[Bug 6775] Sony CD Architect 5.2 crashes on startup (msxml domdoc_createTextNode should access/treat input BSTR data as wide-character string)
http://bugs.winehq.org/show_bug.cgi?id=6775 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |NEW Component|-unknown |msxml3 Summary|blank menus in cdarchitect |Sony CD Architect 5.2 |5.2 |crashes on startup (msxml | |domdoc_createTextNode | |should access/treat input | |BSTR data as wide-character | |string) Ever Confirmed|0 |1 --- Comment #13 from Anastasius Focht <focht(a)gmx.net> 2012-05-01 16:17:56 CDT --- Hello, confirming the crash on startup. If you use 'winetricks msxml3' the application works fine, explanation follows. Prerequisite: 'winetricks -q mfc42' --- snip --- Unhandled exception: page fault on read access to 0x008da000 in 32-bit code (0xf7597533). Register dump: CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b EIP:f7597533 ESP:028bd2c8 EBP:028bd2f8 EFLAGS:00010202( R- -- I - - - ) EAX:008d9ffc EBX:f75fcff4 ECX:0044c6b9 EDX:028c8c40 ESI:028bd630 EDI:00000000 ... Backtrace: =>0 0xf7597533 __memcpy_ssse3_rep+0xd63() in libc.so.6 (0x028bd2f8) 1 0x7e6a545a SysAllocStringByteLen+0x6f(str="{", len=0x455355) [/home/focht/projects/wine/wine-git/dlls/oleaut32/oleaut.c:369] in oleaut32 (0x028bd2f8) 2 0x7e6f1527 VariantCopy+0x290(pvargDest=0x28bd468, pvargSrc=0x28bd560) [/home/focht/projects/wine/wine-git/dlls/oleaut32/variant.c:781] in oleaut32 (0x028bd368) 3 0x7e6f19b4 VariantCopyInd+0x1b9(pvargDest=0x28bd468, pvargSrc=0x28bd560) [/home/focht/projects/wine/wine-git/dlls/oleaut32/variant.c:871] in oleaut32 (0x028bd3f8) 4 0x7e6f20a5 VariantChangeTypeEx+0x2d8(pvargDest=0x28bd510, pvargSrc=0x28bd560, lcid=0x400, wFlags=0, vt=0x8) [/home/focht/projects/wine/wine-git/dlls/oleaut32/variant.c:1041] in oleaut32 (0x028bd4b8) 5 0x7e6f1dc2 VariantChangeType+0x49(pvargDest=0x28bd510, pvargSrc=0x28bd560, wFlags=0, vt=0x8) [/home/focht/projects/wine/wine-git/dlls/oleaut32/variant.c:982] in oleaut32 (0x028bd4f8) 6 0x7d084216 node_put_value+0x41(This=0x1d1048, value=0x28bd560) [/home/focht/projects/wine/wine-git/dlls/msxml3/node.c:289] in msxml3 (0x028bd538) 7 0x7d09e2dd domtext_put_data+0x9c(iface=0x1d1064, data="{CCAC7B28-CA5C-4520-ABBB-184524C01A51}") [/home/focht/projects/wine/wine-git/dlls/msxml3/text.c:617] in msxml3 (0x028bd588) 8 0x7d06961b domdoc_createTextNode+0x14e(iface=0x13fd3a4, data="{CCAC7B28-CA5C-4520-ABBB-184524C01A51}", text=0x28bd610) [/home/focht/projects/wine/wine-git/dlls/msxml3/domdoc.c:1614] in msxml3 (0x028bd5e8) 9 0x35c8ac6c in sfconfigmgr (+0x2ac6b) (0x013fc200) 10 0x00000001 (0x35c9e950) 11 0x35c628a0 in sfconfigmgr (+0x289f) (0x35c62940) 12 0x08244c8b (0x0c24448b) 0xf7597533 __memcpy_ssse3_rep+0xd63 in libc.so.6: repe movq 0x0(%eax),%mm0 --- snip --- There is a GUID-like string passed to domdoc_createTextNode(). The string is created as _wide_ character string within the application(!) Dump of string data: $+0 = (start) address of string passed through API --- snip --- $-4 00455355 $ ==> 0043007B {C $+4 00410043 CA $+8 00370043 C7 $+C 00320042 B2 $+10 002D0038 8- $+14 00410043 CA $+18 00430035 5C $+1C 0034002D -4 $+20 00320035 52 $+24 002D0030 0- $+28 00420041 AB $+2C 00420042 BB $+30 0031002D -1 $+34 00340038 84 $+38 00320035 52 $+3C 00430034 4C $+40 00310030 01 $+44 00350041 A5 $+48 007D0031 1} $+4C F7790000 $+50 006F0053 So $+54 0079006E ny --- snip --- At $-4 you see the heap magic "USE". This is a clear indication that this string is _not_ a BSTR. MSXML interface defines the string type to be BSTR. Wine code accesses it as such: SysStringByteLen -> return str ? *((DWORD*)str-1) : 0; You can imagine that 0x00455355 is not really suitable as length ;-) The real bug is in the application code. I debugged it and found no code path that actually makes use of BSTR allocation API (SysAllocXXX) for this parameter. Interestingly with native msxml3 override (winetricks) the application call to msxml to create a text node succeeds. An educated guess: for whatever reason the input string is not accessed as BSTR but as wide-character string, which avoids relying on garbage length ($-4). Source: http://source.winehq.org/git/wine.git/blob/e983db851888b900873153ce42921aee8... domdoc_createTextNode -> domtext_put_data ... This problem might apply to more methods that carry BSTR parameters but I think getting domdoc_createTextNode -> domtext_put_data to work with pure WCHAR* data should be ok. To not change much code down the call tree maybe a temporary "real" BSTR could be created as soon as possible from input "wide character" string. $ du -sh cdarchitect52d-trial_enu.exe 30M cdarchitect52d-trial_enu.exe $ sha1sum cdarchitect52d-trial_enu.exe 045cfb932746810b2bfb52594f31926be11ebb73 cdarchitect52d-trial_enu.exe $ wine --version wine-1.5.3-73-g93a0ca7 Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
wine-bugs＠winehq.org