November 2023 - Wine-Bugs - list.winehq.org

[Bug 47597] New: Game server can't connect with ssl/tls server
by wine-bugs＠winehq.org Aug. 20, 2026

Aug. 20, 2026

https://bugs.winehq.org/show_bug.cgi?id=47597 Bug ID: 47597 Summary: Game server can't connect with ssl/tls server Product: Wine Version: 4.11 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: crypt32 Assignee: wine-bugs(a)winehq.org Reporter: the7thcore(a)gmail.com Distribution: --- Created attachment 65011 --> https://bugs.winehq.org/attachment.cgi?id=65011 Clean prefix with corefonts vcrun2012 and dotnet472 I'm trying to get a net framework 4.7.2 based game server to work on linux with wine. The game does work and before the game devs implemented https there ware no issues. Now when they did implement https the game can't connect to the required server. Gnutls, openssl and libwbclient are installed. Log file below. If wine devs are interested, the game devs provided me with a small net framework application and it's source code that is based on the code in the game for testing. I am only permitted to send it through email and only to wine devs due to security reasons. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 13

[Bug 53445] New: crypt32:cert - testVerifyRevocation() sometimes fails on Windows due to the revocation server being offline?!
by WineHQ Bugzilla Aug. 20, 2026

Aug. 20, 2026

https://bugs.winehq.org/show_bug.cgi?id=53445 Bug ID: 53445 Summary: crypt32:cert - testVerifyRevocation() sometimes fails on Windows due to the revocation server being offline?! Product: Wine Version: unspecified Hardware: x86-64 OS: Windows Status: NEW Severity: normal Priority: P2 Component: crypt32 Assignee: wine-bugs(a)winehq.org Reporter: fgouget(a)codeweavers.com crypt32:cert - testVerifyRevocation() sometimes fails due to the revocation server being offline?! cert.c:4177: Test failed: got 80092013 cert.c:4178: Test failed: got 80092013 https://test.winehq.org/data/patterns.html#crypt32:cert So far this has only impacted Windows 10 (2022-06-27 and 2022-07-28). -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 2

[Bug 19660] New: Lotus Ami Pro 3.1 causes a page fault on load
by wine-bugs＠winehq.org Aug. 20, 2026

Aug. 20, 2026

http://bugs.winehq.org/show_bug.cgi?id=19660 Summary: Lotus Ami Pro 3.1 causes a page fault on load Product: Wine Version: 1.1.27 Platform: PC OS/Version: Linux Status: NEW Keywords: win16 Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: kennybobs(a)o2.co.uk Created an attachment (id=22942) --> (http://bugs.winehq.org/attachment.cgi?id=22942) Wine 1.1.27 console output Lotus Ami Pro 3.1 causes a page fault on load. 3 0x7ec726cf enum_font_callback+0xf5(plf=0x73daa8, ptm=0x73da44, fType=4, param=7593320) [/home/test/wine-git/dlls/gdi32/gdi16.c:219] in gdi32 (0x0073d7d8) 4 0x7ec9a5cd FONT_EnumInstance+0xfa(plf=0x73daa8, ptm=0x73da44, fType=4, lp=7593092) [/home/test/wine-git/dlls/gdi32/font.c:615] in gdi32 (0x0073d928) 5 0x7ecaf7c1 WineEngEnumFonts+0x511(plf=0x73dd0c, proc=0x7ec9a4d3, lparam=7593092) [/home/test/wine-git/dlls/gdi32/freetype.c:4143] in gdi32 (0x0073dc58) "winetricks allfonts" doesn't help. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

3 15

[Bug 15906] New: EnumFonts returns each font multiple times
by wine-bugs＠winehq.org Aug. 20, 2026

Aug. 20, 2026

http://bugs.winehq.org/show_bug.cgi?id=15906 Summary: EnumFonts returns each font multiple times Product: Wine Version: 1.1.5 Platform: PC-x86-64 URL: http://msdn.microsoft.com/en- us/library/ms533964(VS.85).aspx OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: gdi32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: goeran(a)uddeborg.se Created an attachment (id=17078) --> (http://bugs.winehq.org/attachment.cgi?id=17078) Test program executing EnumFonts() According to the documentation (see URL) the EnumFonts function returns one (random) font of each available typeface. The Wine implementation returns each typeface many times. As a test case I installed the typeface "Signet Roundhand" and ran the attached test program. Under indows it returns "Signet Roundhand" once. Under wine it returns it three times, with different values for lfCharSet and tmCharSet. I also copied the Arial font files from Windows (arial.ttf, ariali.ttf, arialbd.ttf, and arialbi.ttf) to my $HOME/.fonts directory. Under Windows, Arial is returned once with the test program. Under Wine it is returned ten(!) times. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

3 18

[Bug 32995] New: Attempts to copy text from Folio VIP 3.01 and paste into Libre Office causes Wine to crash
by wine-bugs＠winehq.org Aug. 19, 2026

Aug. 19, 2026

http://bugs.winehq.org/show_bug.cgi?id=32995 Bug #: 32995 Summary: Attempts to copy text from Folio VIP 3.01 and paste into Libre Office causes Wine to crash Product: Wine Version: unspecified Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: critical Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: hakimoerton(a)gmail.com Classification: Unclassified Created attachment 43589 --> http://bugs.winehq.org/attachment.cgi?id=43589 info from Wine following crash When attempting to paste text copied with Ctrl-c from Folio VIP 3.01 into Office Writer or Gedit text editor Wine crashes saying there is a problem with Winedvm.exe. The crashes happens every time in Wine but copy and paste into Open Office works fine on Windows XP. Only and immediately when Ctrl-V is pressed does the crash happen. Office then responds with "Requested clipboard format in not available". -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 9

[Bug 53464] New: conhost.exe:tty sometimes times out on Windows 10
by WineHQ Bugzilla Aug. 18, 2026

Aug. 18, 2026

https://bugs.winehq.org/show_bug.cgi?id=53464 Bug ID: 53464 Summary: conhost.exe:tty sometimes times out on Windows 10 Product: Wine Version: unspecified Hardware: x86-64 OS: Windows Status: NEW Severity: normal Priority: P2 Component: programs Assignee: wine-bugs(a)winehq.org Reporter: fgouget(a)codeweavers.com conhost.exe:tty sometimes times out on Windows 10: conhost.exe:tty start programs/conhost/tests/tty.c conhost.exe:tty:1734 done (258) in 120s https://test.winehq.org/data/patterns.html#conhost.exe:tty The timeouts are very frequent on Windows 10 1909 as per bug 51182. However they also happen on other Windows 10 versions like 2004 and 21H1 where they cannot be blamed on conhost.exe being a buggy early version. Adding more traces shows that the test gets stuck in test_read_console_control(). Depending on the run this happens in one of two locations: 1350: skip_sequence("\x1b[25l"); /* broken hide cursor */ tty.c:1370:4.047 Test succeeded tty.c:1373:4.047 Test succeeded tty.c:226:4.047 Test succeeded tty.c:1705:3.984 Test succeeded tty.c:1350:4.110 Test succeeded tty.c:603:4.tty.c:1602:4.047 Test 110 Test succeeded succeeded ttytty.c:60.c:6:4.110 T16est succeeded 04:4tty.c:.043477:4.110 Test succeeded Test succeeded tty.c:1245:4.110 Test succeeded conhost.exe:tty:1dbc done (258) in 120s 1406: skip_sequence("\x1b[?25l"); /* hide cursor */ tty.c:1647:6.578 Test succeeded tty.c:1650:tty.c6.578:140 Test5:6.6 succeeded87 Tes t succeeded tty.c:1405:6.687 Test succeeded tty.c:1405:6.687 Test succeeded tty.c:1405:6.687 Test succeeded tty.c:1406:6.687 Test succeeded tty.c:437:6.750 Test succeeded tty.c:1245:6.750 Test succeeded conhost.exe:tty:13d4 done (258) in 120s The traces are mangled because the main test process and the child process write to stdout at the same time. In all cases the last trace is from write_console_pipe(): 1245: ok(res, "WriteFile failed: %lu\n", GetLastError()); -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 5

[Bug 51182] New: test_write_console() fails in conhost:tty on Windows 1909
by WineHQ Bugzilla Aug. 18, 2026

Aug. 18, 2026

https://bugs.winehq.org/show_bug.cgi?id=51182 Bug ID: 51182 Summary: test_write_console() fails in conhost:tty on Windows 1909 Product: Wine Version: 6.8 Hardware: x86-64 OS: Windows Status: NEW Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: fgouget(a)codeweavers.com test_write_console() fails in conhost:tty on Windows 1909, probably because conhost.exe is broken in Windows 10 <= 2004: tty.c:581: Test failed: 0: expected "abc" got "\x1b[H \x1b[32m0\x1b[41m1\x1b[30m2\x1b[m\x1b[20X\x1b[20C\r\n\x1b[30X\x1b[30C\r\n\x1b[30X\x1b[30C\r\n abc \x1b[30ma\x1b[m\x1b[17X\x1b[17C\r\n child z\r\nz\x1b[29X\x1b[29C\r\n bo\x1b[30m\r\nxxx890\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\nx"... tty.c:586: Test failed: 0: expected " " got "\x1b[H \x1b[32m0\x1b[41m1\x1b[30m2\x1b[m\x1b[20X\x1b[20C\r\n\x1b[30X\x1b[30C\r\n\x1b[30X\x1b[30C\r\n abc \x1b[30ma\x1b[m\x1b[17X\x1b[17C\r\n child z\r\nz\x1b[29X\x1b[29C\r\n bo\x1b[30m\r\nxxx890\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\nx"... tty.c:587: Test failed: 0: expected "t" got "\x1b[H \x1b[32m0\x1b[41m1\x1b[30m2\x1b[m\x1b[20X\x1b[20C\r\n\x1b[30X\x1b[30C\r\n\x1b[30X\x1b[30C\r\n abc \x1b[30ma\x1b[m\x1b[17X\x1b[17C\r\n child z\r\nz\x1b[29X\x1b[29C\r\n bo\x1b[30m\r\nxxx890\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\nx"... tty.c:589: Test failed: expected empty buffer, got "\x1b[H \x1b[32m0\x1b[41m1\x1b[30m2\x1b[m\x1b[20X\x1b[20C\r\n\x1b[30X\x1b[30C\r\n\x1b[30X\x1b[30C\r\n abc \x1b[30ma\x1b[m\x1b[17X\x1b[17C\r\n child z\r\nz\x1b[29X\x1b[29C\r\n bo\x1b[30m\r\nxxx890\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\nx"... tty.c:593: Test failed: 0: expected "\rr abc tx" got "\x1b[m\rr abc tx\x1b[4;2H\x1b[?25h" tty.c:595: Test failed: 0: expected "\x1b[4;2H" got "\x1b[m\rr abc tx\x1b[4;2H\x1b[?25h" tty.c:596: Test failed: 0: expected "\x1b[?25h" got "\x1b[m\rr abc tx\x1b[4;2H\x1b[?25h" tty.c:597: Test failed: expected empty buffer, got "\x1b[m\rr abc tx\x1b[4;2H\x1b[?25h" tty.c:666: Test failed: Read file failed: 996 tty.c:666: Test failed: 0: expected "\x1b[11;29H" got "\x08\x1b[?25h" tty.c:667: Test failed: 0: expected "\x1b[?25h" got "\x08\x1b[?25h" tty.c:669: Test failed: expected empty buffer, got "\x08\x1b[?25h" tty.c:694: Test failed: 0: expected "\r\nc" got "\x1b[?25h" tty.c:706: Test failed: 0: expected "\x1b[40;29H" got "\r\nc\x1b[29X\x1b[29C\x1b[40;29H\x1b[?25h" tty.c:708: Test failed: expected empty buffer, got "\r\nc\x1b[29X\x1b[29C\x1b[40;29H\x1b[?25h" tty.c:729: Test failed: 0: expected "\n" got "\x1b[?25h" tty.c:730: Test failed: 0: expected "\x1b[30X" got "\x1b[?25h" tty.c:731: Test failed: 0: expected "\x1b[30C" got "\x1b[?25h" tty.c:732: Test failed: 0: expected "\r" got "\x1b[?25h" tty.c:741: Test failed: 0: expected "\x1b[12;29H" got "\r\n\x1b[Habcchild z\r\n123\x1b[27X\x1b[27C\r\ncde bo\x1b[30m\r\nxxx890\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\nxx5677\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\n902344\x1b[m\x1b[24X\x1b[24C\r\n xxx\x1b[24X\x1b[24C\r\n\x1b[30X\x1b[30C\r\n "... tty.c:746: Test failed: 0: expected "43\x08" got "\r\n\x1b[Habcchild z\r\n123\x1b[27X\x1b[27C\r\ncde bo\x1b[30m\r\nxxx890\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\nxx5677\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\n902344\x1b[m\x1b[24X\x1b[24C\r\n xxx\x1b[24X\x1b[24C\r\n\x1b[30X\x1b[30C\r\n "... tty.c:748: Test failed: expected empty buffer, got "\r\n\x1b[Habcchild z\r\n123\x1b[27X\x1b[27C\r\ncde bo\x1b[30m\r\nxxx890\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\nxx5677\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\n902344\x1b[m\x1b[24X\x1b[24C\r\n xxx\x1b[24X\x1b[24C\r\n\x1b[30X\x1b[30C\r\n "... tty.c:752: Test failed: 0: expected "\x08" got "43\x1b[12;29H\x1b[?25h" tty.c:756: Test failed: expected hide cursor escape tty.c:757: Test failed: 0: expected "23" got "43\x1b[12;29H\x1b[?25h" tty.c:759: Test failed: 0: expected "\x1b[12;29H" got "43\x1b[12;29H\x1b[?25h" tty.c:760: Test failed: 0: expected "\x1b[?25h" got "43\x1b[12;29H\x1b[?25h" tty.c:761: Test failed: expected empty buffer, got "43\x1b[12;29H\x1b[?25h" tty.c:789: Test failed: 0: expected "\x1b[28C" got "\x1b[Habcchild z\r\n123\x1b[27X\x1b[27C\r\ncde bo\x1b[30m\r\nxxx890\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\nxx5677\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\n902344\x1b[m\x1b[24X\x1b[24C\r\n xxx\x1b[24X\x1b[24C\r\n\x1b[30X\x1b[30C\r\n "... tty.c:791: Test failed: expected empty buffer, got "\x1b[Habcchild z\r\n123\x1b[27X\x1b[27C\r\ncde bo\x1b[30m\r\nxxx890\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\nxx5677\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\n902344\x1b[m\x1b[24X\x1b[24C\r\n xxx\x1b[24X\x1b[24C\r\n\x1b[30X\x1b[30C\r\n "... tty.c:862: Test failed: 0: expected "\x1b[21;29H" got "\x1b[Habcchild z\r\n123\x1b[27X\x1b[27C\r\ncde bo\x1b[30m\r\nxxx890\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\nxx5677\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\n902344\x1b[m\x1b[24X\x1b[24C\r\n xxx\x1b[24X\x1b[24C\r\n\x1b[30X\x1b[30C\r\n "... tty.c:864: Test failed: expected empty buffer, got "\x1b[Habcchild z\r\n123\x1b[27X\x1b[27C\r\ncde bo\x1b[30m\r\nxxx890\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\nxx5677\x1b[m\x1b[24X\x1b[24C\x1b[30m\r\n902344\x1b[m\x1b[24X\x1b[24C\r\n xxx\x1b[24X\x1b[24C\r\n\x1b[30X\x1b[30C\r\n "... These failures can be reproduced on cw-rx46-1909, wc-gtx560-1909 and the TestBot's w1064v1909: https://test.winehq.org/data/patterns.html#conhost.exe:tty They don't happen on Windows 10 1809 and lower because the test detects that conhost.exe is broken there: tty.c:1645: Tests skipped: Skipping tty output tests on broken Windows version And the test succeeds on Windows 10 >= 2004 (or rather has unrelated failures). So it looks like 1909 fell between the cracks and that the test should skip too somehow. This test was introduced by the commit below: commit 5d96c5aac883b343ddcfbe6f6b1b96ad6827a46b Author: Jacek Caban <jacek(a)codeweavers.com> AuthorDate: Fri Sep 11 14:31:24 2020 +0200 Commit: Alexandre Julliard <julliard(a)winehq.org> CommitDate: Fri Sep 11 16:55:40 2020 +0200 conhost/tests: Add WriteConsole tests. Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 6

[Bug 53465] New: conhost.exe:tty - test_tty_output() sometimes fails on Windows 10
by WineHQ Bugzilla Aug. 18, 2026

Aug. 18, 2026

https://bugs.winehq.org/show_bug.cgi?id=53465 Bug ID: 53465 Summary: conhost.exe:tty - test_tty_output() sometimes fails on Windows 10 Product: Wine Version: unspecified Hardware: x86-64 OS: Windows Status: NEW Severity: normal Priority: P2 Component: programs Assignee: wine-bugs(a)winehq.org Reporter: fgouget(a)codeweavers.com conhost.exe:tty - test_tty_output() sometimes fails on Windows 10. There are only three known failures spread across two similar failure modes: * 2022-07-27 w10pro64-pt-BR * 2022-07-27 w10pro64-mx-MX (mixed locale) tty.c:1051: Test failed: avail = 3 tty.c:1051: Test failed: expected empty buffer, got "\x1b[m" tty.c:1058: Test failed: 0: expected "\x1b[9;4H" got "\x1b[30m\x1b[9;4H5\x1b[4;3H\x1b[?25h" tty.c:1059: Test failed: 0: expected "5" got "\x1b[30m\x1b[9;4H5\x1b[4;3H\x1b[?25h" tty.c:1060: Test failed: 0: expected "\x1b[4;3H" got "\x1b[30m\x1b[9;4H5\x1b[4;3H\x1b[?25h" tty.c:1061: Test failed: 0: expected "\x1b[?25h" got "\x1b[30m\x1b[9;4H5\x1b[4;3H\x1b[?25h" tty.c:1062: Test failed: expected empty buffer, got "\x1b[30m\x1b[9;4H5\x1b[4;3H\x1b[?25h" * 2022-07-29 w10pro64-pt-BR tty.c:1055: Test failed: expected hide cursor escape tty.c:1057: Test failed: 0: expected "\x1b[30m" got "\x1b[25l\x1b[30m\x1b[9;4H5\x1b[4;3H\x1b[?25h" tty.c:1058: Test failed: 0: expected "\x1b[9;4H" got "\x1b[25l\x1b[30m\x1b[9;4H5\x1b[4;3H\x1b[?25h" tty.c:1059: Test failed: 0: expected "5" got "\x1b[25l\x1b[30m\x1b[9;4H5\x1b[4;3H\x1b[?25h" tty.c:1060: Test failed: 0: expected "\x1b[4;3H" got "\x1b[25l\x1b[30m\x1b[9;4H5\x1b[4;3H\x1b[?25h" tty.c:1061: Test failed: 0: expected "\x1b[?25h" got "\x1b[25l\x1b[30m\x1b[9;4H5\x1b[4;3H\x1b[?25h" tty.c:1062: Test failed: expected empty buffer, got "\x1b[25l\x1b[30m\x1b[9;4H5\x1b[4;3H\x1b[?25h" -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 5

[Bug 42233] New: wine 2.0 rc 5 apparent regression error in TES 4: oblivion
by wine-bugs＠winehq.org Aug. 18, 2026

Aug. 18, 2026

https://bugs.winehq.org/show_bug.cgi?id=42233 Bug ID: 42233 Summary: wine 2.0 rc 5 apparent regression error in TES 4: oblivion Product: Wine-staging Version: 2.0-rc5 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: jonathon.n.baker(a)gmail.com CC: erich.e.hoover(a)wine-staging.com, michael(a)fds-team.de, sebastian(a)fds-team.de Distribution: --- Created attachment 56878 --> https://bugs.winehq.org/attachment.cgi?id=56878 information output by terminal and the wine crash logging tool before and after program crash The video game Elder Scrolls 4: Oblivion is installed in a wine prefix which is shared with a steam installation and several other videogames. This prefix is run exclusively with the 64 bit version of wine. With the currently set dll overrides and winetricks modifications, and starting with a wine version of 2.0 rc2, wine has had no problems running this game. However, upon trying to run it after updating to 2.0 rc5, the game launches, loads the names of the companies and a disclaimer about other engine components they used, and then crashes prior to reaching the main menu. I have attached the full output of the wine process when this occurs. This regression is not present in the current wine-devel version. All other video games installed to this prefix still function with no errors. These games include: Fallout: New Vegas, Bioshock, Mass Effect 1, Mass Effect 2. I have installed several windows DLLs using winetricks, and several others were installed by steam during game installation. This is a list of installed DLLs (as listed by winetricks and winecfg) and their override settings (from winecfg), if set: winegstreamer: disabled d3dx10: disabled d3dx11: disabled d3dx9_43: native quartz: native devenum: builtin dmband: builtin dmcompos: builtin dmime: builtin dmload: builtin dmscript: builtin dmstyle: builtin dmsynth: builtin dmusic: builtin dmusic32: builtin dsound:builtin dswave: builtin streamci: builtin d3dx9: d3dx9_26 d3dx9_28 d3dx9_31 d3dx9_35 d3dx9_36 d3dx9_39 d3dx9_42 directmusic directx9 vcrun2008 xact xact_jun2010 xinput mwo was toggled a few times with winetricks, but is currently set to default behavior all of this was set manually, and no recipes were applied with winetricks I attempted to record more information about the crash at the direction of a user on the #winehq irc channel on freenode using the environment variable setting 'WINEDEBUG=+relay,+tid,+seh' however adding +relay changed program behavior from crashing to hanging. At that point, user told me to post bug here -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

3 11

[Bug 45104] New: OOB read in gdiplus
by wine-bugs＠winehq.org Aug. 18, 2026

Aug. 18, 2026

https://bugs.winehq.org/show_bug.cgi?id=45104 Bug ID: 45104 Summary: OOB read in gdiplus Product: Wine Version: 3.7 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: gdiplus Assignee: wine-bugs(a)winehq.org Reporter: robert.gawlik(a)rub.de Distribution: --- Original submitted report can be found here: https://bugs.launchpad.net/ubuntu/+source/wine/+bug/1764719 (*) Out-of-bounds read in dlls/gdiplus/metafile.c:2528 (last commit: dd2624a24fba400bf59b9396e496d16c43d399d9): The parameters data, dataSize and recordType are completely user controlled and flow into a memcpy() call in line 2528. If the length of data is less than dataSize, then this results in an out-of-bounds read. 2461 GpStatus WINGDIPAPI GdipPlayMetafileRecord(GDIPCONST GpMetafile *metafile, 2462 EmfPlusRecordType recordType, UINT flags, UINT dataSize, GDIPCONST BYTE *data) 2463 { .... 2471 2472 if (recordType >= 1 && recordType <= 0x7a) 2473 { 2474 /* regular EMF record */ 2475 if (metafile->playback_dc) 2476 { 2477 switch (recordType) 2478 { .... 2520 default: 2521 { 2522 ENHMETARECORD *record = heap_alloc_zero(dataSize + 8); // <== dataSize is completely user controlled 2523 2524 if (record) 2525 { 2526 record->iType = recordType; 2527 record->nSize = dataSize + 8; 2528 memcpy(record->dParm, data, dataSize); // <== data is user controlled, memcpy performs OOB read 2529 2530 if(PlayEnhMetaFileRecord(metafile->playback_dc, metafile->handle_table, 2531 record, metafile->handle_count) == 0) // (record is user controlled => source of many vulnerabilities) 2532 ERR("PlayEnhMetaFileRecord failed\n"); If you need more information (EMF trigger file, etc.) let me know! -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 13