[Bug 60088] New: ole32/storage: extra trailing NUL byte written into name of stream nested in a substorage (breaks MS Publisher .pub file portability)
http://bugs.winehq.org/show_bug.cgi?id=60088 Bug ID: 60088 Summary: ole32/storage: extra trailing NUL byte written into name of stream nested in a substorage (breaks MS Publisher .pub file portability) Product: Wine Version: 9.0 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: ole32 Assignee: wine-bugs@list.winehq.org Reporter: veliga99@gmail.com Target Milestone: --- Distribution: --- When a Microsoft Publisher 2003 (.pub) document containing embedded pictures is saved under Wine, the OLE compound-file stream named "EscherDelayStm" — nested inside the "Escher" substorage — is written with an extra trailing NUL character as part of its name: "EscherDelayStm\x00" (15 UTF-16 units) instead of the correct "EscherDelayStm" (14 UTF-16 units). The directory entry's "Name Length" field is internally consistent with this wrong name (32 instead of 30), so the file remains structurally valid and is read back fine by Wine itself, by the Python `olefile` library, and by the independent `libmspub` parser — but real Windows/Publisher, which resolves this stream by an exact name lookup, fails to find it. Notably, the sibling stream "EscherStm" in the very same substorage is always written correctly, with no extra byte — this points to something specific to how this particular stream (or streams nested in a substorage more generally) gets created/named, rather than a blanket string-length bug affecting every stream. Impact: if the stream is empty (no embedded pictures), the bug has no visible effect. If it holds real picture data (any Publisher document with at least one embedded image), the resulting .pub file: - crashes Publisher 2003 silently on open (native Windows), and - is flatly refused by Publisher 2016+ ("a problem was detected with this file", Office File Validation). This makes any Publisher document with pictures, edited under Wine, unopenable once transferred back to a real Windows machine. Reproduction: 1. Under Wine, open/create a Publisher 2003 (.pub) document containing at least one embedded picture, and save it. 2. Compare the OLE stream names in "Escher/*" against a reference file saved by native Windows Publisher (e.g. with `olefile` in Python, or any compound-file browser) — the Wine-saved file will show "EscherDelayStm\x00" (note the visible extra byte) where Windows shows "EscherDelayStm". 3. Attempt to open the Wine-saved file with native Windows Publisher: it fails (silent crash on 2003, explicit rejection on 2016+). Confirmed fix: manually correcting only the 2-byte "Name Length" field of this stream's directory entry (32 -> 30, no other byte touched) makes the file open correctly again under native Windows Publisher — verified on multiple real documents. A minimal reproduction script and full write-up (including a working Python-based post-hoc fix, for anyone hitting this before it's fixed in Wine itself) is available at: https://github.com/veliga-syutkin/mspub-wine-escherdelaystm-fix -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60088 --- Comment #1 from Nikolay Sivov <bunglehead@gmail.com> --- Could you please attach a wine log using WINEDEBUG=+storage when creating a document like that? That will hopefully show where this name is used exactly. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60088 --- Comment #2 from Nikolay Sivov <bunglehead@gmail.com> --- Compound file documentation says explicitly that null should be included in name length count, so will need to replicate what application is doing first. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60088 --- Comment #3 from Veliga Syutkin <veliga99@gmail.com> --- Created attachment 81612 --> http://bugs.winehq.org/attachment.cgi?id=81612 WINEDEBUG=+storage log, MS Publisher creating .pub with embedded picture WINEDEBUG=+storage log as requested. Reproduced by opening MS Publisher (Office 2003, MSPUB.EXE) under Wine 9.0, creating a new document, inserting a picture, saving as .pub, then closing. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60088 --- Comment #4 from Veliga Syutkin <veliga99@gmail.com> --- Grepping the log for "EscherDelayStm" shows Publisher doesn't create that stream name directly — it writes to "EscherDelayTemp" then calls RenameElement("EscherDelayTemp" -> "EscherDelayStm") near the end of the save. That rename call looks like the place to check the name length handling. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60088 --- Comment #5 from Nikolay Sivov <bunglehead@gmail.com> --- Created attachment 81616 --> http://bugs.winehq.org/attachment.cgi?id=81616 patch Could you try this patch? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60088 --- Comment #6 from Veliga Syutkin <veliga99@gmail.com> --- Tested this patch against current git master (Wine 11.14, 1012f3d9, fetched 2026-07-29) with your 3 hunks applied to dlls/ole32/storage32.c — nothing else changed. Two independent checks, both confirm the fix: 1. Targeted unit test. Added a test reproducing the exact sequence Publisher uses (CreateStream(L"EscherDelayTemp") → RenameElement(..., L"EscherDelayStm")), then reading back the raw on-disk directory entry. - Without the patch: sizeOfNameString = 32 (the bug, matches the corrupted file from comment #3). - With the patch: sizeOfNameString = 30 (correct, matches the compound-file spec you cited). 2. Real-world repro. Built the patched Wine, installed MS Office Publisher 2003 into a clean prefix, opened the original corrupted .pub from this bug and re-saved it. Byte-inspecting the resulting file (checked two independent ways) confirms EscherDelayStm's declared name length is now 30, with a clean single null terminator — matches what real Windows expects. Patch looks correct to me, including the added bounds check for the symmetric case (renaming to a name longer than the buffer). -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60088 --- Comment #7 from Nikolay Sivov <bunglehead@gmail.com> --- Thanks, sent https://gitlab.winehq.org/wine/wine/-/merge_requests/11515. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60088 Nikolay Sivov <bunglehead@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Fixed by SHA1| |4bf02ed10145f2258aedd8bd30a | |ceba1c82da063 Resolution|--- |FIXED --- Comment #8 from Nikolay Sivov <bunglehead@gmail.com> --- Marking fixed, 4bf02ed10145f2258aedd8bd30aceba1c82da063. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60088 Alexandre Julliard <julliard@winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #9 from Alexandre Julliard <julliard@winehq.org> --- Closing bugs fixed in 11.15. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla