May 2026 - Wine-Bugs - list.winehq.org

[Bug 59718] New: d2d1: Three correctness issues in arc Bezier-approximation code (d2d_arc_to_bezier, d2d_figure_add_arc, d2d_arc_transform)
by WineHQ Bugzilla May 15, 2026

May 15, 2026

http://bugs.winehq.org/show_bug.cgi?id=59718 Bug ID: 59718 Summary: d2d1: Three correctness issues in arc Bezier-approximation code (d2d_arc_to_bezier, d2d_figure_add_arc, d2d_arc_transform) Product: Wine Version: 11.8 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: d2d Assignee: wine-bugs(a)list.winehq.org Reporter: nen24t(a)gmail.com Distribution: --- Code review of the arc Bezier-approximation code introduced in commits - `5d093518d71` ("d2d1: Implement arc approximation with Bezier segments.") — adds `d2d_arc_to_bezier()` and `d2d_figure_add_arc()` - `c34a09e285c` ("d2d1: Create a path internally for the geometry group.") — adds `d2d_arc_transform()` revealed three correctness issues. All three are present unchanged in `wine-11.8`. They are independent of each other but related (all three are in the arc-handling path), so I'm filing them as a single bug for convenience. Happy to split into three if preferred. ### Issue 1 — Uninitialized `points[0]` used as line endpoint in degenerate-radius case In `dlls/d2d1/geometry.c`: ```c static int d2d_arc_to_bezier(const D2D_POINT_2F *start_point, const D2D1_ARC_SEGMENT *arc, D2D_POINT_2F *points) { ... if (!d2d_arc_check_radius(rHalfChord2, fuzz2, &radius.x) || !d2d_arc_check_radius(rHalfChord2, fuzz2, &radius.y)) { return 0; /* points[] never written */ } ... } static bool d2d_figure_add_arc(struct d2d_figure *figure, const D2D1_ARC_SEGMENT *arc) { size_t last = figure->vertex_count - 1; D2D_POINT_2F points[12]; int count = 0; count = d2d_arc_to_bezier(&figure->vertices[last], arc, points); if (count > 0) return d2d_figure_add_beziers(figure, (D2D1_BEZIER_SEGMENT *)points, count); else if (count == 0) return d2d_figure_add_lines(figure, points, 1); /* points[0] is uninitialized */ return true; } ``` When `d2d_arc_to_bezier()` returns 0 (radius check failed), `points[]` is left uninitialized but the caller passes `points[0]` to `d2d_figure_add_lines()` as a line endpoint. Result: garbage line endpoint, undefined visual behavior. Reasonable fix would be to use `arc->point` (the arc's specified end point) as the line endpoint in the degenerate case — but the function signature doesn't currently expose `arc` to the caller of `d2d_figure_add_lines()`, so either `d2d_arc_to_bezier()` should write `arc->point` into `points[0]` before returning 0, or `d2d_figure_add_arc()` should pass `&arc->point` directly. --- ### Issue 2 — Typo in arc center transform: `m._12 * center.x` should be `m._12 * center.y` In `d2d_arc_to_bezier()` after computing the arc center: ```c m._31 = 0.5f * (arc->point.x + start_point->x); m._32 = 0.5f * (arc->point.y + start_point->y); if (!zero_center) { m._31 += (m._11 * center.x + m._12 * center.x); /* second term should be center.y */ m._32 += (m._21 * center.x + m._22 * center.y); /* this line is correct */ } ``` The first line uses `center.x` twice. The intended computation is the linear matrix-vector product `M * center`: ``` (_31, _32) += (M11 * cx + M12 * cy, M21 * cx + M22 * cy) ``` so the first line should be: ```c m._31 += (m._11 * center.x + m._12 * center.y); ``` Effect is invisible when `m._12 == 0` (i.e. `arc->rotationAngle == 0`), which is the most common case in UI rendering. Becomes visible for rotated arcs / rotated ellipse-segments, where the arc center will be displaced along the rotation axis. --- ### Issue 3 — `d2d_arc_transform()` contaminates radius vectors with translation component ```c static inline void d2d_arc_transform(D2D1_ARC_SEGMENT *arc, const D2D1_MATRIX_3X2_F *transform) { D2D_POINT_2F point; d2d_point_transform(&arc->point, transform, arc->point.x, arc->point.y); d2d_point_transform(&point, transform, arc->size.width, 0.0f); arc->size.width = d2d_point_length(&point); d2d_point_transform(&point, transform, 0.0f, arc->size.height); arc->size.height = d2d_point_length(&point); } ``` `d2d_point_transform()` applies the full affine transform including the `_31`/`_32` translation. For the arc endpoint (`arc->point`) that is correct. For the radius vectors `(width, 0)` and `(0, height)` it is wrong: those represent direction/length, not absolute positions, and should be transformed with the linear part only. Concretely, with a translation `(tx, ty)`: ``` transform of (width, 0) = (width * _11 + tx, width * _12 + ty) length(...) = sqrt((width*_11 + tx)^2 + (width*_12 + ty)^2) ``` The correct value is `sqrt((width*_11)^2 + (width*_12)^2) = width * sqrt(_11^2 + _12^2)`, the magnitude of the linear part only. Fix: compute the radius vectors relative to the transformed origin, e.g.: ```c static inline void d2d_arc_transform(D2D1_ARC_SEGMENT *arc, const D2D1_MATRIX_3X2_F *transform) { D2D_POINT_2F origin, w_axis, h_axis; d2d_point_transform(&origin, transform, 0.0f, 0.0f); d2d_point_transform(&w_axis, transform, arc->size.width, 0.0f); d2d_point_transform(&h_axis, transform, 0.0f, arc->size.height); d2d_point_transform(&arc->point, transform, arc->point.x, arc->point.y); arc->size.width = sqrtf((w_axis.x - origin.x) * (w_axis.x - origin.x) + (w_axis.y - origin.y) * (w_axis.y - origin.y)); arc->size.height = sqrtf((h_axis.x - origin.x) * (h_axis.x - origin.x) + (h_axis.y - origin.y) * (h_axis.y - origin.y)); } ``` Visible only for transformed paths (`ID2D1TransformedGeometry`, geometry-group internal stream) where the transform contains a non-zero translation — common for plugin host UIs with offset rendering layers. --- ## How to reproduce Each issue requires a different setup: - **Issue 1**: Build a path geometry with `AddArc()` whose start/end points are far apart but `arc->size.width` or `arc->size.height` is below the implementation's fuzz threshold (very thin arc). Render — random line endpoints will appear. - **Issue 2**: Use `AddArc()` with `rotationAngle != 0` (e.g. 30°) with a non-degenerate arc. Compare against native Direct2D in Windows — the arc center will be slightly displaced. - **Issue 3**: Wrap a path containing an arc in `ID2D1TransformedGeometry` with a transform that has both a non-trivial linear part *and* a translation. Stream the transformed geometry — the arc radius will be wrong. --- ## Affected versions `wine-11.0` through `wine-11.8`. All three issues are present unchanged across the range. ## Reporter context These came up while reviewing the 11.x → 12.0 rebase plan for an out-of-tree D2D1 patch series targeted at JUCE 8 / VSTGUI plugin compatibility. The plan adopts Sivov's Stream-Path + Bezier-Arc architecture as the upstream-compatible foundation, so we wanted to flag these issues before settling on it. References: - Fork: https://github.com/giang17/wine - Active branch: https://github.com/giang17/wine/tree/d2d1-dcomp-11.0 - Discussion thread: https://github.com/robbert-vdh/yabridge/issues/413 - Related earlier bug (DWrite text rendering): https://bugs.winehq.org/show_bug.cgi?id=59365 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 7

[Bug 53637] New: WinSCP UI rendering issue
by WineHQ Bugzilla May 15, 2026

May 15, 2026

https://bugs.winehq.org/show_bug.cgi?id=53637 Bug ID: 53637 Summary: WinSCP UI rendering issue Product: Wine Version: 7.16 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: comctl32 Assignee: wine-bugs(a)winehq.org Reporter: aros(a)gmx.com Distribution: --- Created attachment 73035 --> https://bugs.winehq.org/attachment.cgi?id=73035 WinSCP UI in Wine 7.16 See the attached screenshot. The white line at the bottom (in the file transfer log) shouldn't be white and it should be rendered properly (in Wine 7.16 it contains junk). -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 7

[Bug 59425] New: GXSCC crashes when a valid MIDI file is dragged in its window
by WineHQ Bugzilla May 15, 2026

May 15, 2026

http://bugs.winehq.org/show_bug.cgi?id=59425 Bug ID: 59425 Summary: GXSCC crashes when a valid MIDI file is dragged in its window Product: Wine Version: 11.0 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: -unknown Assignee: wine-bugs(a)list.winehq.org Reporter: 2990810561(a)qq.com Distribution: --- Created attachment 80390 --> http://bugs.winehq.org/attachment.cgi?id=80390 Archive of the backtrace when the mouse is released and the test midi file Steps to reproduce: 1. Fetch and install GXSCC from source: https://web.archive.org/web/20251114022838/https://meme.institute/gxscc/gxs… 2. Run GXSCC executable using Wine 11.0; 3. Download the test midi file provided in attachment, and drag it to GXSCC window; 4. GXSCC immediately crashes when mouse is released. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 11

[Bug 36484] New: Lotus Notes 8.x installer aborts with SAX parser exception (line breaks not preserved)
by wine-bugs＠winehq.org May 15, 2026

May 15, 2026

https://bugs.winehq.org/show_bug.cgi?id=36484 Bug ID: 36484 Summary: Lotus Notes 8.x installer aborts with SAX parser exception (line breaks not preserved) Product: Wine Version: 1.7.19 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: msxml3 Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Hello folks, continuation of bug 36228 As already said, the Java SAXParser still throws same exception as in bug 36228 --- snip --- ... 2014/05/18 19:46:46.452 SEVERE CWPPR0026E: The XML parser reported an exception at line number 17 and column number 1 when parsing the provisioning manifest. ::class.method=com.ibm.rcp.provisioning.internal.impl.ProvisioningServiceImpl.process() ::thread=Worker-0 ::loggername=com.ibm.rcp.provisioning org.xml.sax.SAXParseException: Attribute name "ur" associated with an element type "feature" must be followed by the ' = ' character. at org.apache.xerces.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source) at org.apache.xerces.util.ErrorHandlerWrapper.fatalError(Unknown Source) at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source) at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source) at org.apache.xerces.impl.XMLScanner.reportFatalError(Unknown Source) at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanAttribute(Unknown Source) at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanStartElement(Unknown Source) at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl$FragmentContentDispatcher.dispatch(Unknown Source) at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanDocument(Unknown Source) at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source) at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source) at org.apache.xerces.parsers.XMLParser.parse(Unknown Source) at org.apache.xerces.parsers.AbstractSAXParser.parse(Unknown Source) at org.apache.xerces.jaxp.SAXParserImpl$JAXPSAXParser.parse(Unknown Source) at org.apache.xerces.jaxp.SAXParserImpl.parse(Unknown Source) at com.ibm.rcp.provisioning.internal.impl.ProvisioningServiceImpl$3.run(Unknown Source) at org.eclipse.core.internal.jobs.Worker.run(Unknown Source) ... --- snip --- For reproducing one can short-circuit the whole thing by re-running on a failed install attempt as follows: --- snip --- wine "C:\\Program Files\\IBM\\Lotus\\Notes\\framework\\rcp\\rcplauncher.exe" -rcpLauncherWait -provManifest -noSplash -product NULL -provisioningOperation update -vmargs -verbose:class -verbose:jni -DprovisioningOperation=update -Drcp.system.admin=true -DprovUpdateSiteListOverride="file:/C:/users/focht/Temp/Lotus Notes/updateSite" --- snip --- Java VM args '-verbose:class -verbose:jni' were added for debugging purpose, they can be omitted. It seems the culprit is that Wine's msxml (re)generates an 'install.xml' file with line breaks not preserved/generated (linefeed/carriage return missing). Good one, each tag is separated by line break (seen in hex-editor with 0x0D,0A). --- snip --- <?xml version="1.0" encoding="ISO-8859-1"?>   <!-- ... <ibm-portal-composite><domain-object name="com.ibm.rcp.installmanifest"><object-data><install version="8.0.0.20080809.0430"><installfeature default="true" id="Platform.XPD" required="true" show="false" version="8.0.0.20080809.0430"><requirements><feature download-size="2188" id="com.ibm.langware.engine.feature" match="perfect" size="3464" url="jar:file:/C:/users/focht/Temp/Lotus Notes/updateSite.zip!/" version="6.1.2.200808010926"/> --- snip --- The XML file in question is already present with the installer at unpack time, located at 'C:\\users\\focht\\Temp\\Lotus Notes\\deploy\\install.xml' (with proper Windows line breaks). The file gets rewritten during install time, being smaller in the end with fewer feature-sets (ok) and line breaks lost (not ok). 'winetricks -q msxml3' works around. $ sha1sum C1K31EN.exe 5aac0feb578c471e65c0a24a3f5dceb719fd5760 C1K31EN.exe $ du -sh C1K31EN.exe 456M C1K31EN.exe $ wine --version wine-1.7.19 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

3 9

[Bug 59722] New: RemoveDirectoryW fails with ERROR_SHARING_VIOLATION after subprocess exit
by WineHQ Bugzilla May 15, 2026

May 15, 2026

http://bugs.winehq.org/show_bug.cgi?id=59722 Bug ID: 59722 Summary: RemoveDirectoryW fails with ERROR_SHARING_VIOLATION after subprocess exit Product: Wine Version: 11.8 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: kernel32 Assignee: wine-bugs(a)list.winehq.org Reporter: joel(a)airwebreathe.org.uk Distribution: --- Created attachment 80868 --> http://bugs.winehq.org/attachment.cgi?id=80868 reproducer.c (Found by AI testing) After a subprocess exits that had its current working directory set to a given directory, `RemoveDirectoryW()` on that directory fails with `ERROR_SHARING_VIOLATION` (error code 32). Wine does not properly release the directory handle that was used as the subprocess's CWD after the process terminates. On real Windows, removing the directory succeeds immediately after the subprocess exits. ## Impact on MSYS2 The MSYS2/Cygwin runtime maps `ERROR_SHARING_VIOLATION` to `EBUSY` (errno 16). Many MSYS2 test suite tests create a temporary directory, `fork()` + `exec()` a child process (which inherits the CWD), wait for the child to exit, then call `rmdir()` to clean up. Under Wine, this cleanup fails with `EBUSY`, causing the test harness to report failures even though the actual test logic passed. Affected tests include: | Test | Symptom | |------|---------| | fcntl07 | All 2 test cases PASS, but cleanup rmdir fails with EBUSY | | fcntl07B | Test case PASSES, but cleanup rmdir fails with EBUSY | ## Reproducer ``` x86_64-w64-mingw32-gcc -o reproducer.exe reproducer.c -lntdll wine reproducer.exe ``` ### Expected output (real Windows) ``` === Test 3: rmdir after subprocess with CWD in target dir === PASS: CreateDirectory PASS: RemoveDirectory after subprocess exit ``` ### Actual output (Wine 11.4) ``` === Test 3: rmdir after subprocess with CWD in target dir === PASS: CreateDirectory FAIL: RemoveDirectory after subprocess exit (GetLastError=32) Error: 32 ``` Error 32 is `ERROR_SHARING_VIOLATION`, indicating Wine still holds an internal reference to the directory after the subprocess has exited. ## Analysis When Wine creates a process with a CWD in a target directory, it opens a handle to that directory. When the process exits, Wine should close this handle so that the directory is no longer held open. Instead, the handle appears to leak or be released asynchronously, causing an immediate `RemoveDirectoryW` to hit a sharing violation. The underlying NT status is `STATUS_SHARING_VIOLATION`, which occurs because the directory still has an open handle without compatible sharing modes. ## Environment - Wine: 11.4 - Host: Linux x86_64 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 9

[Bug 59611] New: ExamDiff Pro Fileeditor blocks on end of file
by WineHQ Bugzilla May 15, 2026

May 15, 2026

http://bugs.winehq.org/show_bug.cgi?id=59611 Bug ID: 59611 Summary: ExamDiff Pro Fileeditor blocks on end of file Product: WineHQ.org Version: unspecified Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: minor Priority: P2 Component: www-unknown Assignee: wine-bugs(a)list.winehq.org Reporter: gerhard.muellner(a)gm.co.at Distribution: --- if Fileeditor is open e.g. after a directory compare and the cursor in one of both editor windows is moved to last line all seams blocked. i have to use "killall ExamDiff" and reopen then editor. other functions from ExamDiff are working. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 6

[Bug 59409] New: msvcrt: scanf scanset character ranges with high bytes (\x80-\xff) broken due to signed char comparison in scanf.h
by WineHQ Bugzilla May 15, 2026

May 15, 2026

http://bugs.winehq.org/show_bug.cgi?id=59409 Bug ID: 59409 Summary: msvcrt: scanf scanset character ranges with high bytes (\x80-\xff) broken due to signed char comparison in scanf.h Product: Wine Version: 11.2 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: msvcrt Assignee: wine-bugs(a)list.winehq.org Reporter: marco.bartoli.dev(a)gmail.com Distribution: --- Created attachment 80377 --> http://bugs.winehq.org/attachment.cgi?id=80377 repro The %[a-z]-style scanset range handling in scanf.h uses a signed comparison of format string characters, causing all ranges that include bytes above \x7f (e.g., %1[\x01-\xff]) to fail to match anything. This differs from native MSVCRT behavior and from other C libraries (glibc, etc) which handle this correctly. Affected code in dlls/msvcrt/scanf.h: ```c if (format[0] < format[2]) RtlSetBits(&bitMask, format[0], format[2] - format[0] + 1); else RtlSetBits(&bitMask, format[2], format[0] - format[2] + 1); ``` On x86/x64 chars are defined as signed so the comparison and subtractions needs to be handles with casting to unsigned char. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 3

[Bug 59746] New: SteelSeries GG 110.0 crashes on startup in .NET System.Security.Cryptography.X509Certificates.CertificateRequest..ctor
by WineHQ Bugzilla May 15, 2026

May 15, 2026

http://bugs.winehq.org/show_bug.cgi?id=59746 Bug ID: 59746 Summary: SteelSeries GG 110.0 crashes on startup in .NET System.Security.Cryptography.X509Certificates.Certific ateRequest..ctor Product: Wine Version: 11.8 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: crypt32 Assignee: wine-bugs(a)list.winehq.org Reporter: toadking(a)toadking.com Distribution: --- Created attachment 80925 --> http://bugs.winehq.org/attachment.cgi?id=80925 WINEDEBUG=trace+crypt trace New .NET 8.0 executable in SteelSeries GG 110.0 crashes on startup. It looks like the error happens in the X509Certificates assembly, specifically when calling into crypt32. Trace log with trace+crypt attached. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 3

[Bug 59028] New: Graphpad Prism 9: project (.pzfx) files cannot be saved if msxml6 is not installed
by WineHQ Bugzilla May 15, 2026

May 15, 2026

http://bugs.winehq.org/show_bug.cgi?id=59028 Bug ID: 59028 Summary: Graphpad Prism 9: project (.pzfx) files cannot be saved if msxml6 is not installed Product: Wine Version: 10.19 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)list.winehq.org Reporter: pachoramos1(a)gmail.com Distribution: --- Created attachment 79771 --> http://bugs.winehq.org/attachment.cgi?id=79771 output.txt Hello, I am coming from: https://bugs.winehq.org/show_bug.cgi?id=46568#c10 When I try to run Prism, I cannot save the project file except if I install msxml6 (in that case, I need to run wine-staging as it fixes bug #46568). The error I get looks a bit misleading: a Prism window gets opened saying that "There is not enough memory for normal operations. Please close other programs or exit Graphpad Prism..." I attach the wine command output while reproducing the problem... but I think that errors are not related with this issue (maybe they are more related with a rendering issue with the icons). Thanks -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 11

[Bug 59011] New: Wargaming Game Center Window not appearing / invisible
by WineHQ Bugzilla May 15, 2026

May 15, 2026

http://bugs.winehq.org/show_bug.cgi?id=59011 Bug ID: 59011 Summary: Wargaming Game Center Window not appearing / invisible Product: Wine Version: 10.16 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)list.winehq.org Reporter: luca+wine(a)thepixelhead.co Distribution: --- Created attachment 79750 --> http://bugs.winehq.org/attachment.cgi?id=79750 console output When starting WGC, only the tray icon appears, but no window. Even after clicking 'Open Game Center' in the context menu. Rendering the launcher unusable. Everything works fine again after downgrading wine to 10.15. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 4