http://bugs.winehq.org/show_bug.cgi?id=60063 Bug ID: 60063 Summary: shell32: SHBrowseForFolder crashes when an application passes an invalid BROWSEINFO.pidlRoot Product: Wine Version: 11.14 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: shell32 Assignee: wine-bugs@list.winehq.org Reporter: commoncargo@tutanota.com Target Milestone: --- Distribution: --- Created attachment 81568 --> http://bugs.winehq.org/attachment.cgi?id=81568 Backtrace A 32-bit application crashes when it opens the shell folder browser dialog. The process dies with a page fault inside shell32. Cause: the application fills its BROWSEINFOW with a plain CSIDL value instead of an item id list in the pidlRoot field. Disassembling the caller shows the BROWSEINFOW being built with the constant 0x11 (CSIDL_DRIVES) in the pidlRoot slot, ulFlags = BIF_RETURNONLYFSDIRS|BIF_STATUSTEXT, followed by the call to SHBrowseForFolderW. So the mistake is on the application side, but Windows does not crash on it. Wine dereferences the value immediately in InitializeTreeView (ILClone -> ILGetSize) and faults, making the dialog unusable. Windows 10 behaviour: the dialog is created and the process survives. Verified with a conformance test built from the Wine tree and run in a Windows 10 VM; the dialog opens and closes normally. How to reproduce without the application: Add a test to dlls/shell32/tests/brsfolder.c that calls SHBrowseForFolderA with bi.pidlRoot = (LPCITEMIDLIST)CSIDL_DRIVES and a callback that posts IDOK on BFFM_INITIALIZED. On Wine the test process dies with the page fault above; on Windows 10 it runs to completion. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.