July 2024 - Wine-Bugs - list.winehq.org

[Bug 51499] New: Assassin's Creed Rogue some textures have Normal Map effect
by WineHQ Bugzilla Sept. 18, 2026

Sept. 18, 2026

https://bugs.winehq.org/show_bug.cgi?id=51499 Bug ID: 51499 Summary: Assassin's Creed Rogue some textures have Normal Map effect Product: Wine Version: 6.13 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: directx-d3d Assignee: wine-bugs(a)winehq.org Reporter: andrey.goosev(a)gmail.com Distribution: --- Created attachment 70339 --> https://bugs.winehq.org/attachment.cgi?id=70339 example wine-6.13-30-g384fc71a480 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 2

[Bug 45104] New: OOB read in gdiplus
by wine-bugs＠winehq.org Sept. 18, 2026

Sept. 18, 2026

https://bugs.winehq.org/show_bug.cgi?id=45104 Bug ID: 45104 Summary: OOB read in gdiplus Product: Wine Version: 3.7 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: gdiplus Assignee: wine-bugs(a)winehq.org Reporter: robert.gawlik(a)rub.de Distribution: --- Original submitted report can be found here: https://bugs.launchpad.net/ubuntu/+source/wine/+bug/1764719 (*) Out-of-bounds read in dlls/gdiplus/metafile.c:2528 (last commit: dd2624a24fba400bf59b9396e496d16c43d399d9): The parameters data, dataSize and recordType are completely user controlled and flow into a memcpy() call in line 2528. If the length of data is less than dataSize, then this results in an out-of-bounds read. 2461 GpStatus WINGDIPAPI GdipPlayMetafileRecord(GDIPCONST GpMetafile *metafile, 2462 EmfPlusRecordType recordType, UINT flags, UINT dataSize, GDIPCONST BYTE *data) 2463 { .... 2471 2472 if (recordType >= 1 && recordType <= 0x7a) 2473 { 2474 /* regular EMF record */ 2475 if (metafile->playback_dc) 2476 { 2477 switch (recordType) 2478 { .... 2520 default: 2521 { 2522 ENHMETARECORD *record = heap_alloc_zero(dataSize + 8); // <== dataSize is completely user controlled 2523 2524 if (record) 2525 { 2526 record->iType = recordType; 2527 record->nSize = dataSize + 8; 2528 memcpy(record->dParm, data, dataSize); // <== data is user controlled, memcpy performs OOB read 2529 2530 if(PlayEnhMetaFileRecord(metafile->playback_dc, metafile->handle_table, 2531 record, metafile->handle_count) == 0) // (record is user controlled => source of many vulnerabilities) 2532 ERR("PlayEnhMetaFileRecord failed\n"); If you need more information (EMF trigger file, etc.) let me know! -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 16

[Bug 26758] New: Makefile system does not respect AS variable
by wine-bugs＠winehq.org Sept. 18, 2026

Sept. 18, 2026

http://bugs.winehq.org/show_bug.cgi?id=26758 Summary: Makefile system does not respect AS variable Product: Wine Version: 1.3.17 Platform: x86 OS/Version: All Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: cdavis(a)mines.edu As part of building Wine DLLs an executables, Winebuild generates assembly files that are then assembled. If an assembler is specified using --as-cmd, that program is used; otherwise the system assembler is used. Wine's build system, unfortunately, does not allow the user to set the assembler to pass to winebuild. The usual way to set the assembler to use is to set the AS variable, but the build system does not respect it. This is a problem, for example, on Mac OS X when building with Clang with its integrated assembler turned on. Clang's integrated assembler supports .cfi directives, but the system assembler doesn't. During configure, a test file containing .cfi directives is passed to the compiler, on the assumption that it would be then passed to the system assembler. With Clang's integrated assembler, this assumption is broken. Thus, when winebuild tries to assemble files containing .cfi directives (because it believes that the system assembler supported them), it fails as a result. A workaround is to tell winebuild to use Clang to assemble, but the Makefile system doesn't support that. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 6

