[Bug 60110] New: AiCube-ISP v6.96Z: crashes (stack overflow) when selecting MCU type from dropdown
http://bugs.winehq.org/show_bug.cgi?id=60110 Bug ID: 60110 Summary: AiCube-ISP v6.96Z: crashes (stack overflow) when selecting MCU type from dropdown Product: Wine Version: 11.14 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: comctl32 Assignee: wine-bugs@list.winehq.org Reporter: nong24@qq.com Target Milestone: --- Distribution: --- Created attachment 81664 --> http://bugs.winehq.org/attachment.cgi?id=81664 Terminal output from wine-staging 11.14 showing the stack overflow crash AiCube-ISP v6.96Z is a 32-bit MFC application (STC MCU ISP flashing tool). On Wine, it crashes with a stack overflow when selecting "AI8051U-34K64" from the MCU Type dropdown. Reproduction: 1. Download: https://www.stcaimcu.com/data/download/Tools/AiCube-ISP-v6.96Z.zip SHA1: 7197cf62a010fbc5b1191284113a4f3818438621 2. Install and run with Wine. A native mfc42.dll from Windows is needed (taken from Windows XP, SHA1: 0154c5ff2612780d70319d88a28a8e43db2e6b10) since Wine does not include an MFC implementation. 3. Select "AI8051U-34K64" from the MCU Type dropdown. 4. Wine crashes immediately with "Unhandled stack overflow". Confirmed on both wine-staging 11.14 and plain wine 11.14 (built from source). The bug is in upstream Wine's comctl32, not staging-specific. Root cause: Wine's DefSubclassProc (dlls/comctl32/commctrl.c) has no recursion limit. When a subclassed window procedure re-enters SetWindowText in response to WM_SETTEXT, the recursion continues unbounded until stack overflow. Windows bounds this recursion to about 15 levels. A conformance test is attached that reproduces the issue without requiring mfc42.dll or the application, using only Wine's comctl32 subclassing API. The test shows Wine reaches the recursion guard (50) while Windows bounds it (~15). Terminal outputs from both wine-staging and plain wine are attached, along with a screenshot showing the dropdown selection that triggers the crash. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60110 --- Comment #1 from nong24@qq.com --- Created attachment 81665 --> http://bugs.winehq.org/attachment.cgi?id=81665 Terminal output from plain wine 11.14 (built from source) showing the same crash -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60110 nong24@qq.com changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://www.stcaimcu.com/da | |ta/download/Tools/AiCube-IS | |P-v6.96Z.zip Keywords| |download -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60110 --- Comment #2 from nong24@qq.com --- Created attachment 81666 --> http://bugs.winehq.org/attachment.cgi?id=81666 Conformance test for comctl32 subclass recursion depth limit -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60110 --- Comment #3 from nong24@qq.com --- Created attachment 81667 --> http://bugs.winehq.org/attachment.cgi?id=81667 Screenshot showing the MCU Type dropdown selection that triggers the crash -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60110 --- Comment #4 from nong24@qq.com --- Created attachment 81668 --> http://bugs.winehq.org/attachment.cgi?id=81668 comctl32_test subclass output on Wine showing recursion depth 50 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60110 Ken Sharp <imwellcushtymelike@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Ever confirmed|0 |1 Status|UNCONFIRMED |NEW --- Comment #5 from Ken Sharp <imwellcushtymelike@gmail.com> --- Confirming with Wine 11.14, though: 1. I get a hang, not a crash. 2. Using WINEARCH=win32 the app immediately hangs on load. So could be a couple of issues here, though I suspect a fix for 1 would fix 2. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60110 --- Comment #6 from Ken Sharp <imwellcushtymelike@gmail.com> --- Ah, in case 2 it does eventually wake up, though the end result is the same. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60110 --- Comment #7 from Ken Sharp <imwellcushtymelike@gmail.com> --- It looks like the app needs ODBC, try installing/building with that and see if the crash stops. I still get the following like you, however: 0024:err:virtual:virtual_setup_exception stack overflow 1344 bytes addr 0x7bd081e7 stack 0x230ac0 (0x230000-0x231000-0x330000) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60110 --- Comment #8 from nong24@qq.com --- Created attachment 81680 --> http://bugs.winehq.org/attachment.cgi?id=81680 winedbg first-chance backtrace showing unbounded WM_SETTEXT/DefSubclassProc recursion (140+ levels) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60110 --- Comment #9 from nong24@qq.com --- (In reply to Ken Sharp from comment #7) Thanks for looking into this. To address your points: **1. hang vs crash** You're right — the app hangs, it doesn't crash/exit. The process stays alive (pgrep finds it, pkill kills it). The "Unhandled stack overflow" in the terminal output from the original report is a Wine-internal log event; the process itself doesn't terminate. So your observation of a hang matches mine. **2. ODBC** The "err:winediag:load_odbc failed to open library libodbc.so" message is a red herring. I checked: - The app's own import table does NOT import odbc32.dll. Its imports are: MFC42, MSVCRT, KERNEL32, USER32, GDI32, comdlg32, ADVAPI32, SHELL32, COMCTL32, ole32, OLEPRO32, OLEAUT32, VERSION, SETUPAPI, HID, SHLWAPI, iphlpapi, gdiplus, WS2_32. - The native mfc42.dll (required by the app) statically imports odbc32.dll. This is what causes odbc32.dll to be loaded and the winediag message to appear. - A WINEDEBUG=+loaddll,+odbc run shows odbc32.dll loaded once at startup (DllMain only), then zero SQL* function calls throughout the entire session — including at the point where the hang occurs. Installing ODBC (unixODBC or via winetricks mdac28) would only silence the winediag message; it should not change the hang. **3. Root cause: confirmed via winedbg backtrace** I ran the app under winedbg with BreakOnFirstChance enabled and caught the EXCEPTION_STACK_OVERFLOW (0xc00000fd) at first chance, before mfc42's SEH handler could intercept it. The backtrace (attached) shows unbounded re-entrant recursion through the comctl32 subclassing chain. The repeating cycle is: SetWindowTextA(hwnd, "0000") -> SendMessageA(hwnd, WM_SETTEXT) [msg=0xc] -> COMCTL32_SubclassProc -> DefSubclassProc -> TOOLTIPS_SubclassProc -> DefSubclassProc -> CallWindowProcW -> EDIT_WindowProc -> EDIT_WM_SetText -> notify_parent(EN_UPDATE) [msg=0x111] -> mfc42 WndProc -> SetWindowTextA(...) [re-enter] This cycle repeats ~140 times (each cycle consumes 7392 bytes of stack; 1MB stack exhausted at ESP=0x231ee8). The overflow triggers in WINPROC_CallProcWtoA (user32/winproc.c). The full winedbg session is attached as "winedbg_backtrace_60110.txt". Key frames from the backtrace: frame 58: SetWindowTextA(hwnd=000100C0, lpString="0000") frame 48: DefSubclassProc(uMsg=0xc) [WM_SETTEXT] frame 51: COMCTL32_SubclassProc(uMsg=0xc) frame 31: EDIT_WM_SetText frame 30: notify_parent -> SendMessageW(msg=0x111) [EN_UPDATE] frame 103: SetWindowTextA(hwnd=000100C0, lpString="0000") [re-enter] ... (repeats to frame 193, then stack overflow) **4. Conformance test (attachment 81666) — request for verification** The attached conformance test (attachment 81666) reproduces the same class of WM_SETTEXT re-entrancy without needing the app, mfc42, or ODBC. I ran it on both Wine and Windows: - Wine 11.14: recursion reaches the test's guard (depth 50) - Windows: recursion is bounded (depth ~15) I would appreciate it if you could verify the test on your Windows setup to confirm the Windows behavior independently. A note on scope: the test is a *simplified* reproduction. It triggers re-entrancy via a WndProc that re-enters SetWindowText on WM_SETTEXT, with a passive subclass in the chain. The real app's cycle (shown in the backtrace above) is more involved — it goes through EDIT_WM_SetText -> notify_parent(EN_UPDATE) -> WM_COMMAND -> mfc42 -> SetWindowText, with the comctl32 subclassing chain (TOOLTIPS_SubclassProc) in between. But both expose the same underlying gap: Wine does not bound WM_SETTEXT re-entrancy the way Windows does. The test isolates the core issue; the backtrace confirms it manifests in the real app. Notably, Wine already defines MAX_WINPROC_RECURSION (64) in dlls/win32u/message.c, but this limit did not prevent the recursion from reaching ~140 levels in the app — the re-entrancy appears to bypass the existing guard. This may warrant investigation as the potential fix site. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60110 Ken Sharp <imwellcushtymelike@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |testcase --- Comment #10 from Ken Sharp <imwellcushtymelike@gmail.com> --- Passed on Windows 10. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla