[Bug 53795] New: Emojis crash Naver LINE (and possibly all Qt applications)
https://bugs.winehq.org/show_bug.cgi?id=53795 Bug ID: 53795 Summary: Emojis crash Naver LINE (and possibly all Qt applications) Product: Wine Version: 7.19 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: gdi32 Assignee: wine-bugs(a)winehq.org Reporter: pq2sx44teeigl7za(a)chyen.cc Distribution: --- Created attachment 73289 --> https://bugs.winehq.org/attachment.cgi?id=73289 Source of a trivial Qt application to reproduce the issue Naver LINE (installer at [1]) crashes if I paste some kinds of emojis, like ???? (U+1F972) or ???? (U+1F970). Crashes happen with all kinds of text boxes, including username in the login dialog, search box and messaging dialog. Crash does not happen if I uninstalled the Noto Color Emoji font [2]. Without WINEDEBUG, crashes are intermittent. With WINEDEBUG=+font, I always get crashes. The issue can be reproduced with a trivial Qt application (source attached). The backtrace from a Qt 5.12.12 MinGW debug build [3] is also attached.
From the backtrace, Qt crashes when trying to get the string from otm->otmpFullName [4]. In a gdb session, the address (otm + otm->otmpFullName) points to an invalid address (needs to add otm per [5]). Apparently GetOutlineTextMetrics does not correctly assign that pointer.
[1] https://desktop.line-scdn.net/win/new/LineInst.exe [2] https://archlinux.org/packages/extra/any/noto-fonts-emoji/ [3] https://download.qt.io/archive/qt/5.12/5.12.12/qt-opensource-windows-x86-5.1... [4] https://github.com/qt/qtbase/blob/v5.12.12/src/platformsupport/fontdatabases... [5] https://learn.microsoft.com/en-us/windows/win32/api/wingdi/ns-wingdi-outline... -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=53795 --- Comment #1 from yan12125 <pq2sx44teeigl7za(a)chyen.cc> --- Created attachment 73290 --> https://bugs.winehq.org/attachment.cgi?id=73290 Backtrace -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=53795 Jactry Zeng <jactry92(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://desktop.line-scdn.n | |et/win/new/LineInst.exe Keywords| |download -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=53795 daoxiang <15959866515@163.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |15959866515@163.com --- Comment #2 from daoxiang <15959866515@163.com> --- Created attachment 82118 --> http://bugs.winehq.org/attachment.cgi?id=82118 standalone probe source -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=53795 --- Comment #3 from daoxiang <15959866515@163.com> --- Created attachment 82119 --> http://bugs.winehq.org/attachment.cgi?id=82119 probe output -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=53795 --- Comment #4 from daoxiang <15959866515@163.com> --- Created attachment 82120 --> http://bugs.winehq.org/attachment.cgi?id=82120 in-process call trace -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=53795 --- Comment #5 from daoxiang <15959866515@163.com> --- Still reproducible on Wine 11.17, and the mechanism can now be measured from inside the failing process rather than inferred from a backtrace. Second application, independent of Naver LINE: **NetEase UU Remote 4.40.1** (`GameViewer.exe`, a Qt 5.15.12 shell). Under Wine 11.17 on Arch Linux, clicking "enter desktop" terminates it within 1-3 s, every time. The fault is the same one described here: ``` EXCEPTION 0xc0000005 at Qt5Core.dll+0xbf11b 0xbf0f0 = ?fromUtf16@QString@@SA?AV1@PEBGH@Z -> +0x2b is `cmp WORD PTR [rdx],cx` rdx = an unmapped pointer, different on every run ``` Hooking `GetOutlineTextMetricsW` inside the process shows what the two calls Qt makes actually return. Qt calls it twice -- once to size the buffer, once to fill it (`qwindows.dll+0x7041f` and `+0x7043a`): ``` [GetOutlineTextMetricsW] QUERY caller=qwindows+0x7041f cbData=0 otm=NULL -> ret=0 FAILED, face=[Noto Color Emoji] [GetOutlineTextMetricsW] FILL caller=qwindows+0x7043a cbData=0 otm=00007F0EDD83FCA0 -> ret=0 FAILED, face=[Noto Color Emoji] ``` So the query returns 0, Qt does not test it and calls `malloc(0)`, the fill writes nothing, and Qt then reads `otm->otmpFullName` out of that zero-size block and hands `otm + otmpFullName` to `QString::fromWCharArray(..., -1)`. The buffer pointer in the `FILL` line above is byte-for-byte the `rdi` observed at the crashing call, which is what pins the sequence. The font is the one already named in this report: **Noto Color Emoji**. It is a bitmap-only SFNT face, FreeType reports it as not scalable, and Wine consequently returns 0. Removing the font makes the crash disappear here as well. **There is a fix under review:** <https://gitlab.winehq.org/wine/wine/-/merge_requests/11388> ("win32u: Return outline metrics for bitmap-only SFNT fonts") reads `unitsPerEm` from the `head` table and builds `OUTLINETEXTMETRIC` for these faces. It is still a draft with no review, and it is not linked from this report, which is why the connection is worth making explicitly. Attached: a standalone probe that reproduces the protocol without any application (`uuyc-otmprobe.c`, build with `x86_64-w64-mingw32-gcc -O2 -o uuyc-otmprobe.exe uuyc-otmprobe.c -lgdi32`) and its full output. The probe runs Qt's exact two-call protocol over every font in a prefix and validates that the four name offsets land inside the buffer that was allocated; it can assert the post-fix behaviour for bitmap-only faces without a GUI. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (2)
-
WineHQ Bugzilla -
WineHQ Bugzilla