[Bug 48078] New: Astro Avenger 2 fails to run with seh:setup_exception_record stack overflow
by WineHQ Bugzilla Sept. 18, 2026

Sept. 18, 2026

https://bugs.winehq.org/show_bug.cgi?id=48078 Bug ID: 48078 Summary: Astro Avenger 2 fails to run with seh:setup_exception_record stack overflow Product: Wine Version: 4.19 Hardware: x86-64 URL: https://astro-avenger.en.softonic.com/ OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: iodreamify(a)gmail.com Distribution: Ubuntu Created attachment 65628 --> https://bugs.winehq.org/attachment.cgi?id=65628 winedebug warn+all log Astro Avenger 2 manages to launch but clicking "Run" in the launcher makes the game freeze forever with a "002a:err:seh:setup_exception_record stack overflow 816 bytes in thread 002a eip 00ac1926 esp 00231000 stack 0x230000-0x231000-0x330000" error. Tried it both in 64bit and 32bit prefixes in windows 7, XP, 2000 and 98 modes and also disabling csmt.I've added a winedebug=warn+all log below. A demo 60 min trial can be found at the link above. I've also done a +relay log but i'm not sure if it's relevant. Thank you. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 6

[Bug 52621] New: Failed test of `alternate_success_code` from `windows-rs`
by WineHQ Bugzilla Sept. 18, 2026

Sept. 18, 2026

https://bugs.winehq.org/show_bug.cgi?id=52621 Bug ID: 52621 Summary: Failed test of `alternate_success_code` from `windows-rs` Product: Wine Version: 7.2 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: mikrutrafal(a)protonmail.com Distribution: --- This test pass on Windows 10 Failures ``` running 1 test test test ... FAILED failures: ---- test stdout ---- thread 'test' panicked at 'assertion failed: hr == CO_E_NOTINITIALIZED', crates\tests\alternate_success_c ode\tests\test.rs:9:5 note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace failures: test ``` Rust for Windows can be installed via https://forge.rust-lang.org/infra/other-installation-methods.html or directly https://static.rust-lang.org/dist/rust-1.59.0-x86_64-pc-windows-gnu.msi Steps to reproduce git clone https://github.com/microsoft/windows-rs.git cd windows-rs git checkout 9965e3c44829d0c86b2d9d2b3c5338376f158bde cd crates/tests/alternate_success_code/ wine cargo test -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 2

[Bug 52620] New: Failed test of `win32_arrays` from `windows-rs`
by WineHQ Bugzilla Sept. 18, 2026

Sept. 18, 2026

https://bugs.winehq.org/show_bug.cgi?id=52620 Bug ID: 52620 Summary: Failed test of `win32_arrays` from `windows-rs` Product: Wine Version: 7.2 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: mikrutrafal(a)protonmail.com Distribution: --- This test pass on Windows 10 Failures ``` failures: ---- keyboard_state stdout ---- thread 'keyboard_state' panicked at 'assertion failed: state != zeroed', crates\tests\win32_arrays\tests\ fixed.rs:9:9 note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace ---- temp_file stdout ---- thread 'temp_file' panicked at 'assertion failed: `(left == right)` left: `[46, 92, 116, 101, 115, 55, 98, 46, 116, 109, 112, 0]`, right: `[46, 92, 116, 101, 115, 55, 66, 46, 116, 109, 112, 0]`', crates\tests\win32_arrays\tests\fixed.r s:20:9 failures: keyboard_state temp_file ``` Rust for Windows can be installed via https://forge.rust-lang.org/infra/other-installation-methods.html or directly https://static.rust-lang.org/dist/rust-1.59.0-x86_64-pc-windows-gnu.msi Steps to reproduce git clone https://github.com/microsoft/windows-rs.git cd windows-rs cd crates/tests/win32_arrays/ wine cargo test -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 2

[Bug 53795] New: Emojis crash Naver LINE (and possibly all Qt applications)
by WineHQ Bugzilla Sept. 18, 2026

Sept. 18, 2026

https://bugs.winehq.org/show_bug.cgi?id=53795 Bug ID: 53795 Summary: Emojis crash Naver LINE (and possibly all Qt applications) Product: Wine Version: 7.19 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: gdi32 Assignee: wine-bugs(a)winehq.org Reporter: pq2sx44teeigl7za(a)chyen.cc Distribution: --- Created attachment 73289 --> https://bugs.winehq.org/attachment.cgi?id=73289 Source of a trivial Qt application to reproduce the issue Naver LINE (installer at [1]) crashes if I paste some kinds of emojis, like ???? (U+1F972) or ???? (U+1F970). Crashes happen with all kinds of text boxes, including username in the login dialog, search box and messaging dialog. Crash does not happen if I uninstalled the Noto Color Emoji font [2]. Without WINEDEBUG, crashes are intermittent. With WINEDEBUG=+font, I always get crashes. The issue can be reproduced with a trivial Qt application (source attached). The backtrace from a Qt 5.12.12 MinGW debug build [3] is also attached. >From the backtrace, Qt crashes when trying to get the string from otm->otmpFullName [4]. In a gdb session, the address (otm + otm->otmpFullName) points to an invalid address (needs to add otm per [5]). Apparently GetOutlineTextMetrics does not correctly assign that pointer. [1] https://desktop.line-scdn.net/win/new/LineInst.exe [2] https://archlinux.org/packages/extra/any/noto-fonts-emoji/ [3] https://download.qt.io/archive/qt/5.12/5.12.12/qt-opensource-windows-x86-5.… [4] https://github.com/qt/qtbase/blob/v5.12.12/src/platformsupport/fontdatabase… [5] https://learn.microsoft.com/en-us/windows/win32/api/wingdi/ns-wingdi-outlin… -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 6

[Bug 34774] New: Crimson Skies crashes when a mission ends
by wine-bugs＠winehq.org Sept. 18, 2026

Sept. 18, 2026

http://bugs.winehq.org/show_bug.cgi?id=34774 Bug #: 34774 Summary: Crimson Skies crashes when a mission ends Product: Wine Version: 1.7.4 Platform: x86-64 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: benpicco-wine(a)flauschlabor.de Classification: Unclassified Created attachment 46368 --> http://bugs.winehq.org/attachment.cgi?id=46368 Unhandled page fault on read access I've installed the game to a 32bit Windeprefix, installed quartz, Active Video and native amstream.dll and disabled winegstreamer so the game would launch. Everything works well, I can launch missions/instant action battles, but when they end and the game normally would go to a debriefing screen, it crashes instead. Last few lines of console output (abbreviated): fixme:dinput:LinuxInputEffectImpl_Download Could not upload effect. Assuming a disconnected device 45 "Invalid argument". fixme:dinput:joy_polldev joystick cannot handle type 21 event (code 1) fixme:dinput:LinuxInputEffectImpl_Download Could not upload effect. Assuming a disconnected device 45 "Invalid argument". fixme:dinput:LinuxInputEffectImpl_Download Could not upload effect. Assuming a disconnected device 45 "Invalid argument". wine: Unhandled page fault on read access to 0x06240000 at address 0x22022e0 (thread 0047), starting debugger... fixme:ole:RemUnknown_QueryInterface No interface for iid {00000019-0000-0000-c000-000000000046} -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

3 11

[Bug 51443] New: Test fails in remove_dir_all crate when creating file
by WineHQ Bugzilla Sept. 17, 2026

Sept. 17, 2026

https://bugs.winehq.org/show_bug.cgi?id=51443 Bug ID: 51443 Summary: Test fails in remove_dir_all crate when creating file Product: Wine Version: 6.12 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: mikrutrafal(a)protonmail.com Distribution: --- Hi, Steps to reproduce on clear wine-devel 6.12 ``` wget https://static.rust-lang.org/dist/rust-1.53.0-x86_64-pc-windows-gnu.msi msiexec /i rust-1.53.0-x86_64-pc-windows-gnu.msi git clone https://github.com/XAMPPRocky/remove_dir_all.git cd remove_dir_all git checkout 9b164cecdb4a0590af68be8b22f9c747402237e3 wine cargo test ``` should print this ``` running 4 tests test removes_read_only ... FAILED test removes_empty ... ok test removes_files ... ok test removes_dirs ... ok failures: ---- removes_read_only stdout ---- thread 'removes_read_only' panicked at 'called `Result::unwrap()` on an `Err` value: Os { code: 5, kind: PermissionDenied, message: "Access denied." }', tests\windows.rs:68:49 note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace failures: removes_read_only test result: FAILED. 3 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s error: test failed, to rerun pass '--test windows' ``` I tested it and this works fine in Windows Server 2019 Source code of failed test - https://github.com/XAMPPRocky/remove_dir_all/blob/9b164cecdb4a0590af68be8b2… ``` fn removes_read_only() { env_logger::init(); for i in 0..5 { let path = format!("./readonly/{}/subdir", i); fs::create_dir_all(&path).unwrap(); let file_path = format!("{}/file.txt", path); { let file = File::create(&file_path).unwrap(); ``` -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 5

[Bug 33126] New: divided SysEx and coalesced midiOutLongMsg
by wine-bugs＠winehq.org Sept. 16, 2026

Sept. 16, 2026

http://bugs.winehq.org/show_bug.cgi?id=33126 Bug #: 33126 Summary: divided SysEx and coalesced midiOutLongMsg Product: Wine Version: 1.5.25 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: winealsa.drv AssignedTo: wine-bugs(a)winehq.org ReportedBy: hoehle(a)users.sourceforge.net Classification: Unclassified Johannes Kroll reported in wine-patches that the KORG Kontrol Editor software hung after sending an ill-formed SysEx via winealsa's midiOutLongMsg. http://www.winehq.org/pipermail/wine-patches/2013-January/121335.html The MIDIHDR data is F0 ... F7 00 00 00 (125 bytes). http://www.winehq.org/pipermail/wine-devel/2013-February/098852.html He observed that no hang occurs when skipping the trailing 3 zero bytes. F7 is the "End Of SysEx" (EOX) marker. It is still unclear what happens. MIDI HW is expected to skip over bogus bytes, thus the zero bytes should cause no harm. OTOH, ALSA might be getting into trouble processing ill-formed messages, and we don't know if or how many bytes ALSA actually sent out through the serial port. In any case, midiOutLongMsg handling in Wine needs fixes. - winealsa should extract the F0...F7 part and send that as a SysEx. - More generally, midiOutLong is known to accept not only SysEx packets, but also coalesced status messages. Some MIDI authors prefer to send e.g. chords via one LongMsg rather than successive calls to midiOutShortMsg, arguing that it's faster. Hence all Wine MIDI drivers need to decompose midiOutLongMsg into packets consisting of status message, regular SysEx ... and possibly junk. - All APIs (MS, ALSA, OSS, CA) acknowledge the existence of divided SysEx. As a result, framing SysEx with F0 ... F7 is entirely under application control. The current winealsa framing code is simply wrong. - winecoreaudio always declared 3 bytes for short messages, even program change. I have written a sequence of patches to fix all of this. The only thing that is unclear is how to encapsulate garbage data like the above 3 zero bytes or real time messages with ALSA. What ALSA API function and what ALSA message type to use? Heck, I'm not even sure winealsa.drv/midi.c:modData is ok to send a 2-byte MTC quarter frame via snd_seq_ev_set_sysex instead of using a primitive that sets the type SND_SEQ_EVENT_CLOCK/TICK. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

3 5