[Bug 60063] New: shell32: SHBrowseForFolder crashes when an application passes an invalid BROWSEINFO.pidlRoot
http://bugs.winehq.org/show_bug.cgi?id=60063 Bug ID: 60063 Summary: shell32: SHBrowseForFolder crashes when an application passes an invalid BROWSEINFO.pidlRoot Product: Wine Version: 11.14 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: shell32 Assignee: wine-bugs@list.winehq.org Reporter: commoncargo@tutanota.com Target Milestone: --- Distribution: --- Created attachment 81568 --> http://bugs.winehq.org/attachment.cgi?id=81568 Backtrace A 32-bit application crashes when it opens the shell folder browser dialog. The process dies with a page fault inside shell32. Cause: the application fills its BROWSEINFOW with a plain CSIDL value instead of an item id list in the pidlRoot field. Disassembling the caller shows the BROWSEINFOW being built with the constant 0x11 (CSIDL_DRIVES) in the pidlRoot slot, ulFlags = BIF_RETURNONLYFSDIRS|BIF_STATUSTEXT, followed by the call to SHBrowseForFolderW. So the mistake is on the application side, but Windows does not crash on it. Wine dereferences the value immediately in InitializeTreeView (ILClone -> ILGetSize) and faults, making the dialog unusable. Windows 10 behaviour: the dialog is created and the process survives. Verified with a conformance test built from the Wine tree and run in a Windows 10 VM; the dialog opens and closes normally. How to reproduce without the application: Add a test to dlls/shell32/tests/brsfolder.c that calls SHBrowseForFolderA with bi.pidlRoot = (LPCITEMIDLIST)CSIDL_DRIVES and a callback that posts IDOK on BFFM_INITIALIZED. On Wine the test process dies with the page fault above; on Windows 10 it runs to completion. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60063 --- Comment #1 from Ken Sharp <imwellcushtymelike@gmail.com> --- What application? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60063 --- Comment #2 from commoncargo@tutanota.com --- It is an internal CASE tool from my company, which we use for ERP software development. it's working well apart from the Open folder menu section (that triggers the crash), which is making it very tricky to use under Linux. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60063 Nikolay Sivov <bunglehead@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Ever confirmed|0 |1 Status|UNCONFIRMED |NEW --- Comment #3 from Nikolay Sivov <bunglehead@gmail.com> --- Doesn't look like an application bug to me. We should simply support those CSIDL_* constants. Please feel free to submit a fix for that. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60063 Attila Fidan <winebugs@print0.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |winebugs@print0.net --- Comment #4 from Attila Fidan <winebugs@print0.net> --- Related: https://gitlab.winehq.org/wine/wine/-/merge_requests/8861 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60063 --- Comment #5 from commoncargo@tutanota.com --- (In reply to Nikolay Sivov from comment #3)
Doesn't look like an application bug to me. We should simply support those CSIDL_* constants.
Please feel free to submit a fix for that.
Agree with you. This is an up to date patch I posted that fixes the issue on my application: https://gitlab.winehq.org/wine/wine/-/merge_requests/11477 From a quick read, the one from Attila Fidan could work as well. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60063 Nikolay Sivov <bunglehead@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED Fixed by SHA1| |50f326a462e2c3243f0ba909e91 | |dcdf8540fb460 --- Comment #6 from Nikolay Sivov <bunglehead@gmail.com> --- Marking fixed, 50f326a462e2c3243f0ba909e91dcdf8540fb460. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60063 Alexandre Julliard <julliard@winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #7 from Alexandre Julliard <julliard@winehq.org> --- Closing bugs fixed in 11.15. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla