by wine-bugs＠winehq.org July 18, 2021

July 18, 2021

http://bugs.winehq.org/show_bug.cgi?id=23467 Summary: SnagIt: needs GdipEnumerateMetafileDestRect Product: Wine Version: 1.2-rc5 Platform: x86 URL: http://download.techsmith.com/snagit/enu/910/snagit.ex e OS/Version: Linux Status: NEW Keywords: download Severity: minor Priority: P2 Component: gdiplus AssignedTo: wine-bugs(a)winehq.org ReportedBy: austinenglish(a)gmail.com It also hits an unimplemented function in rpcrt4, but I've sent a patch for that one already. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 8

[Bug 33503] New: SnagIt 9.x needs ole32.dll.CLSIDFromProgIDEx
by wine-bugs＠winehq.org July 18, 2021

July 18, 2021

http://bugs.winehq.org/show_bug.cgi?id=33503 Bug #: 33503 Summary: SnagIt 9.x needs ole32.dll.CLSIDFromProgIDEx Product: Wine Version: 1.5.29 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: ole32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello folks, as the summary says ... Reproduce: 1) start "SnagIt Editor" from main GUI using "Quick launch" 2) create new image 3) menu "send" -> "word" --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/TechSmith/Snagit 9 ... $ wine ./Snagit32.exe ... Unhandled exception: unimplemented function ole32.dll.CLSIDFromProgIDEx called in 32-bit code (0x7bc4d2da). Register dump: CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b EIP:7bc4d2da ESP:0033efc0 EBP:0033f024 EFLAGS:00000212( - -- I -A- - ) EAX:0033efcc EBX:7bcc89d0 ECX:0e040da8 EDX:0033f068 ESI:0e040da8 EDI:0e040d80 Stack dump: 0x0033efc0: 00010246 00680053 04146300 80000100 0x0033efd0: 00000001 00000000 7bc4d2da 00000002 0x0033efe0: 0dc8a566 0dc8a4e8 042ff6d8 042ff6d8 0x0033eff0: 00000000 000101de 0033f020 00000001 0x0033f000: 0e040da8 0e040d80 0033f038 7b827259 0x0033f010: 00000000 04146308 7b8265fd 7b827259 000c: sel=0067 base=00000000 limit=00000000 32-bit r-x Backtrace: =>0 0x7bc4d2da stub_entry_point+0x4b(dll="ole32.dll", name="CLSIDFromProgIDEx", ret_addr=0xdc429ca) [/home/focht/projects/wine/wine-git/dlls/ntdll/loader.c:197] in ntdll (0x0033f024) 1 0x03c3000f (0x0e040da8) 0x7bc4d2da stub_entry_point+0x4b [/home/focht/projects/wine/wine-git/dlls/ntdll/loader.c:197] in ntdll: subl $4,%esp 197 for (;;) RtlRaiseException( &rec ); ... 00000009 (D) C:\Program Files\TechSmith\Snagit 9\SnagitEditor.exe 00000048 0 00000064 -1 ... 0000004a 0 00000041 0 <== --- snip --- MSDN: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680113%28v=vs.85%… $ du -sh snagit.exe 28M snagit.exe $ sha1sum snagit.exe cedae34b59b5cfe7b3aa9f04a23dbd88c0f0e475 snagit.exe $ wine --version wine-1.5.29-100-ga0b4cd1 Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 33468] New: SnagIt 9 needs msvcr90.dll._mbstok_s
by wine-bugs＠winehq.org July 18, 2021

July 18, 2021

http://bugs.winehq.org/show_bug.cgi?id=33468 Bug #: 33468 Summary: SnagIt 9 needs msvcr90.dll._mbstok_s Product: Wine Version: 1.5.29 Platform: x86 URL: http://download.techsmith.com/snagit/enu/910/snagit.ex e OS/Version: Linux Status: NEW Keywords: download Severity: normal Priority: P2 Component: msvcrt AssignedTo: wine-bugs(a)winehq.org ReportedBy: 00cpxxx(a)gmail.com Blocks: 12703 Classification: Unclassified When trying to run the application this is printed in the console: wine: Call from 0x7b83c33b to unimplemented function msvcr90.dll._mbstok_s, aborting To reproduce just install the app using the 30 day evaluation and run Snagit32.exe. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 5

[Bug 33530] New: SnagIt 11.x editor tool crashes at startup on unimplemented function gdiplus.dll.GdipEnumerateMetafileDestPointI
by wine-bugs＠winehq.org July 18, 2021

July 18, 2021

http://bugs.winehq.org/show_bug.cgi?id=33530 Bug #: 33530 Summary: SnagIt 11.x editor tool crashes at startup on unimplemented function gdiplus.dll.GdipEnumerateMetafileDestPointI Product: Wine Version: 1.5.29 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: gdiplus AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello folks, as the summary says... Prerequisite: 'winetricks -q dotnet40 corefonts' --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/TechSmith/Snagit 11 ... wine ./SnagitEditor.exe ... wine: Call from 0x7b83aa5b to unimplemented function gdiplus.dll.GdipEnumerateMetafileDestPointI, aborting wine: Unimplemented function gdiplus.dll.GdipEnumerateMetafileDestPointI called at address 0x7b83aa5b (thread 0009), starting debugger... Unhandled exception: unimplemented function gdiplus.dll.GdipEnumerateMetafileDestPointI called in 32-bit code (0x7b83aa5b). Register dump: CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b EIP:7b83aa5b ESP:00324fe4 EBP:00325048 EFLAGS:00000283( - -- I S - - -C) EAX:7b826819 EBX:7b8b96b0 ECX:7ddc1571 EDX:0032500c ESI:00165220 EDI:100c7048 Stack dump: 0x00324fe4: 00325074 00000008 00325010 80000100 0x00324ff4: 00000001 00000000 7b83aa5b 00000002 0x00325004: 7ddc1520 7ddc1571 7dd9505f 100c7018 0x00325014: 00325058 00000000 00000000 00000000 0x00325024: 00000000 00000000 7ffdf000 00325050 0x00325034: 003250ac 00325098 7dd95e5c 0032505c 000c: sel=0067 base=00000000 limit=00000000 32-bit r-x Backtrace: ... 1 0x7ddc14b5 __wine_spec_unimplemented_stub+0x34(module="gdiplus.dll", function="GdipEnumerateMetafileDestPointI") [/home/focht/projects/wine/wine-git/dlls/winecrt0/stub.c:34] in gdiplus (0x00325084) 2 0x7dd731c1 __wine_stub_GdipEnumerateMetafileDestPointI+0x28() in gdiplus (0x00325110) 3 0x0058b301 in snagiteditor (+0x18b300) (0x00325110) --- snip --- 'winetricks gdiplus' works around. $ du -sh snagit.exe 65M snagit.exe $ sha1sum snagit.exe aaed9a649379744c07fe1256c32c62ba82600bce snagit.exe $ wine --version wine-1.5.29-122-g865d53d Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 9

[Bug 29358] New: Vit Registry Fix 9.5 crashes when clicking "close" button in "about" dialog
by wine-bugs＠winehq.org July 18, 2021

July 18, 2021

http://bugs.winehq.org/show_bug.cgi?id=29358 Bug #: 29358 Summary: Vit Registry Fix 9.5 crashes when clicking "close" button in "about" dialog Product: Wine Version: 1.3.34 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello, this is a bug split off from bug 7816 http://bugs.winehq.org/show_bug.cgi?id=7816#c16 --- quote --- It's also issue with http://www.vitsoft.org.ua/Download/Vit%20Registry%20Fix%20Free%20Edition%20… and Wine 1.3.19. Steps to reproduce: 1) start application 2) click "about" 3) close "about" window --- quote --- Both bugs have nothing in common - except the crashing apps are VB6 apps. The crash: --- snip --- 0023:Ret window proc 0x6605f626 (hwnd=0x3036e,msg=WM_LBUTTONUP,wp=00000000,lp=00020029) retval=00000000 0023:Ret user32.CallWindowProcA() retval=00000000 ret=016570cd 0023:trace:seh:raise_exception code=c0000005 flags=0 addr=0x1657117 ip=01657117 tid=0023 0023:trace:seh:raise_exception info[0]=00000001 0023:trace:seh:raise_exception info[1]=00000001 0023:trace:seh:raise_exception eax=00000000 ebx=6846a690 ecx=00000000 edx=00000000 esi=00000023 edi=01680458 0023:trace:seh:raise_exception ebp=0032f808 esp=0032f7f4 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010246 ... Backtrace: =>0 0x01657117 (0x0032f808) 1 0x6842f2d2 WINPROC_wrapper+0x19() in user32 (0x0032f838) 2 0x6842f427 call_window_proc+0xcd(hwnd=0x3036e, msg=0x202, wp=0, lp=0x20029, result=0x32f8b8, arg=0x1657050) [/home/focht/projects/wine/wine-git/dlls/user32/winproc.c:242] in user32 (0x0032f888) 3 0x68431876 CallWindowProcA+0x63(func=0x1657050, hwnd=0x3036e, msg=0x202, wParam=0, lParam=0x20029) [/home/focht/projects/wine/wine-git/dlls/user32/winproc.c:954] in user32 (0x0032f8c8) 4 0x7bc64852 call_entry_point+0x29() in ntdll (0x0032f8f8) 5 0x7bc64a7d relay_call+0x1bb(descr=0x6846f120, idx=0x50019, stack=0x32f95c) [/home/focht/projects/wine/wine-git/dlls/ntdll/relay.c:435] in ntdll (0x0032f948) 6 0x68387ee9 in user32 (+0x7ee8) (0x0032f9a8) 7 0x2b28bdee DefSubclassProc+0x16c(hWnd=0x3036e, uMsg=0x202, wParam=0, lParam=0x20029) [/home/focht/projects/wine/wine-git/dlls/comctl32/commctrl.c:1267] in comctl32 (0x0032f9a8) 8 0x2b310fac TOOLTIPS_SubclassProc+0x9b(hwnd=0x3036e, uMsg=0x202, wParam=0, lParam=0x20029, uID=0x1, dwRef=0x60372) [/home/focht/projects/wine/wine-git/dlls/comctl32/tooltips.c:2145] in comctl32 (0x0032f9e8) 9 0x2b28be44 DefSubclassProc+0x1c2(hWnd=0x3036e, uMsg=0x202, wParam=0, lParam=0x20029) [/home/focht/projects/wine/wine-git/dlls/comctl32/commctrl.c:1272] in comctl32 (0x0032fa38) 10 0x2b28bb7b COMCTL32_SubclassProc+0x134(hWnd=0x3036e, uMsg=0x202, wParam=0, lParam=0x20029) [/home/focht/projects/wine/wine-git/dlls/comctl32/commctrl.c:1214] in comctl32 (0x0032fa98) 11 0x6842f2d2 WINPROC_wrapper+0x19() in user32 (0x0032fac8) 12 0x6842f427 call_window_proc+0xcd(hwnd=0x3036e, msg=0x202, wp=0, lp=0x20029, result=0x32fc48, arg=0x2b28ba46) [/home/focht/projects/wine/wine-git/dlls/user32/winproc.c:242] in user32 (0x0032fb18) 13 0x684317b3 WINPROC_call_window+0x211(hwnd=0x3036e, msg=0x202, wParam=0, lParam=0x20029, result=0x32fc48, unicode=0, mapping=WMCHAR_MAP_DISPATCHMESSAGE) [/home/focht/projects/wine/wine-git/dlls/user32/winproc.c:908] in user32 (0x0032fb68) 14 0x683f434c DispatchMessageA+0x17d(msg=0x32fd10) [/home/focht/projects/wine/wine-git/dlls/user32/message.c:3742] in user32 (0x0032fc78) 15 0x7bc64852 call_entry_point+0x29() in ntdll (0x0032fc98) 16 0x7bc64a7d relay_call+0x1bb(descr=0x6846f120, idx=0x1009e, stack=0x32fcfc) [/home/focht/projects/wine/wine-git/dlls/ntdll/relay.c:435] in ntdll (0x0032fce8) 17 0x68388b01 in user32 (+0x8b00) (0x0032fd38) 18 0x6600a4a3 in msvbvm60 (+0xa4a2) (0x0032fd38) --- snip --- The VB6 app subclasses controls, installing its own window proc thunks... Convert hex opcodes to binary: --- snip --- 0023:Call oleaut32.VarBstrCat(0014f254 L"5589E583C4F85731C08945FC8945F8EB0EE80000000083F802742185C07424E830000000837DF800750AE838000000E84D0000005F8B45FCC9C21000E826000000EBF168000000006AFCFF7508E800000000EBE031D24ABF00000000B900000000E82D000000C3FF7514FF7510FF750CFF75086800000000E8000000008945FCC331D2BF00000000B900000000E801000000C3E33209",0049b38c L"C978078B450CF2AF75278D4514508D4510508D450C508D4508508D45FC508D45F85052B800000000508B00FF90A4070000C3",0032f4e4) ret=660e5f4d ... 0023:Call oleaut32.VarParseNumFromStr(0014e674 L"&H55",00000409,80000000,0032f4a0,0032f480) ret=660d31fd ... 0023:Call oleaut32.VarParseNumFromStr(01698094 L"&HC3",00000409,80000000,0032e75c,0032e73c) ret=660d31fd 0023:Ret oleaut32.VarParseNumFromStr() retval=00000000 ret=660d31fd ... --- snip --- Alloc heap memory for window proc thunk: 01657050-0x1657118 --- snip --- ... 0023:Call KERNEL32.GlobalAlloc(00000000,000000c8) ret=0081bf65 0023:Ret KERNEL32.GlobalAlloc() retval=01657050 ret=0081bf65 ... --- snip --- Set window proc: --- snip --- 0023:Call user32.SetWindowLongA(0003036e,fffffffc,01657050) ret=0081bf84 0023:trace:win:WIN_SetWindowLong 0x3036e -4 1657050 A 0023:trace:win:alloc_winproc allocated 0xffff006c for A 0x1657050 (109/4096 used) 0023:Ret user32.SetWindowLongA() retval=6605f626 ret=0081bf84 ... --- snip --- Filling thunk with code: --- snip --- 0023:Call ntdll.RtlMoveMemory(01657050,01665ba0,000000c8) ret=0081bfa7 0023:Ret ntdll.RtlMoveMemory() retval=01657050 ret=0081bfa7 ... --- snip --- Patch all intermodular calls --- snip --- 0023:Call ntdll.RtlMoveMemory(01657062,0032e770,00000004) ret=0081c825 0023:Ret ntdll.RtlMoveMemory() retval=01657062 ret=0081c825 ... 0023:Call ntdll.RtlMoveMemory(01657094,0032e7a4,00000004) ret=0081c89d 0023:Ret ntdll.RtlMoveMemory() retval=01657094 ret=0081c89d ... 0023:Call ntdll.RtlMoveMemory(0165709e,0032e770,00000004) ret=0081c825 0023:Ret ntdll.RtlMoveMemory() retval=0165709e ret=0081c825 ... 0023:Call ntdll.RtlMoveMemory(016570c4,0032e7a4,00000004) ret=0081c89d 0023:Ret ntdll.RtlMoveMemory() retval=016570c4 ret=0081c89d ... 0023:Call ntdll.RtlMoveMemory(016570c9,0032e770,00000004) ret=0081c825 0023:Ret ntdll.RtlMoveMemory() retval=016570c9 ret=0081c825 ... 0023:Call ntdll.RtlMoveMemory(0165710a,0032e7a4,00000004) ret=0081c89d 0023:Ret ntdll.RtlMoveMemory() retval=0165710a ret=0081c89d ... 0023:Call oleaut32.SysFreeString(016572bc L"5589E583C4F85731C08945FC8945F8EB0EE80000000083F802742185C07424E830000000837DF800750AE838000000E84D0000005F8B45FCC9C21000E826000000EBF168000000006AFCFF7508E800000000EBE031D24ABF00000000B900000000E82D000000C3FF7514FF7510FF750CFF75086800000000E8000000008945FCC331D2BF00000000B900000000E801000000C3E33209C"...) ret=660e60c0 ... --- snip --- Subclassing once more (old = 01657050, new = 2b28ba46)... --- snip --- 0023:Call user32.SetWindowLongA(0003036e,fffffffc,2b28ba46) ret=2b28b5d9 0023:trace:win:WIN_SetWindowLong 0x3036e -4 2b28ba46 A 0023:trace:win:alloc_winproc reusing 0xffff0069 for 0x2b28ba46 0023:Ret user32.SetWindowLongA() retval=01657050 ret=2b28b5d9 ... 0023:Call user32.CallWindowProcA(01657050,0003036e,00000055,00060372,00000003) ret=2b28bdee 0023:Call window proc 0x1657050 (hwnd=0x3036e,msg=WM_NOTIFYFORMAT,wp=00060372,lp=00000003) 0023:Call user32.CallWindowProcA(6605f626,0003036e,00000055,00060372,00000003) ret=016570cd 0023:Call window proc 0x6605f626 (hwnd=0x3036e,msg=WM_NOTIFYFORMAT,wp=00060372,lp=00000003) ... 0023:Call user32.CallWindowProcA(01657050,0003036e,00000046,00000000,0032ebc8) ret=2b28bdee 0023:Call window proc 0x1657050 (hwnd=0x3036e,msg=WM_WINDOWPOSCHANGING,wp=00000000,lp=0032ebc8) 0023:Call user32.CallWindowProcA(6605f626,0003036e,00000046,00000000,0032ebc8) ret=016570cd 0023:Call window proc 0x6605f626 (hwnd=0x3036e,msg=WM_WINDOWPOSCHANGING,wp=00000000,lp=0032ebc8) --- snip --- Destruction of windows/controls and restoration of old window proc: NOTE: the subclassed window proc thunk memory is released here! --- snip --- ... 0023:Call user32.SetWindowLongA(0003036e,fffffffc,6605f626) ret=0081c270 0023:trace:win:WIN_SetWindowLong 0x3036e -4 6605f626 A 0023:trace:win:alloc_winproc reusing 0xffff0028 for 0x6605f626 0023:Ret user32.SetWindowLongA() retval=2b28ba46 ret=0081c270 ... 0023:Call ntdll.RtlMoveMemory(016570ad,0032f0d8,00000004) ret=0081c89d 0023:Ret ntdll.RtlMoveMemory() retval=016570ad ret=0081c89d ... 0023:Call ntdll.RtlMoveMemory(016570d9,0032f0d8,00000004) ret=0081c89d 0023:Ret ntdll.RtlMoveMemory() retval=016570d9 ret=0081c89d ... 0023:Call KERNEL32.GlobalFree(01657050) ret=0081c2a6 0023:Ret KERNEL32.GlobalFree() retval=00000000 ret=0081c2a6 ... 0023:Ret window proc 0x6605f626 (hwnd=0x3036e,msg=WM_DESTROY,wp=00000000,lp=00000000) retval=00000000 0023:trace:win:WIN_DestroyWindow 0x3036e 0023:trace:msg:WINPROC_CallProcWtoA (hwnd=0x3036e,msg=WM_NCDESTROY,wp=00000000,lp=00000000) 0023:Call window proc 0x6605f626 (hwnd=0x3036e,msg=WM_NCDESTROY,wp=00000000,lp=00000000) ... 0023:Call user32.DefWindowProcA(0003036e,00000082,00000000,00000000) ret=6605d591 0023:Ret user32.DefWindowProcA() retval=00000000 ret=6605d591 0023:Ret window proc 0x6605f626 (hwnd=0x3036e,msg=WM_NCDESTROY,wp=00000000,lp=00000000) retval=00000000 0023:trace:win:dc_hook hDC = 0xc534, 1 0023:Ret user32.DestroyWindow() retval=00000001 ret=6605b4f6 --- snip --- How the thunk looks like (virtual addresses from another run = don't match with other trace snippets): --- snip --- 0165A040 55 PUSH EBP 0165A041 89E5 MOV EBP,ESP 0165A043 83C4 F8 ADD ESP,-8 0165A046 57 PUSH EDI ... 0165A0FF 8B00 MOV EAX,DWORD PTR DS:[EAX] 0165A101 FF90 A4070000 CALL DWORD PTR DS:[EAX+7A4] 0165A107 C3 RETN --- snip --- Memory dump while the thunk was intact (virtual addresses from another run = don't match with other trace snippets): --- snip --- 0165F780 000000C8 <len> 0165F784 00455355 USE <magic> 0165F788 83E58955 <window proc start> 0165F78C 3157F8C4 ... 0165F844 8B500000 0165F848 A490FF00 0165F84C C3000007 <window proc start end = ret opcode> 0165F850 00000071 <len> 0165F854 45455246 FREE <magic> 0165F858 001100E8 0165F85C 001100D8 0165F860 00000000 --- snip --- When the window proc memory chunk was marked free, the "c3" opcode = "ret" is overwritten which leads to the crash after returning from call "CALL DWORD PTR DS:[EAX+7A4]" (0165A101). A window/control hierarchy destruction sequence happens while in nested message handling for WM_LBUTTONUP ("about" dialog, tooltip). Either the nested message handling (COMCTL32_SubclassProc) has a bug or this might be an application bug which is hidden in Windows due to different heap management (ret opcode not immediately overwritten upon heap free operation, allowing the window proc to return to its caller). $ sha1sum "Vit Registry Fix Free Edition Setup.exe" 0319916dff8a57ab11a1796f3fff817379936fae Vit Registry Fix Free Edition Setup.exe $ wine --version wine-1.3.34-353-g6fe14a0 Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 8