[Bug 60039] New: Microsoft Office Word 2016 hangs after changing a Design style

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60039

            Bug ID: 60039
           Summary: Microsoft Office Word 2016 hangs after changing a
                    Design style
           Product: Wine
           Version: 11.13
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: msxml6
          Assignee: [e-mail]
          Reporter: [e-mail]
  Target Milestone: ---
      Distribution: ---

Created attachment 81492
  --> http://bugs.winehq.org/attachment.cgi?id=81492
+timestamp,+tid,+msxml,+ole,+seh,+loaddll

When running Microsoft Word 2016 in a Windows 7 Wine prefix, selecting a
different style from the Design tab and then opening the File tab causes Word
to hang indefinitely. Installing native MSXML6 with winetricks -q msxml6 avoids
the hang.

Adding a null check in xpath_parse_selection_namespaces() prevents Wine's
builtin MSXML implementation from dereferencing a null BSTR, which stops the
hang.

The failure is triggered by this call:

    trace:msxml:domdoc_setProperty ... L"SelectionNamespaces" ... {VT_BSTR:
(null)}

Wine passes the null BSTR to xpath_parse_selection_namespaces() in
dlls/msxml3/xpath.c, where it is dereferenced by:

    while (*ctxt.cur)

This produces the access violation and the subsequent loop of:

    err:msvcrt:_invalid_parameter (null):0 (null): (null) 0
    trace:seh:dispatch_exception code=c0000417 (unknown)

The application is using the SelectionNamespaces property to process Office XML
after the Design style change. Native MSXML treats a null BSTR as an empty
namespace declaration and returns successfully.

Steps to reproduce:

1. Run Word 2016 with builtin MSXML6.
2. Open a blank document.
3. Select the Design tab and apply another document style.
4. Select the File tab.
5. Word hangs and repeatedly prints _invalid_parameter messages.

The proposed fix is to return S_OK from xpath_parse_selection_namespaces() when
the input BSTR is null. A regression test for DOMDocument60 with VT_BSTR and
BSTR == NULL is included.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.