[Bug 60252] New: fix wow64 type cast bug + use-after-free of the demuxer context in demuxer_destroy/demuxer_create
http://bugs.winehq.org/show_bug.cgi?id=60252 Bug ID: 60252 Summary: fix wow64 type cast bug + use-after-free of the demuxer context in demuxer_destroy/demuxer_create Product: Wine Version: unspecified Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: winegstreamer Assignee: wine-bugs@list.winehq.org Reporter: peter.soetens@gmail.com Target Milestone: --- Distribution: --- Created attachment 81965 --> http://bugs.winehq.org/attachment.cgi?id=81965 fixes the 3 crash sites I have been chasing a 'double/invalid free()' crash in WoW64, which did not occur in regular wine. That's the wrong type casting bug of the patch. This patch also fixes 2 demuxer cleanup bugs, but all 3 are basic/obvious memory management errors. Like, why the rust people are not giving us a break. Please apply it and release it. The code it touches is 100% broken. This is not cosmetic. Patch speaks for itself. Tested (before/after) and works for me. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60252 Ken Sharp <imwellcushtymelike@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|major |normal --- Comment #1 from Ken Sharp <imwellcushtymelike@gmail.com> --- Which Wine version? What app is causing this crash? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60252 --- Comment #2 from Rafał Mużyło <galtgendo@o2.pl> --- (In reply to Ken Sharp from comment #1)
Which Wine version?
What app is causing this crash?
Could we just call it 'current git head' and move on ? Likewise, exact app is irrelevant, when the code is obviously wrong. Cause he's right - this patch *does* speak for itself (even though it's parsed not quite correctly by bugzilla in the 'View' link). -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60252 Nikolay Sivov <bunglehead@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|winegstreamer |-unknown Version|unspecified |11.16 Status|UNCONFIRMED |NEW Ever confirmed|0 |1 --- Comment #3 from Nikolay Sivov <bunglehead@gmail.com> --- I've submitted the fix for that a day ago https://gitlab.winehq.org/wine/wine/-/merge_requests/11781 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60252 --- Comment #4 from Austin English <austinenglish@gmail.com> --- (In reply to Rafał Mużyło from comment #2)
(In reply to Ken Sharp from comment #1)
Which Wine version?
What app is causing this crash?
Could we just call it 'current git head' and move on ?
$ git describe works fine. Keep in mind that bugs are often read months/years later. It takes way less effort for the commenter to write the actual wine version than it does for someone to try to figure it out via git history after the fact. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60252 --- Comment #5 from Rafał Mużyło <galtgendo@o2.pl> --- (In reply to Austin English from comment #4)
(In reply to Rafał Mużyło from comment #2)
(In reply to Ken Sharp from comment #1)
Which Wine version?
What app is causing this crash?
Could we just call it 'current git head' and move on ?
$ git describe
works fine.
Keep in mind that bugs are often read months/years later. It takes way less effort for the commenter to write the actual wine version than it does for someone to try to figure it out via git history after the fact.
I'd say you have half a point there. I've said 'current git head', cause I've simply looked at gitlab to see if the code looks like the patch says it looks, not as in git part having any relevance. But if it took a couple months to pick up this thing (and sometimes it does take years), a point of reference is somewhat useful vs rechecking filing date against the list of git tags. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60252 Stian Low <wineryyyyy@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wineryyyyy@gmail.com --- Comment #6 from Stian Low <wineryyyyy@gmail.com> --- (In reply to Peter from comment #0)
I have been chasing a 'double/invalid free()' crash in WoW64, which did not occur in regular wine. That's the wrong type casting bug of the patch.
Context regarding winedmo is important for understanding why this bug has not been encountered/reported until now. winedmo seems to have been introduced around the time new wow64 was being worked/released so it may not have been fully fleshed at the time. winedmo also seems to have been introduced in support of Proton related work which delayed transition to wow64 until more stable. Now that wow64 is considered more stable, transition for some Proton projects has begun so more wow64 specific code may be found needing similar fixes. Given the amount of time/effort just for winedmo to be considered for approval for merge it's understandable why time may have been limited to only supporting most relevant parts vs risking wasting too much time if ultimately rejected.
Like, why the rust people are not giving us a break.
Languages supporting most breaks/liberty have their own advantages over restrictions otherwise considered safer and more helpful. Max slack of C vs rust is often conveniently appreciated despite some inconveniences elsewhere that balance for some cost/benefit preferences. (In reply to Rafał Mużyło from comment #2)
Likewise, exact app is irrelevant, when the code is obviously wrong.
Providing at least one example of an app broken may still useful regardless to reproduce since tests aren't yet available to verify before/after results. winedmo is still less common so providing a track record of how to use and reproduce results for specific apps may be useful for future folks to set expectations. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60252 Peter <peter.soetens@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #81965|0 |1 is obsolete| | --- Comment #7 from Peter <peter.soetens@gmail.com> --- Created attachment 81968 --> http://bugs.winehq.org/attachment.cgi?id=81968 proper patch using git format patch from HEAD Replaces previous (hand rolled from diff) patch. This comes from a git format patch on this tree: (base) kylo ~/wine-src(wow64-fix) $ git describe wine-11.10-1-g13778d8 Bug present since wine release 9.18: 3856633a is the unixlib.c bug: https://github.com/wine-mirror/wine/commit/3856633ab5f9ec95aeb5450546fdc077f... e9a9640e is the demuxer cleanup bug: https://github.com/wine-mirror/wine/commit/e9a9640e2eb692423209e5d2817fadfcc... Both introduced in 2024. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60252 --- Comment #8 from Peter <peter.soetens@gmail.com> --- The bug was surfaced by the Xwing Alliance Update 2025 project, which plays lots of videos during cut scenes. Trying to port this 32bit windows game to Linux, required WoW64 for memory pressure reasons. That crashed from time to time when playing a cut scene. Video was a H.264 High + AAC-LC in MP4. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60252 Nikolay Sivov <bunglehead@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #9 from Nikolay Sivov <bunglehead@gmail.com> --- This is fixed with 2110c64d89ccf90e7865031238456b5f20ed1066 and 1456cc0e6fe3bed089a409cf0cd56fa97d5d6919 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60252 Nikolay Sivov <bunglehead@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|fix wow64 type cast bug + |winedmo: Issue with demuxer |use-after-free of the |destructor logic |demuxer context in | |demuxer_destroy/demuxer_cre | |ate | -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60252 Alexandre Julliard <julliard@winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #10 from Alexandre Julliard <julliard@winehq.org> --- Closing bugs fixed in 11.17. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla