[Bug 60236] New: riched20: uninitialized ITextHost format pointers crash SketchUp LayOut 2026
http://bugs.winehq.org/show_bug.cgi?id=60236 Bug ID: 60236 Summary: riched20: uninitialized ITextHost format pointers crash SketchUp LayOut 2026 Product: Wine Version: unspecified Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: richedit Assignee: wine-bugs@list.winehq.org Reporter: dante.dex.arch@gmail.com Target Milestone: --- Distribution: --- Created attachment 81930 --> http://bugs.winehq.org/attachment.cgi?id=81930 fix_richedit_layout2026.patch SketchUp LayOut 2026 crashes while initializing its RTF text services when Wine's builtin RichEdit implementation is used. Wine calls `ITextHost::TxGetCharFormat()` and `ITextHost::TxGetParaFormat()` with uninitialized pointer values. The text host reached through `LayOutRTF.dll` follows native Microsoft text-services behavior: it may fill the writable format storage supplied through the pointer instead of replacing the pointer. Under Wine, this writes through an indeterminate address and causes an access violation. The relevant Wine code currently declares these locals without initializing them: ``` const CHARFORMATW *host_cf; const PARAFORMAT2 *host_fmt; ``` They are then passed to the host callbacks: ``` ITextHost_TxGetCharFormat(editor->texthost, &host_cf); ITextHost_TxGetParaFormat(editor->texthost, (const PARAFORMAT **)&host_fmt); ``` Native Microsoft text services pass initialized writable default-format storage. Initializing the pointers to suitable local format storage prevents the crash while preserving compatibility with hosts that replace the pointer. I reproduced the failure with stock Wine Staging 11.15 and 11.14, and with the Wine 11.0 runtime used by GE-Proton 11-5. Rebuilding their builtin `riched20.dll` with the attached patch allows LayOut to pass repeated RTF stream initialization and also allows SketchUp's **Send to LayOut** child process to pass this initialization point. No native Microsoft `msftedit.dll` is installed in these tests. The issue testing and research was done by GPT 5.6 Sol, who also wrote the patch. So, it is not a ready-to-merge patch, but a proof of fix. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60236 Dante Dex <dante.dex.arch@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|unspecified |11.16 Distribution|--- |ArchLinux -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60236 --- Comment #1 from Ken Sharp <imwellcushtymelike@gmail.com> --- Did you test this on actual upstream Wine? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60236 --- Comment #2 from Dante Dex <dante.dex.arch@gmail.com> --- Created attachment 81931 --> http://bugs.winehq.org/attachment.cgi?id=81931 upstream_wine_access_violation_log This is the Wine (11.16) upstream access violation log. We did a test matrix, with the following results: | Runtime | Builtin RichEdit | Result | | --- | --- | --- | | Wine 11.16 | stock | access violation at the first `ME_StreamIn`; LayOut does not start; captured log | | Wine 11.16 | patched | LayOut starts; 42 `ME_StreamIn` calls complete without an access violation | | Wine Staging 11.16 | stock | access violation at `ME_StreamIn`; LayOut does not start | | Wine Staging 11.16 | patched | LayOut starts; 42 `ME_StreamIn` calls complete without an access violation; later exits in a separate CEF/graphics path | | Wine Staging 11.15 | stock | access violation at `ME_StreamIn` | | Wine Staging 11.15 | patched | LayOut starts; no access violation | | Wine Staging 11.14 | stock | access violation during RTF initialization | | Wine Staging 11.14 | patched | LayOut starts | | GE-Proton 11-5 / Wine 11.0 | stock | access violation during RTF initialization | | GE-Proton 11-5 / Wine 11.0 | patched | LayOut starts | | Native Windows text services | native | LayOut starts | -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla