October 2020 - Wine-Bugs - list.winehq.org

[Bug 42731] New: stack overflow when .bat script variable has more than 256 characters
by wine-bugs＠winehq.org March 23, 2021

March 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=42731 Bug ID: 42731 Summary: stack overflow when .bat script variable has more than 256 characters Product: Wine Version: 2.3 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: lucianposton(a)gmail.com Distribution: --- Created attachment 57723 --> https://bugs.winehq.org/attachment.cgi?id=57723 bug demo When a variable with more than (roughly) 256 characters in a .bat script is passed as a parameter, the script fails with the following error: err:seh:setup_exception_record stack overflow 1408 bytes in thread 0009 eip 7bc4887d esp 00240db0 stack 0x240000-0x241000-0x340000 attached .bat file that demonstrates the bug -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 7

[Bug 49643] New: Calling ClipCursor too frequently can cause stack overflow in foreground window thread.
by WineHQ Bugzilla March 23, 2021

March 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=49643 Bug ID: 49643 Summary: Calling ClipCursor too frequently can cause stack overflow in foreground window thread. Product: Wine Version: 5.13 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: winex11.drv Assignee: wine-bugs(a)winehq.org Reporter: rbernon(a)codeweavers.com Distribution: --- Created attachment 67845 --> https://bugs.winehq.org/attachment.cgi?id=67845 Reproducing sample application Calling ClipCursor too frequently in a non-foreground thread may cause the foreground window thread to overflow its stack. This is happening under some circumstances with CoD: WWII. This is inherent to the current implementation where every ClipCursor request from a non-foreground thread involves synchronously sending internal messages to the foreground window thread, then to the desktop thread. Each ClipCursor request is processed when the desktop thread is notified, growing the stack every time, until it overflows. The attached program can be used to easily reproduce the issue. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 5

[Bug 49335] New: Dolphin EasyReader for Windows 6.04 (TTS app) crashes after completing startup wizard (needs IMarkupServices::CreateMarkupPointer method implementation)
by WineHQ Bugzilla March 23, 2021

March 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=49335 Bug ID: 49335 Summary: Dolphin EasyReader for Windows 6.04 (TTS app) crashes after completing startup wizard (needs IMarkupServices::CreateMarkupPointer method implementation) Product: Wine Version: 5.10 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: mshtml Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, continuation of bug 49062 Download: https://yourdolphin.com/downloads/product?demo=true&lid=1&pvid=9 https://web.archive.org/web/20200430183420/https://yourdolphin.com/download… Trace log: --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files (x86)/Dolphin/EasyReader604 $ WINEDEBUG=+seh,+relay,+mshtml,+ole,+variant wine ./Dolphin\ EasyReader.exe >>log.txt 2>&1 ... 0108:trace:variant:VariantClear (0031E58C {VT_BSTR: L"File open image"}) 0108:Ret oleaut32.VariantClear() retval=00000000 ret=0072c55a 0108:trace:mshtml:HTMLBodyElement_createTextRange (01D6AB70)->(0031E5E8) 0108:Call msvcrt.malloc(00000038) ret=661c3003 0108:Call ntdll.RtlAllocateHeap(0bc00000,00000000,00000038) ret=7ba7e2f8 0108:Ret ntdll.RtlAllocateHeap() retval=0f2c8370 ret=7ba7e2f8 0108:Ret msvcrt.malloc() retval=0f2c8370 ret=661c3003 0108:Call KERNEL32.GetLastError() ret=6ca5ce9f 0108:Ret KERNEL32.GetLastError() retval=00000000 ret=6ca5ce9f 0108:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=0301707b 0108:Ret ntdll.RtlAllocateHeap() retval=0357b348 ret=0301707b 0108:trace:mshtml:HTMLTxtRange_moveToElementText (0357B348)->(03575A9C) 0108:fixme:mshtml:MarkupServices_CreateMarkupPointer (01DEC718)->(0031E588) 0108:fixme:mshtml:MarkupServices_CreateMarkupPointer (01DEC718)->(0031E57C) 0108:fixme:mshtml:MarkupServices_MovePointersToRange (01DEC718)->(0357B358,00000000,00000000) 0108:trace:seh:raise_exception code=c0000005 flags=0 addr=0x72c669 ip=0072c669 tid=0108 0108:trace:seh:raise_exception info[0]=00000000 0108:trace:seh:raise_exception info[1]=00000000 0108:trace:seh:raise_exception eax=80004001 ebx=0031e458 ecx=0031e580 edx=00000000 esi=00000000 edi=0031e458 ... wine: Unhandled page fault on read access to 00000000 at address 0072C669 (thread 0108), starting debugger... ... --- snip --- Disassembly at crash site, annotated: --- snip --- ... 0072C5D8 | mov dword ptr ss:[ebp-10C],0 | 0072C5E2 | mov dword ptr ss:[ebp-108],0 | 0072C5EC | mov dword ptr ss:[ebp-F8],0 | 0072C5F6 | mov dword ptr ss:[ebp-104],0 | 0072C600 | lea edx,dword ptr ss:[ebp-F8] | 0072C606 | push edx | 0072C607 | mov eax,dword ptr ss:[ebp-18] | IMarkupPointer *pPointerStart 0072C60A | mov ecx,dword ptr ds:[eax] | 0072C60C | mov edx,dword ptr ss:[ebp-18] | 0072C60F | push edx | 0072C610 | mov eax,dword ptr ds:[ecx+C] | 0072C613 | call eax ; IMarkupServices::CreateMarkupPointer() 0072C615 | lea ecx,dword ptr ss:[ebp-104] | IMarkupPointer *pPointerFinish 0072C61B | push ecx | 0072C61C | mov edx,dword ptr ss:[ebp-18] | 0072C61F | mov eax,dword ptr ds:[edx] | 0072C621 | mov ecx,dword ptr ss:[ebp-18] | 0072C624 | push ecx | 0072C625 | mov edx,dword ptr ds:[eax+C] | 0072C628 | call edx ; IMarkupServices::CreateMarkupPointer() 0072C62A | mov eax,dword ptr ss:[ebp-104] | 0072C630 | push eax | IMarkupPointer *pPointerFinish 0072C631 | mov ecx,dword ptr ss:[ebp-F8] | 0072C637 | push ecx | IMarkupPointer *pPointerStart 0072C638 | mov edx,dword ptr ss:[ebp-98] | 0072C63E | push edx | IHTMLTxtRange *pIRange 0072C63F | mov eax,dword ptr ss:[ebp-18] | 0072C642 | mov ecx,dword ptr ds:[eax] | 0072C644 | mov edx,dword ptr ss:[ebp-18] | 0072C647 | push edx | 0072C648 | mov eax,dword ptr ds:[ecx+4C] | 0072C64B | call eax ; IMarkupServices::MovePointersToRange() 0072C64D | mov dword ptr ss:[ebp-100],0 | 0072C657 | lea ecx,dword ptr ss:[ebp-100] | 0072C65D | push ecx | 0072C65E | push dolphin easyreader.8D98A8 | 0072C663 | mov edx,dword ptr ss:[ebp-F8] | IMarkupPointer *pPointerStart 0072C669 | mov eax,dword ptr ds:[edx] | *boom* 0072C66B | mov ecx,dword ptr ss:[ebp-F8] | 0072C671 | push ecx | 0072C672 | mov edx,dword ptr ds:[eax] | 0072C674 | call edx | IMarkupPointer::QueryInterface() 0072C676 | cmp dword ptr ss:[ebp-100],0 | 0072C67D | je dolphin easyreader.72C6C1 | ... --- snip --- Wine source: https://source.winehq.org/git/wine.git/blob/3cc3b445752902e07231900befc296f… --- snip --- 4835 static HRESULT WINAPI MarkupServices_CreateMarkupPointer(IMarkupServices *iface, IMarkupPointer **ppPointer) 4836 { 4837 HTMLDocument *This = impl_from_IMarkupServices(iface); 4838 FIXME("(%p)->(%p)\n", This, ppPointer); 4839 return E_NOTIMPL; 4840 } --- snip --- Microsoft docs: * https://docs.microsoft.com/en-us/previous-versions/windows/internet-explore… ("Introduction to Markup Services") * https://docs.microsoft.com/en-us/previous-versions/windows/internet-explore… ("IMarkupServices interface") * https://docs.microsoft.com/en-us/previous-versions/windows/internet-explore… ("IMarkupContainer interface") $ sha1sum EasyReader_for_Windows_6.04_English_$United_Kingdom$_DEMO.exe 19d0911a8b05bb0966ce80e2c0e62c48cd039c2c EasyReader_for_Windows_6.04_English_(United_Kingdom)_DEMO.exe $ du -sh EasyReader_for_Windows_6.04_English_$United_Kingdom$_DEMO.exe 104M EasyReader_for_Windows_6.04_English_(United_Kingdom)_DEMO.exe $ wine --version wine-5.10 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 5

[Bug 44061] New: Destiny 2 crashes on launch
by wine-bugs＠winehq.org March 23, 2021

March 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=44061 Bug ID: 44061 Summary: Destiny 2 crashes on launch Product: Wine Version: 2.21 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: zombieff(a)gmail.com Distribution: ArchLinux Created attachment 59774 --> https://bugs.winehq.org/attachment.cgi?id=59774 Crash report shown by the app The game "Destiny 2" crashes on launch. It installs successfully via Blizzard client, but crashes on launch. There's a delay between "Launching" → "Ready to Launch" (not launched) → crashed with an error. Tested on Arch Linux. Wine version is wine-2.21 (Staging). Terminal output (app crash report is in the attachment): fixme:thread:create_user_shared_data_thread Creating user shared data update thread. fixme:heap:RtlSetHeapInformation (nil) 1 (nil) 0 stub fixme:crypt:CRYPT_LoadProvider Failed to load dll L"C:\\windows\\system32\\rsaenh.dll" fixme:seh:call_stack_handlers nested exception wine: Unhandled exception 0xc06d007e in thread 556 at address 0x7b450c67 (thread 0556), starting debugger... fixme:module:load_dll Loader redirect from L"uxtheme.dll" to L"uxtheme-gtk.dll" fixme:module:load_dll Loader redirect from L"uxtheme.dll" to L"uxtheme-gtk.dll" fixme:msg:pack_message msg 14 (WM_ERASEBKGND) not supported yet fixme:uxthemegtk:SetWindowTheme (0xf0054, (null), (null)) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 39

[Bug 49982] New: A '(call )' line does not reset %ERRORLEVEL% to 0
by WineHQ Bugzilla March 23, 2021

March 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=49982 Bug ID: 49982 Summary: A '(call )' line does not reset %ERRORLEVEL% to 0 Product: Wine Version: 5.18 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: cmd Assignee: wine-bugs(a)winehq.org Reporter: aa1ronham(a)gmail.com Distribution: --- The following batch script: ``` @echo off echo Initial error level: %errorlevel% call missing echo After bad call: %errorlevel% (call ) echo After empty call: %errorlevel% ``` gives the following output under Wine: ``` Initial error level: 0 Can't recognize 'missing' as an internal or external command, or batch script. After bad call: 1 After empty call: 1 ``` However, Windows 10 gives the following output: ``` Initial error level: 0 'missing' is not recognized as an internal or external command, operable program or batch file. After empty call: 1 After empty call: 0 ``` It looks like the Windows cmd.exe resets %errorlevel% to 0 after a '(call )' is executed, while Wine's cmd.exe leaves it unchanged. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 5

[Bug 49774] New: macDriver no longer functions within macOS VM
by WineHQ Bugzilla March 23, 2021

March 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=49774 Bug ID: 49774 Summary: macDriver no longer functions within macOS VM Product: Wine Version: 4.15 Hardware: x86-64 OS: Mac OS X Status: UNCONFIRMED Severity: normal Priority: P2 Component: winemac.drv Assignee: wine-bugs(a)winehq.org Reporter: gcenx83(a)gmail.com Regression SHA1: 792521f33b2786cb100cb202dcb4181a579ef3b3 Wine-4.14 macDriver would function within a macOS VM from Wine-4.15 that’s no longer the case. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 17

[Bug 49172] New: Always true condition `code > 0xffff` in vbscript/global.c
by WineHQ Bugzilla March 23, 2021

March 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=49172 Bug ID: 49172 Summary: Always true condition `code > 0xffff` in vbscript/global.c Product: Wine Version: 5.8 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: vbscript Assignee: wine-bugs(a)winehq.org Reporter: mikrutrafal54(a)gmail.com Distribution: --- code > 0xffff is always true - probably code > 0 should look like code < 0 https://github.com/wine-mirror/wine/blob/59987bc9ecdd0dbafd768a95c21a14884b… -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 6

[Bug 47570] New: FotoBizX - Installer throws backtrace
by wine-bugs＠winehq.org March 23, 2021

March 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=47570 Bug ID: 47570 Summary: FotoBizX - Installer throws backtrace Product: Wine Version: 4.11 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: maiktapwagner(a)aol.com Distribution: --- Created attachment 64971 --> https://bugs.winehq.org/attachment.cgi?id=64971 Backtrace (4.11 Staging) Hello everyone, I have been trying out FotoBizX which is a business software for photographers and agencies allowing invoices and quotes. There is a demo version available at: https://www.cradocfotosoftware.com/fotobiz/fotobiz-x-demo sha256sum installfotoBizX1005.exe 7f6bcc85413442e4fe4f61919a98e0fffbcef32f2d99272abec9fe0dec0adffd installfotoBizX1005.exe Will try to add an AppDB entry later on. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 9

[Bug 49309] New: vbscript:run test fails in Japanese locale
by WineHQ Bugzilla March 23, 2021

March 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=49309 Bug ID: 49309 Summary: vbscript:run test fails in Japanese locale Product: Wine Version: 5.9 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: vbscript Assignee: wine-bugs(a)winehq.org Reporter: madewokherd(a)gmail.com Distribution: --- For example: https://test.winehq.org/data/48020f4846cca1a02f4e1dc037e2cc2068df5e9c/linux… run.c:1877: Error in line 1585: 0 L"Invalid procedure call or argument" run.c:1891: Test failed: unexpected call OnScriptError run.c:2943: Test failed: expected global_success_d run.c:2944: Test failed: expected global_success_i run.c:2946: Test failed: parse_script failed: 800a0005 It seems that the call testAsc(Chr(255), 255) causes a runtime error when Asc is called with Chr(255). For some reason, on the Japanese locale, this Chr call gives us U+F8F3. It makes sense to get different results depending on encoding, but I don't understand why we get this one. Since this hasn't been observed on Windows, I assume this is a bug in Wine's vbscript and not the test. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 10

[Bug 38014] New: CCCP Insurgent v2007-01-01 crashes when querying system information via DxDiag
by wine-bugs＠winehq.org March 23, 2021

March 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=38014 Bug ID: 38014 Summary: CCCP Insurgent v2007-01-01 crashes when querying system information via DxDiag Product: Wine Version: 1.7.35 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, as the summary says. --- snip --- $ WINEDEBUG=+tid,+seh,+relay,+dxdiag,+variant,+ole wine ./CCCP-Insurgent-2007-01-01.exe >>log.txt 2>&1 ... 0024:trace:dxdiag:IDxDiagProviderImpl_GetRootContainer (0x1790a8,0x90e940) 0024:trace:dxdiag:DXDiag_CreateDXDiagContainer ({7d0f462f-4064-4862-bc7f-933e5058c10f}, 0x90e940) 0024:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7d3aabbc 0024:Ret ntdll.RtlAllocateHeap() retval=001829c8 ret=7d3aabbc 0024:trace:dxdiag:IDxDiagProviderImpl_AddRef (0x1790a8)->(ref before=1) 0024:trace:dxdiag:IDxDiagContainerImpl_AddRef (0x1829c8)->(ref before=0) 0024:trace:dxdiag:IDxDiagContainerImpl_GetChildContainer (0x1829c8, L"DxDiag_SystemInfo", 0x90e8f8) 0024:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7d3aa540 0024:Ret ntdll.RtlAllocateHeap() retval=00195b10 ret=7d3aa540 0024:trace:dxdiag:IDxDiagContainerImpl_GetChildContainer Trying to get container L"DxDiag_SystemInfo" 0024:Call KERNEL32.lstrcmpW(00179130 L"DxDiag_SystemInfo",00195b10 L"DxDiag_SystemInfo") ret=7d3aa413 0024:Ret KERNEL32.lstrcmpW() retval=00000000 ret=7d3aa413 0024:trace:dxdiag:DXDiag_CreateDXDiagContainer ({7d0f462f-4064-4862-bc7f-933e5058c10f}, 0x90e8f8) 0024:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7d3aabbc 0024:Ret ntdll.RtlAllocateHeap() retval=001958c8 ret=7d3aabbc 0024:trace:dxdiag:IDxDiagProviderImpl_AddRef (0x1790a8)->(ref before=2) 0024:trace:dxdiag:IDxDiagContainerImpl_AddRef (0x1958c8)->(ref before=0) 0024:trace:dxdiag:IDxDiagContainerImpl_GetChildContainer Succeeded in getting the container instance 0024:Call ntdll.RtlFreeHeap(00110000,00000000,00195b10) ret=7d3aa76f 0024:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7d3aa76f 0024:trace:dxdiag:IDxDiagContainerImpl_EnumChildContainerNames (0x1958c8, 0, 0x90e6d0, 256) 0024:trace:dxdiag:IDxDiagContainerImpl_EnumChildContainerNames Failed to find container name at specified index 0024:trace:dxdiag:IDxDiagContainerImpl_GetChildContainer (0x1958c8, L"", 0x90e8fc) 0024:Call ntdll.RtlAllocateHeap(00110000,00000000,00000002) ret=7d3aa540 0024:Ret ntdll.RtlAllocateHeap() retval=0018a4b8 ret=7d3aa540 0024:trace:dxdiag:IDxDiagContainerImpl_GetChildContainer Trying to get container L"" 0024:Call ntdll.RtlFreeHeap(00110000,00000000,0018a4b8) ret=7d3aa76f 0024:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7d3aa76f 0024:trace:dxdiag:IDxDiagContainerImpl_Release (0x1958c8)->(ref before=1) 0024:trace:dxdiag:IDxDiagProviderImpl_Release (0x1790a8)->(ref before=3) 0024:Call ntdll.RtlFreeHeap(00110000,00000000,001958c8) ret=7d3aa14d 0024:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7d3aa14d 0024:Call oleaut32.VariantInit(0090e6c0) ret=0040b276 0024:trace:variant:VariantInit (0x90e6c0) 0024:Ret oleaut32.VariantInit() retval=0090e6c0 ret=0040b276 0024:trace:seh:raise_exception code=c0000005 flags=0 addr=0x40b276 ip=0040b276 tid=0024 0024:trace:seh:raise_exception info[0]=00000000 0024:trace:seh:raise_exception info[1]=00000000 0024:trace:seh:raise_exception eax=0090e6c0 ebx=005659c8 ecx=0090e8d8 edx=0090ef8c esi=0090e928 edi=00000000 0024:trace:seh:raise_exception ebp=0090e740 esp=0090e6c0 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00210206 0024:trace:seh:call_stack_handlers calling handler at 0x5341e2 code=c0000005 flags=0 --- snip --- The app doesn't have proper error handling (HRESULT check), it just continues after failure of 'IDxDiagContainer::EnumChildContainerNames' on 'DxDiag_SystemInfo' container. The following 'IDxDiagContainer::GetChildContainer' method call gets an empty string passed. The app expects a valid 'IDxDiagContainer' instance - the current container. After fixing this there is another crash, albeit different issue ('DxDiag_SoundDevices' props missing). $ sha1sum CCCP-Insurgent-2007-01-01.exe 21a1171a7993aef75bcfc8304a09333c77bb32a2 CCCP-Insurgent-2007-01-01.exe $ du -sh CCCP-Insurgent-2007-01-01.exe 608K CCCP-Insurgent-2007-01-01.exe Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 12