[Bug 34774] New: Crimson Skies crashes when a mission ends
http://bugs.winehq.org/show_bug.cgi?id=34774 Bug #: 34774 Summary: Crimson Skies crashes when a mission ends Product: Wine Version: 1.7.4 Platform: x86-64 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: benpicco-wine(a)flauschlabor.de Classification: Unclassified Created attachment 46368 --> http://bugs.winehq.org/attachment.cgi?id=46368 Unhandled page fault on read access I've installed the game to a 32bit Windeprefix, installed quartz, Active Video and native amstream.dll and disabled winegstreamer so the game would launch. Everything works well, I can launch missions/instant action battles, but when they end and the game normally would go to a debriefing screen, it crashes instead. Last few lines of console output (abbreviated): fixme:dinput:LinuxInputEffectImpl_Download Could not upload effect. Assuming a disconnected device 45 "Invalid argument". fixme:dinput:joy_polldev joystick cannot handle type 21 event (code 1) fixme:dinput:LinuxInputEffectImpl_Download Could not upload effect. Assuming a disconnected device 45 "Invalid argument". fixme:dinput:LinuxInputEffectImpl_Download Could not upload effect. Assuming a disconnected device 45 "Invalid argument". wine: Unhandled page fault on read access to 0x06240000 at address 0x22022e0 (thread 0047), starting debugger... fixme:ole:RemUnknown_QueryInterface No interface for iid {00000019-0000-0000-c000-000000000046} -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34774 --- Comment #1 from benpicco <benpicco-wine(a)flauschlabor.de> 2013-10-20 15:53:09 CDT --- Created attachment 46369 --> http://bugs.winehq.org/attachment.cgi?id=46369 Unhandled page fault on read access the same crash as the other backtrace, this time without a gamepad attached (just to rule that out) -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34774 --- Comment #2 from Austin English <austinenglish(a)gmail.com> --- This is your friendly reminder that there has been no bug activity for over a year. Is this still an issue in current (1.7.37 or newer) wine? If so, please attach the terminal output in 1.7.37 (see http://wiki.winehq.org/FAQ#get_log). -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34774 thedoctor45 <thedoctor45(a)portingteam.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |thedoctor45(a)portingteam.com --- Comment #3 from thedoctor45 <thedoctor45(a)portingteam.com> --- Created attachment 55193 --> https://bugs.winehq.org/attachment.cgi?id=55193 wine 1.9.7 crash log for Crimson Skies I can confirm that this bug is still not fixed in Wine 1.9.7. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34774 thedoctor45 <thedoctor45(a)portingteam.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #55193|0 |1 is obsolete| | --- Comment #4 from thedoctor45 <thedoctor45(a)portingteam.com> --- Created attachment 55197 --> https://bugs.winehq.org/attachment.cgi?id=55197 Unhandled exception: page fault on read access -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34774 joaopa <jeremielapuree(a)yahoo.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jeremielapuree(a)yahoo.fr --- Comment #5 from joaopa <jeremielapuree(a)yahoo.fr> --- Does the bug still occur with wine-6.5? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34774 Benjamin Legendre <legendre.benjamin(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |legendre.benjamin(a)gmail.com --- Comment #6 from Benjamin Legendre <legendre.benjamin(a)gmail.com> --- Bug still occurs in Wine 7.18 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34774 Sven Arvidsson <sa(a)whiz.se> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sa(a)whiz.se -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34774 Le Gluon du Net <legluondunet@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |legluondunet@gmail.com --- Comment #7 from Le Gluon du Net <legluondunet@gmail.com> --- Bug still occurs in Wine 11.16. Tested with staging. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34774 --- Comment #8 from Le Gluon du Net <legluondunet@gmail.com> --- you will find a video which shows how to reproduce the issue on my Github: https://github.com/legluondunet/MyLittleLutrisScripts/issues/218 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34774 --- Comment #9 from Le Gluon du Net <legluondunet@gmail.com> --- Bug still occurs in Wine 11.17. Tested with staging. I joined you a log. PS: this game needs you install directshow with winetricks or you will not see main menu. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34774 --- Comment #10 from Le Gluon du Net <legluondunet@gmail.com> --- Created attachment 82115 --> http://bugs.winehq.org/attachment.cgi?id=82115 wine 11.17 log -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34774 RJ <rene.viper999@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |rene.viper999@gmail.com --- Comment #11 from RJ <rene.viper999@gmail.com> --- # Crimson Skies — roffile+0x22e0 crash: what the faulting code is doing Still reproducible on **wine-11.17** (WoW64, x86_64 host, CachyOS, Mesa/RADV), Windows XP mode, with the game patched to the official 1.02 update. The crash reports already on this bug span wine-1.7.4 (2013), wine-1.9.7 (macOS), wine-11.0-staging under umu/Proton, and 11.17. They are the same fault every time, and the registers say more than they look like they do. ## The registers are an invariant, not noise Across every dump on this bug: | Wine | ESI (fault) | EDX | ECX | EDX+ECX | |---|---|---|---|---| | 1.7.4 | `06240000` | `0623ffe5` | `1a` | `0623ffff` | | 1.9.7 (Darwin) | `050f0000` | `050effcf` | `30` | `050effff` | | 11.0-staging | `08ad0000` | `08acffe3` | `1c` | `08acffff` | | 11.17 | `0b0d0000` | `0b0cffdb` | `24` | `0b0cffff` | `EDX + ECX` is always exactly the last mapped byte, and `ESI` is always the first unmapped one, always on a 64 KB boundary. So this is not a wild pointer: it is a forward byte scan (`movb (%esi),%al`) that started at EDX, has consumed ECX bytes, has not found its terminator, and has walked one byte past the end of the region it was scanning. The start offset varies with the data; the end never does. ## What roffile is actually doing A relay trace filtered to roffile only (`HKCU\Software\Wine\Debug\RelayFromInclude = "roffile"`, `WINEDEBUG=+relay,+seh`) gives the last calls before the fault. Abridged, all on the crashing thread: ``` Call user32.CharUpperA(0af8755c "[@OrdinanceLayout@]OL_S_ROCKETDESC") ret=0af13e91 Ret user32.CharUpperA() retval=0af8755c ret=0af13e91 Call KERNEL32.InterlockedIncrement(0af87550) ret=0af137ad retval=2 Call KERNEL32.InterlockedIncrement(0af87460) ret=0af137ad retval=2 ... several matched inc/dec pairs ... Call KERNEL32.InterlockedDecrement(0af86070) ret=0af1393c retval=0 <-- released Call KERNEL32.lstrlenA(0af2d860 "") ret=0af13a2f retval=0 <-- empty string Call KERNEL32.IsDBCSLeadByte(0af2b100) ret=0af14081 retval=0 Call KERNEL32.GetStringTypeExA(00000800,00000001,0022fd1b "",00000001,0022fd1e) ret=0af140cd Call KERNEL32.InterlockedDecrement(0af87350) ret=0af1383c retval=0 Call KERNEL32.InterlockedIncrement(0af87310) ret=0af13af3 Call KERNEL32.InterlockedDecrement(0af87310) ret=0af1393c Call KERNEL32.IsDBCSLeadByte(0000003b) ret=0af14081 retval=0 <-- ';' Call KERNEL32.GetStringTypeExA(00000800,00000001,0022fd1b ";\n\"\xf1\n\x1cs\xf8\nr\x1f\xf1\np\xdb\xf6\n\x01",00000001,0022fd1e) ret=0af140cd --> EXCEPTION_ACCESS_VIOLATION at 0af122e0, reading 0b0d0000 ``` Read that from the top: 1. **roffile is a string-table lookup.** The composed key `[@OrdinanceLayout@]OL_S_ROCKETDESC` is upper-cased for a case-insensitive match. The immediately preceding lookups in the same trace are `OL_T_GunName2`, `OL_T_GunName3`, `OL_S_AMMODESC` — the armament panel's strings, from `strings.dll` / `language.dll` / `langui.dll`. 2. **A refcount reaches zero** (`InterlockedDecrement(0af86070) -> 0`), and the string it then measures with `lstrlenA` is **empty**. 3. **It scans anyway.** `IsDBCSLeadByte` + `GetStringTypeExA` one byte at a time is the MBCS-aware walk from the MSVC CRT. Note it classifies a NUL at `0022fd1b ""` and *keeps going*, then classifies `';'` (0x3b) — so the loop is delimiter-driven, not NUL-terminated. 4. Past the `';'` the bytes are garbage (`\n\"\xf1\n\x1cs\xf8...`), there is no delimiter, and the scan runs to the end of the region. So the failing operation is: **look up the next string in the `[@OrdinanceLayout@]` section, get an empty/undefined value back, then parse it with a delimiter scan that has nothing to stop on.** The game does wrap this in `__try` — `msvcrt._except_handler3` fires at `0AF122E0` with handlers at `0AF25CC0`, `0AF25C78` and `00601D30` (the last inside crimson.icd) — but every handler returns `ExceptionContinueSearch` and the process terminates with `c0000005`. Also in the trace, from roffile, earlier: ``` Call KERNEL32.VirtualAlloc(0af80000,00008000,00001000,00000004) ret=0af228a0 Ret KERNEL32.VirtualAlloc() retval=0af80000 ``` — an explicit-base `MEM_COMMIT` of 32 KB inside a larger reservation, i.e. reserve-an-arena-and-commit-as-you-go. That is consistent with the fault address always landing on a 64 KB boundary: the scan reaches the end of the committed part of the arena. On Windows the byte past the end is evidently readable (or the arena is committed differently) and the overrun is harmless; under Wine the next granule is not mapped and it faults. ## Things that do not change it * Patching the game to the official 1.02 update. The fault offset is `roffile+0x22e0` before and after — 1.02 replaces `CRIMSON.EXE` and `CRIMSON.ICD`, not `roffile.dll`. * Having the original disc mounted (CDemu, real optical device node, volume label present, SafeDisc driver in place and passing). * `WINE_CPU_TOPOLOGY=1:0` — the addresses come out byte-identical, so the teardown ordering it would change is not what decides this. * Renderer (wined3d vs d7vk), virtual desktop. * Wine version, host architecture, host OS, GPU vendor — see the table above. ## Reproducing Start any mission and leave it, or open Preferences from inside a mission. It faults every time, in the same place, on the same byte. ## Getting the trace ``` wine reg delete 'HKCU\Software\Wine\Debug' /v RelayFromExclude /f wine reg add 'HKCU\Software\Wine\Debug' /v RelayFromInclude /t REG_SZ /d roffile /f WINEDEBUG=fixme-all,+relay,+seh wine CRIMSON.EXE ``` `RelayFromExclude` has to go first: in `check_from_module()` an exclude list wins outright, so if one exists the include list is never consulted and you get the whole process instead (62 million lines in two minutes, against 8.6 million with the filter actually applied). -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34774 thehack904 <thehack904@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |thehack904@gmail.com --- Comment #12 from thehack904 <thehack904@gmail.com> --- I have identified and tested a working workaround for the Crimson Skies (2000) crashes affecting the Preferences menu and Quit Mission functionality. **Workaround and source code:** https://github.com/thehack904/CrimsonSkies-Wine-Fix **Stable release v1.0.0:** https://github.com/thehack904/CrimsonSkies-Wine-Fix/releases/tag/v1.0.0 ### Investigation Using GDB, I traced a SIGSEGV in `roffile.dll` at RVA `0x22E0`, where the parser attempts to read beyond accessible memory. The investigation identified a problem in the ROF resource line parser's end-of-input handling. The game loads `LAYOUT.CSV` from the `crimson.rof` resource archive. The resource decompresses successfully, but the parser advances beyond the layout data and continues into unrelated memory. A GDB trace recorded more than 1,200 parser calls, showing the cursor progressing past the resource contents and eventually reaching an unmapped memory page. The relevant instruction sequence in `roffile.dll` is: ```asm cmp byte ptr [esi], 0x20 jge short keep_cursor inc esi keep_cursor: mov [edi], esi ``` When the parser encounters a NUL byte (`0x00`), the `INC ESI` instruction advances the cursor past it. This can cause subsequent calls to continue reading beyond the terminator. ### Working workaround For the verified `roffile.dll` build, changing one instruction prevents the observed crash: - DLL: `roffile.dll` - RVA: `0x231E` - Original instruction: `INC ESI` (`0x46`) - Replacement: `NOP` (`0x90`) Original bytes: ```text 80 3E 20 7D 01 46 89 37 ``` Patched bytes: ```text 80 3E 20 7D 01 90 89 37 ``` Original DLL SHA-256: ```text 1bc7b4b1adba1bf6a510e62f93473824c662acbf2a2176087b7b4b85338ba58a ``` This is a game DLL workaround, not a Wine source-code patch. The underlying cause is strongly supported by the debugger evidence and successful functional testing, but broader validation is still needed. ### Testing results With the patched DLL, I successfully tested: - Opening Preferences during a mission. - Changing settings and returning to the mission. - Quitting a mission and returning to the correct menu. - Returning to the main menu. - Starting another mission and repeating these operations. - Saving and loading. - Exiting the game normally. - Restarting the game and repeating the tests. All completed successfully. Both previously reproducible crashes were eliminated in the tested installation. ### Test environment - Game: Crimson Skies (2000), original Windows PC version - Operating system: Kubuntu 26.04.1 - Compatibility layer: GE-Proton 11-9 via Lutris/UMU Steam Runtime 4 - GPU: Intel HD Graphics 4000 - Hardware: HP Elite 8300 USDT ### Public workaround I published a Python 3 patching utility under the MIT license. The utility: - Verifies the original DLL using SHA-256. - Applies the single-byte modification. - Creates and verifies a backup. - Supports status checking and restoration. - Allows safe reapplication after restoration. - Rejects unsupported DLL builds. - Does not distribute copyrighted game files. Repository: https://github.com/thehack904/CrimsonSkies-Wine-Fix Release: https://github.com/thehack904/CrimsonSkies-Wine-Fix/releases/tag/v1.0.0 ### Limitations The workaround has been validated against one specific `roffile.dll` build and one Wine/Proton environment. Because the modification is within the game DLL, it is not inherently tied to GE-Proton 11-9, but I have not verified it against other Wine/Proton versions or different game DLL builds. I am sharing these findings in the hope that they help other Crimson Skies users and provide useful diagnostic information for a potential upstream Wine fix. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (3)
-
wine-bugs＠winehq.org -
WineHQ Bugzilla
-
WineHQ Bugzilla