[Bug 60232] New: GetCurrentHwProfileA crashes on a NULL argument, and the profile guid is hardcoded
http://bugs.winehq.org/show_bug.cgi?id=60232 Bug ID: 60232 Summary: GetCurrentHwProfileA crashes on a NULL argument, and the profile guid is hardcoded Product: Wine Version: 11.16 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: advapi32 Assignee: wine-bugs@list.winehq.org Reporter: nayuta65535@gmail.com Target Milestone: --- Distribution: --- GetCurrentHwProfile is still the semi-stub added in 2002. Four separate problems, all reproduced on an unmodified wine-11.16 build (../configure --enable-archs=i386,x86_64, fresh prefix, no DLL overrides), compared against Windows 11 on the same machine using the same binary. 1. GetCurrentHwProfileA(NULL) crashes. wine: Unhandled page fault on write access to 0000000000000000 at address 00006FFFFF1E3F38 There is no NULL check, so the first write to pInfo->dwDockInfo faults. Windows returns FALSE and sets ERROR_INVALID_PARAMETER (0x57). 2. The profile guid is a constant compiled into Wine, so every installation reports the same machine identity: Wine: {12340001-1234-1234-1234-123456789012} Windows: {7572da61-84c6-11f0-a00e-806e6f6e6963} Applications use this value to identify the machine they are running on. 3. GetCurrentHwProfileW always returns FALSE. On Windows it succeeds and returns values matching the A version. 4. dwDockInfo is DOCKINFO_DOCKED (0x2). On the Windows machine it is DOCKINFO_UNDOCKED (0x1). On Windows the profile lives at HKLM\System\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001 HwProfileGuid = "{7572da61-84c6-11f0-a00e-806e6f6e6963}" FriendlyName = "Undocked Profile" with CurrentConfig, CurrentDockInfo\DockingState, AcpiAlias\0001 and a Hardware Profiles\0000 template alongside it. The guid there is a version 1 UUID whose timestamp is 2025-08-29, matching when Windows was installed on this machine, which supports MSDN's statement that the system generates it at install time. Its node field is the fixed value 806e6f6e6963 rather than a MAC address. Bug 4468 covers the same stub but was closed as FIXED once Full Tilt Poker started working again; the commit recorded there (eb48a472) only corrects a typo in the hardcoded guid string, which had one hex digit too many for five years. The function itself was never implemented. Bug 4468 Comment #12 on that bug already describes the NULL crash and outlines what a real implementation would need to do. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60232 nayuta65535@gmail.com changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|GetCurrentHwProfileA |crypt32: |crashes on a NULL argument, |GetCurrentHwProfileA |and the profile guid is |crashes on a NULL argument, |hardcoded |and the profile guid is | |hardcoded Component|advapi32 |crypt32 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60232 nayuta65535@gmail.com changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|crypt32: |advapi32: |GetCurrentHwProfileA |GetCurrentHwProfileA |crashes on a NULL argument, |crashes on a NULL argument, |and the profile guid is |and the profile guid is |hardcoded |hardcoded -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60232 nayuta65535@gmail.com changed: What |Removed |Added ---------------------------------------------------------------------------- Component|crypt32 |advapi32 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60232 Zeb Figura <z.figura12@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |z.figura12@gmail.com --- Comment #1 from Zeb Figura <z.figura12@gmail.com> --- Is there an application that needs all, or any, of these changes? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60232 --- Comment #2 from nayuta65535@gmail.com --- Not in the sense of an application failing to work. I went and checked, and the answer turned out to be no, so I am posting what I measured even though it argues against part of my own report. iZotope's Product Portal, the client that installs and activates their plug-ins, calls GetCurrentHwProfileA once at startup and uses the guid it gets back as the identity of the machine. On a pristine wine-11.16 built from the release tarball (../configure --enable-archs=i386,x86_64 --with-x --with-dbus, no staging, no DLL overrides), with the Portal's HTTP cache emptied first so that only that run's traffic was in it: fixme:advapi:GetCurrentHwProfileA (00007FFFFE20B560) semi-stub https://productportal.izotope.com/api/entitlements?hostID=123400011234123412... which is the hardcoded {12340001-1234-1234-1234-123456789012} with the braces and dashes stripped. With a locally patched advapi32 that generates a guid and stores it in the registry, the same request carries that machine's own guid instead. But it still works. On that same pristine build I completed machine-bound ("comp") authorizations of two products against that constant, and the vendor accepted both. One of them, with the check before and after in the same log: 04:23:26 AUTHCHECK | iZotope Ozone 8 Elements | Not Authorized | (LicenseType: 0, AuthType: 3) 04:24:25 AUTHORIZE | AuthorizeProduct | Ozone 8 Elements | AuthType: 'comp' 04:24:25 AUTHORIZE | iZotope Ozone 8 Elements | Result: Success 04:24:34 AUTHCHECK | iZotope Ozone 8 Elements | AUTHORIZED | (LicenseType: 3, AuthType: 0) Products authorized earlier also still validate under the stub value. So no application is blocked by this, and I should not have implied otherwise. What remains is that every Wine installation presents the same machine identity to that licensing server, and machine-bound authorizations are all issued against it, where MSDN says the system generates the guid per hardware profile at install time. Whether that is worth implementing is your call. The other three, no. The NULL crash, GetCurrentHwProfileW always failing, and dwDockInfo all came out of running the same test binary on Windows 11 and on Wine on this machine, so they are mismatches with Windows rather than application reports. The crash does still reproduce on 11.16, at dlls/advapi32/advapi.c:87: =>0 GetCurrentHwProfileA+0x18 [dlls/advapi32/advapi.c:87] in advapi32 87 pInfo->dwDockInfo = DOCKINFO_DOCKED; If a narrower bug is more useful, I am happy to reduce this one to the crash alone, or to close it. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla