[Bug 50603] New: WiX Toolset v3.9 installer crashes when loading update feed XML
https://bugs.winehq.org/show_bug.cgi?id=50603 Bug ID: 50603 Summary: WiX Toolset v3.9 installer crashes when loading update feed XML Product: Wine Version: 6.1 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: msxml3 Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, extracted from bug 37751 ("WiX Toolset v3.9 installer doesn't open with Wine-Mono (metahostpolicy_GetRequestedRuntime returns CLR_E_SHIM_RUNTIME)") to avoid the bug being recycled for multiple problems. Stable download link via Internet Archive: https://web.archive.org/web/20200227003934/https://github.com/wixtoolset/wix... Trace log: --- snip --- $ WINEDEBUG=+seh,+relay,+msxml wine ./wix311.exe >>log.txt 2>&1 ... 0110:Call KERNEL32.WideCharToMultiByte(0000fde9,00000000,0017babc L"C:\\users\\focht\\Temp\\UpdateFeed_20210201195635.xml",ffffffff,7dd4f5a0,00000033,00000000,00000000) ret=7d1d0006 ... 0110:trace:msxml:domdoc_load ret (0) ... 0110:trace:msxml:domdoc_get_documentElement (0x1928b0)->(0x31f714) 0110:trace:msxml:create_node type 1 ... 0110:trace:msxml:create_node type 3 0110:trace:msxml:xmldoc_add_refs (0x7cd8da10)->(9) 0110:trace:msxml:domtext_QueryInterface (0x191088)->({2933bf80-7b36-11d2-b20e-00c04f983e60} 0x31f5fc) 0110:trace:msxml:domtext_AddRef (0x191088)->(2) 0110:trace:msxml:domtext_Release (0x191088)->(1) 0110:trace:msxml:domtext_get_nodeType (0x191088)->(0x31f67c) 0110:trace:msxml:domtext_Release (0x191088)->(0) 0110:trace:msxml:xmldoc_release_refs (0x7cd8da10)->(8) 0110:trace:msxml:xmlnodelist_nextNode (0x191040)->(0x31f668) 0110:trace:msxml:domelem_get_text (0x190dc0)->(0x31f66c) 0110:trace:msxml:node_get_text 0x190dc0 L"<p>Change list:</p> <ul>\n<li>RobMen: WIXBUG:6075 - Fix \"Zip Slip\" vulnerability in DTF.</li>\n</ul>" 0110:trace:msxml:xmlnodelist_Release (0x191040)->(0) 0110:trace:msxml:xmldoc_release_refs (0x7cd8da10)->(7) 0110:trace:msxml:xmlnodemap_Release (0x180f18)->(0) 0110:trace:msxml:xmldoc_release_refs (0x7cd8da10)->(6) 0110:trace:msxml:domelem_Release (0x190dc0)->(0) 0110:trace:msxml:xmldoc_release_refs (0x7cd8da10)->(5) 0110:trace:msxml:xmlnodelist_nextNode (0x190660)->(0x31f694) 0110:trace:msxml:create_node type 1 0110:trace:msxml:xmldoc_add_refs (0x7cd8da10)->(6) 0110:trace:msxml:domelem_QueryInterface (0x190dc0)->({2933bf80-7b36-11d2-b20e-00c04f983e60} 0x31f61c) 0110:trace:msxml:domelem_AddRef (0x190dc0)->(2) 0110:trace:msxml:domelem_Release (0x190dc0)->(1) 0110:trace:msxml:domelem_get_nodeType (0x190dc0)->(0x31f6a8) 0110:trace:msxml:domelem_get_baseName (0x190dc0)->(0x31f6c4) 0110:trace:msxml:node_get_base_name returning L"version" 0110:trace:msxml:domelem_get_namespaceURI (0x190dc0)->(0x31f694) 0110:trace:msxml:node_get_namespaceURI uri: L"http://appsyndication.org/2006/appsyn" 0110:trace:msxml:domelem_get_baseName (0x190dc0)->(0x31f690) 0110:trace:msxml:node_get_base_name returning L"version" 0110:trace:msxml:domelem_get_text (0x190dc0)->(0x31f68c) 0110:trace:msxml:node_get_text 0x190dc0 L"v3.11.2.4516" 0110:trace:msxml:domelem_get_attributes (0x190dc0)->(0x31f688) 0110:trace:msxml:xmldoc_add_refs (0x7cd8da10)->(7) 0110:trace:msxml:xmlnodemap_nextNode (0x1911b0)->(0x31f698: 0) 0110:trace:msxml:domelem_next_node (0x7dd51190)->(0: 0x31f698) 0110:trace:seh:dispatch_exception code=c0000005 flags=0 addr=00447A55 ip=00447a55 tid=0110 0110:trace:seh:dispatch_exception info[0]=00000000 0110:trace:seh:dispatch_exception info[1]=00000000 0110:trace:seh:dispatch_exception eax=001911e0 ebx=00000000 ecx=0031f668 edx=00000000 esi=00000000 edi=001911e0 0110:trace:seh:dispatch_exception ebp=0031f66c esp=0031f64c cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010202 0110:trace:seh:call_vectored_handlers calling handler at 01CE03D0 code=c0000005 flags=0 0110:trace:seh:call_vectored_handlers handler at 01CE03D0 returned 0 0110:trace:seh:call_vectored_handlers calling handler at 7B00F270 code=c0000005 flags=0 0110:trace:seh:call_vectored_handlers handler at 7B00F270 returned 0 0110:trace:seh:call_stack_handlers calling handler at 00431150 code=c0000005 flags=0 0110:trace:seh:call_stack_handlers handler at 00431150 returned 1 0110:trace:seh:call_stack_handlers calling handler at 7BC52860 code=c0000005 flags=0 0110:trace:seh:start_debugger Starting debugger L"winedbg --auto 268 316" 0110:trace:seh:call_stack_handlers handler at 7BC52860 returned 1 --- snip --- 'winetricks -q msxml3' works around (https://bugs.winehq.org/show_bug.cgi?id=37751#c19) $ sha1sum wix311.exe 3f619089b46df893f55e58832ce442678fb0635f wix311.exe $ du -sh wix311.exe 27M wix311.exe $ wine --version wine-6.1 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=50603 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, Installer URL| |https://web.archive.org/web | |/20200227003934/https://git | |hub.com/wixtoolset/wix3/rel | |eases/download/wix3111rtm/w | |ix311.exe -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=50603 Damjan Jovanovic <damjan.jov(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |damjan.jov(a)gmail.com --- Comment #1 from Damjan Jovanovic <damjan.jov(a)gmail.com> --- If I just take that last msxml function call before the crash: ---snip--- 0110:trace:msxml:domelem_next_node (0x7dd51190)->(0: 0x31f698) ---snip--- and I patch that function to return S_FALSE if the nextNode is NULL: ---snip--- + if (*nextNode == NULL) return S_FALSE; return S_OK; } ---snip--- the crash is avoided, and the installer proceeds to asking to install .NET 4. It can't be that simple, can it? (Note I used dotnet48 here, as Wine-Mono dies from another error (something about font metrics?). With corefonts Wine-Mono gets further, but still crashes elsewhere before opening that installation dialog with various options.) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=50603 --- Comment #2 from Damjan Jovanovic <damjan.jov(a)gmail.com> --- All current msxml unit tests pass. Let's add a new one for this patch. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=50603 Damjan Jovanovic <damjan.jov(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |patch, source, testcase --- Comment #3 from Damjan Jovanovic <damjan.jov(a)gmail.com> --- Patch sent: https://source.winehq.org/patches/data/207997 As explained in the patch: Currently Wine return S_FALSE when IXMLDOMNamedNodeMap::nextNode() has run out of attributes to return, but when an XML node has no attributes at all, it returns S_OK despite setting the nextNode output parameter to NULL, causing the caller to crash when it accesses this pointer. Return S_FALSE in this case instead. I can't believe this bug went undetected for so long. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=50603 Damjan Jovanovic <damjan.jov(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |06cd8d3d2eb09ffb19f26e95360 | |c3ddcc4caf46d Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #4 from Damjan Jovanovic <damjan.jov(a)gmail.com> --- Patch committed, resolving fixed. Thank you for your bug report. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=50603 Damjan Jovanovic <damjan.jov(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|WiX Toolset v3.9 installer |WiX Toolset v3.11 installer |crashes when loading update |crashes when loading update |feed XML |feed XML --- Comment #5 from Damjan Jovanovic <damjan.jov(a)gmail.com> --- The WiX version in the attached binary is 3.11, not 3.9. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=50603 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #6 from Alexandre Julliard <julliard(a)winehq.org> --- Closing bugs fixed in 6.12. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=50603 Michael Stefaniuc <mstefani(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |6.0.x -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=50603 Michael Stefaniuc <mstefani(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|6.0.x |--- --- Comment #7 from Michael Stefaniuc <mstefani(a)winehq.org> --- Removing the 6.0.x milestone from bug fixes included in 6.0.3. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla