[Bug 59529] New: GetProcessMitigationPolicy stub

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59529

            Bug ID: 59529
           Summary: GetProcessMitigationPolicy stub
           Product: Wine
           Version: 11.0
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: kernel32
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Summary: GetProcessMitigationPolicy stub causes CefSharp 109 subprocess to
crash with RaiseFailFastException (0x80000003)

Description:
When running Paprika Recipe Manager 3 (Windows) under Wine 11.0 on Debian 12,
the CefSharp browser subprocess crashes immediately with unhandled exception
code 80000003 every time it is spawned. This prevents the embedded browser view
from rendering content.

Environment:

Wine version: 11.0
Debian version: 12 (Bookworm)
GPU: NVIDIA GeForce GTX 1060 6GB (driver 580.126.18)
Desktop: KDE Plasma (Wayland + Xwayland)
Application: Paprika Recipe Manager 3
CefSharp version: 109.1.110
CEF/Chromium version: 109.1.11+g6d4fdb2+chromium-109.0.5414.87

Steps to reproduce:

Install Paprika Recipe Manager 3 in a 64-bit Wine prefix
Launch Paprika
Click on any recipe to open the recipe viewer

Observed behavior:
The CefSharp browser subprocess crashes immediately with:

    fixme:process:GetProcessMitigationPolicy (FFFFFFFFFFFFFFFF, 4,
00007FFFFE8FF020, 4): stub
err:seh:NtRaiseException Unhandled exception code 80000003 flags 0 addr
0x6fffee13d3a5

The crash occurs deterministically at the same address every time, across
multiple subprocess instances. The sequence is always identical:

GetProcessMitigationPolicy is called with handle FFFFFFFFFFFFFFFF (current
process) and policy class 4 (ProcessDynamicCodePolicy)
Wine's stub implementation returns TRUE without filling the output buffer
CEF reads uninitialized/garbage data from the unfilled buffer
CEF interprets the garbage values as a security policy violation
CEF calls RaiseFailFastException and the subprocess dies with 0x80000003

This was confirmed by tracing with WINEDEBUG=+seh — the
GetProcessMitigationPolicy stub call appears immediately before every single
subprocess crash, consistently across all spawned instances.

Expected behavior:
GetProcessMitigationPolicy with ProcessDynamicCodePolicy (class 4) should
return a zeroed PROCESS_MITIGATION_DYNAMIC_CODE_POLICY struct indicating no
restrictions are in place, allowing CEF to proceed normally.

Workaround:
Running the application via Proton-GE 10-32 with .NET 4.8 installed in the
prefix works around the issue, suggesting Proton-GE has patches that handle
this case differently.

Additional notes:
The 0xAAAAAAAAAAAAAAAA pattern observed in the r12 register at crash time is
consistent with Windows debug heap poison values, confirming that CEF is
reading from an unfilled output buffer rather than a legitimately populated
one.
A minimal fix would be for GetProcessMitigationPolicy to zero-fill the output
buffer before returning TRUE, which would tell calling applications that no
mitigation policies are active.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.