June 2006 - Wine-Devel - list.winehq.org

Re: LoadResource with module=0x00400000 followed by stack overflow
by Jonathan Clark June 23, 2006

June 23, 2006

On Tue, 20 Jun 2006 12:49:25 +0200, Jan-Espen Pettersen wrote: > Can a win32 program expect that it has write access to the memory > pointed to by the return value of LoadResource with module 0x00400000? > Should LoadResource in some cases copy the memory and return a > writeable copy of the resource? I noticed a similar problem under Windows Server 2003 when DEP is enabled, but haven't seen it on other platforms. If I recall, there is code in version.dll which calls LoadResource with RT_VERSION and then expects to be able to write to pages that are clearly marked not-writable in the PE image. The pages remain read-only until after a call to GetVersionInfo so something in the kernel is altering them. I didn't dig into it, but thought it was really weird. When I turn off DEP for that program I got different behavior. I don't know what this means for wine but maybe that is useful. Jonathan

1 0

Move all common Dll[un]RegisterServer stuff to advapi
by Vijay Kiran Kamuju June 23, 2006

June 23, 2006

Hi All, I would like to move all the helper functions register_coclass,etc to a separate file in advapi.dll called regsvr_helper.c and all declarations of structs, consts moved to a separate file called, wineregsvr.h in include/wine So that it would be easy for other dlls to implement the DllRegisterServer and DllUnRegisterServer. And also clean up the code base. I need your suggestions, before i submit patches. Thanks, Vijay

3 6

LoadResource with module=0x00400000 followed by stack overflow
by Jan-Espen Pettersen June 23, 2006

June 23, 2006

I get this stack overflow exception while trying to run the Watchtower Library Setup on FreeBSD 6.1. I have extracted some debug lines which I think is relevant. Please ask if you need more information. 0009:Call ntdll.LdrFindResource_U(00400000,0034ecf0,00000003,0034ec8c) ret=9c266b12 0009:trace:resource:LdrFindResource_U module 0x400000 type #0006 name #0901 lang 0414 level 3 0009:trace:resource:find_entry_by_id root 0x40b000 dir 0x40b000 id 0006 ret 0x40b090 0009:trace:resource:find_entry_by_id root 0x40b000 dir 0x40b090 id 0901 ret 0x40bb98 0009:trace:resource:find_entry_by_id root 0x40b000 dir 0x40bb98 id 0414 ret 0x40d1c8 0009:Ret ntdll.LdrFindResource_U() retval=00000000 ret=9c266b12 0009:Ret kernel32.FindResourceExA() retval=0040d1c8 ret=00405ac0 0009:Call kernel32.LoadResource(00400000,0040d1c8) ret=00405ae4 0009:trace:resource:LoadResource 0x400000 0x40d1c8 0009:Call ntdll.LdrAccessResource(00400000,0040d1c8,0034ed48,00000000) ret=9c26807b 0009:trace:resource:access_resource access resource 0009:trace:resource:access_resource *ptr=0x4219d0 0009:Ret ntdll.LdrAccessResource() retval=00000000 ret=9c26807b 0009:Ret kernel32.LoadResource() retval=004219d0 ret=00405ae4 0009:Call ntdll.NtCreateEvent(0034e634,001f0003,0034e8dc,00000001,00000000) ret=9c22d14a 0009:Ret ntdll.NtCreateEvent() retval=00000000 ret=9c22d14a wine: Unhandled stack overflow at address 0x405b1d (thread 0009), starting debugger... (There was thread two (to 000b and back to 0009) context switches in between, which I filtered out) I single stepped the last instructions before the crash and found that it crashed while trying to write to the memory pointed to by the returned pointer from LoadResource. It loaded the address with some offset into register %esi and crashed at an andw instruction: First chance exception: stack overflow in 32-bit code (0x00405b1d). file_set_error: Bad address file_set_error: Bad address Register dump: CS:0033 SS:003b DS:003b ES:003b FS:1007 GS:001b EIP:00405b1d ESP:0035ee08 EBP:0035f224 EFLAGS:00010346( - 00 RITZP1) EAX:0000006c EBX:00000000 ECX:00000003 EDX:00000000 ESI:00421b5e EDI:00421a86 Stack dump: 0x0035ee08: 9c266cc0 0035f954 0035f230 00000000 0x0035ee18: 00401df3 00009003 0035f224 0035f958 0x0035ee28: 0035f954 00000000 9c086a19 9c0da2c0 0x0035ee38: 0035ee78 9c092b72 00120020 00000001 0x0035ee48: 9c086957 00000000 00000000 0035ee34 0x0035ee58: 005ca2c0 9c08b791 00167e10 00000000 0200: sel=1007 base=00110000 limit=00001fff 32-bit rw- Backtrace: =>1 0x00405b1d in setup (+0x5b1d) (0x00405b1d) 0x00405b1d: andw $0,0x0(%esi) Wine-dbg>info share Module Address Debug info Name (3 modules) PE 0x9c070000-9c0dd000 --none-- ntdll PE 0x9c210000-9c2f1000 --none-- kernel32 PE 0x00400000-0042b000 Export setup Can a win32 program expect that it has write access to the memory pointed to by the return value of LoadResource with module 0x00400000? Should LoadResource in some cases copy the memory and return a writeable copy of the resource? Jan-Espen Pettersen

2 1

ddraw assert prevents Ankh from starting
by Christoph Frick June 23, 2006

June 23, 2006

hiho on the end of this mail is a patch, that removes an assert(0) from the surface code in ddraw. but removing it let Ankh[1][2] start (it started before, but there where no loading screen visible). yet there are other problems with this game - but it now actually works better than before. so let the ddraw developers decide what to do there - this mail is just a reminder, that there is a poor little homeless assert, that needs your attention ;) [1] german demo: http://www.gamershell.com/download_12062.shtml [2] engl. demo: http://www.gamershell.com/download_12202.shtml -- cu Index: dlls/ddraw/surface.c =================================================================== RCS file: /home/wine/wine/dlls/ddraw/surface.c,v retrieving revision 1.4 diff -u -r1.4 surface.c --- dlls/ddraw/surface.c 19 Jun 2006 10:44:41 -0000 1.4 +++ dlls/ddraw/surface.c 20 Jun 2006 07:10:07 -0000 @@ -1865,7 +1865,6 @@ WINED3DFORMAT newFormat = WINED3DFMT_UNKNOWN; HRESULT hr; FIXME("(%p)->(%p,%lx)\n", This, DDSD, Flags); - assert(0); if(!DDSD) return DDERR_INVALIDPARAMS;

2 4

Re: riched20: EM_GETLINE implementation and test
by James Hawkins June 23, 2006

June 23, 2006

On 6/22/06, Krzysztof Foltman <wdev(a)foltman.com> wrote: > This patch seems to have been overlooked or rejected - yet I do not see > any reason being mentioned. > > Was it rejected because of use of L"" syntax? > Probably, L"" is not portable, and you have to use: static const WHCAR string[] = {'s','t','r','i','n','g',0}; -- James Hawkins

5 7

Re: [AppDB] - protect sql insert statements from injection attacks
by Chris Morgan June 23, 2006

June 23, 2006

Here is the new version. I've switched to the fully expanded method of writing out the sql. This is the same format used by several db wrapper libraries, in prepared sql statements and is the recommended style under c#/.net for queries. I've tested creating new users and distributions and submitting an application. Chris On Friday 23 June 2006 1:05 am, Chris Morgan wrote: > On Thursday 22 June 2006 10:21 pm, Tony Lambregts wrote: > > Chris Morgan wrote: > > > Change compile_insert_string() to compile_insert_array() and add a new > > > first parameter of $sTable that represents the table you are building > > > the insert statement for. The output of compile_insert_array() is > > > passed to query_insert() to perform the insertion. Change all existing > > > calls of compile_insert_string() to compile_insert_array() and specify > > > the table as the first parameter. Make all instances of sql inserts > > > that didn't use compile_insert_string() use compile_insert_array(). > > > > > > The use of mysql_real_escape_string() inside of compile_insert_array() > > > protects the insert statement from sql injection attacks. > > > > > > Chris > > > > Just a couple of nits > > > > This Could have been broken before but when I try to edit a bundle I > > get: *Database Error!* > > Query: SELECT bundleId, appBundle.appId, appName FROM appBundle, > > appFamily WHERE bundleId = AND appFamily.appId = appBundle.appId > > You have an error in your SQL syntax; check the manual that corresponds > > to your MySQL server version for the right syntax to use near 'AND > > appFamily.appId = appBundle.appId' at line 1 > > This is fixed now. Was broken all the way back to the import into cvs :-) > > > This is probably broken from before (makesafe?) but I cannot create a > > new distribution. > > Yes, makesafe changes broke this. Fixed now. > > > Here is a big one though. I cannot create a new account. I just get a > > blank screen. This is .new see below > > > > You could have broken the patch in two IE: > > > > Change log: The use of mysql_real_escape_string() on inserts to protect > > from sql injection attacks. > > > > Files changed: > > include/application.php / > > include/bugs.php / > > include/category.php / > > include/comment.php / > > include/db.php / > > include/distributions.php > > include/monitor.php / > > include/note.php / > > include/screenshot.php > > include/testResults.php / > > include/url.php / > > include/user.php / > > include/util.php / > > include/vendor.php / > > include/version.php / > > > > Change log: Make all remaining instances of sql inserts use > > compile_insert_array(). > > > > Files changed: > > maintainersubmit.php / > > admin/adminAppDataQueue.php / > > admin/editBundle.php / > > include/appdb.php / > > include/vote.php / > > > > I'm not say you should have just that it could have been done that way. > > > > You should include the "change log:" and "files changed:" to the patch > > the files. "Changed files: really helps in that it gives you an > > overview of the scope of the patch. > > > > > ----------------------------------------------------------------------- > > >- > > > > > > ? compile_insert_array.patch > > > ? hits_table_alter > > > ? injection_protect.patch > > > ? injection_protect2.patch > > > ? limittestresults.patch4 > > > ? vote_table_alter > > > ? data/screenshots > > > > Last really trivial nit (these are not really part of the patch) > > > > > Index: include/user.php > > > =================================================================== > > > RCS file: /opt/cvs-commit/appdb/include/user.php,v > > > retrieving revision 1.67 > > > diff -u -r1.67 user.php > > > --- include/user.php 21 Jun 2006 01:04:13 -0000 1.67 > > > +++ include/user.php 22 Jun 2006 20:07:17 -0000 > > > @@ -83,14 +83,15 @@ > > > return false; > > > } else > > > { > > > - $aInsert = compile_insert_string(array( 'realname' => > > > $sRealname, > > > - 'email' => > > > $sEmail, - > > > 'CVSrelease' => $sWineRelease )); > > > + $aInsert = compile_insert_array("user_list", > > > + array( 'realname' => > > > $sRealname, > > > + 'email' => > > > $sEmail, > > > + 'CVSrelease' => > > > $sWineRelease, > > > + 'password' => > > > password($sPassword), > > > + 'stamp' => > > > "NOW()", > > > + 'created' => > > > "NOW()")); > > > > I remember fighting with this before. password() and NOW() cannot be > > put into the array like this I do not have an easy answer for this at > > all at this point > > > > > - $sFields = "({$aInsert['FIELDS']}, `password`, `stamp`, > > > `created`)"; > > > - $sValues = "({$aInsert['VALUES']}, > > > password('".$sPassword."'), NOW(), NOW() )"; > > > - > > > - query_appdb("INSERT INTO user_list $sFields VALUES > > > $sValues", "Error while creating a new user."); > > > + query_insert($aInsert, "Error while creating a new > > > user."); > > > > > > $retval = $this->login($sEmail, $sPassword); > > > $this->setPref("comments:mode", "threaded"); /* set the > > > users default comments:mode to threaded */ > > > @@ -183,7 +184,11 @@ > > > return false; > > > > > > $hResult = query_appdb("DELETE FROM user_prefs WHERE userid = > > > ".$this->iUserId." AND name = '$sKey'"); > > > - $hResult = query_appdb("INSERT INTO user_prefs > > > VALUES(".$this->iUserId.", '$sKey', '$sValue')"); > > > + $aInsert = compile_insert_array("user_prefs", > > > + array( 'userid' => > > > $this->iUserId, > > > + 'name' => $sKey, > > > + 'value' => $sValue)); > > > + $hResult = query_insert($aInsert); > > > return $hResult; > > > } > > > > Other than that its clean. We need to find a way of fixing new > > accounts though. > > > > -- > > > > Tony Lambregts > > I've got a fix for this. The basic jist is to simply get rid of > compile_insert_array() and use a fancier version of query_parameter() that > uses pear db replacement operators. There isn't any other way to know > whether any given variable should be surrounded with '' or not > escaped(something else that is useful in certain cases apparently). Should > have this change in place soon. > > Chris

1 0

CFileDialog::OnFolderChange() problem with Customized file open dialog
by Dan Kegel June 23, 2006

June 23, 2006

Ravinder wrote: > I am currently working on making a windows program function in > wine. it works for the most part, so i'm trying to iron out a > few critical bugs. first off... i'm looking at microsoft's > CFileDialog class - it is what the standard windows 'open > file' and 'save file' dialog windows use. the problem is this: > CFileDialog has a built in function called OnFolderChange, that > is used to determine whether the user has changed folders in the > dialog, whether by double click or what not.. the program i'm > working on overrides the CFileDialog class, and includes more > code for the OnFolderChange function (and for other functions) > for its own purposes. the new OnFolderChange function works > perfectly fine in windows, but is completely ignored when using > wine - it never even gets called, while the rest of the dialog > window retains all of its intended functionality. I see you've filed http://bugs.winehq.org/show_bug.cgi?id=5475 about on Jonathan Ernst's advice. Good advice! But be sure to add the full source code and project file for your sample code, as some people do have Visual C++, and will want to build it and step through. ATL problems are, I suspect, hard to diagnose because it requires understanding a bit about how ATL works under the hood, which few people do. If you're in a hurry for a solution, you could engage Codeweavers to solve problems like this. - Dan -- Wine for Windows ISVs: http://kegel.com/wine/isv

1 0

Re: riched20: (updated) EM_GETLINE implementation and test
by James Hawkins June 22, 2006

June 22, 2006

On 6/22/06, Krzysztof Foltman <wdev(a)foltman.com> wrote: > This is the EM_GETLINE patch from Thomas Kho, updated to current git and > with L"" replaced by proper WCHAR array. > > Krzysztof > > ====================================================== > > Hi, > > The following patch implements EM_GETLINE. This feature was requested in > bug #4305 <http://bugs.winehq.org/show_bug.cgi?id=4305> and also > mentioned at > <http://groups.google.com/group/comp.emulators.ms-windows.wine/msg/f89762653…> > > Regards, > > Thomas Kho > > > diff --git a/dlls/riched20/editor.c b/dlls/riched20/editor.c > index 9a2b966..23538ab 100644 > --- a/dlls/riched20/editor.c > +++ b/dlls/riched20/editor.c ... > @@ -2016,6 +2016,62 @@ LRESULT WINAPI RichEditANSIWndProc(HWND > return nChars; > } > } > + case EM_GETLINE: > + { > + ME_DisplayItem *run; > + ME_String *strText; > + int nMaxChars = (int) *(WORD *) lParam; > + int nBPC = 1; /* bytes per character */ > + int nEndChars; > + char *dest = (char *) lParam; > + > + TRACE("EM_GETLINE: row=%d, nMaxChars=%d (%s)\n", (int) wParam, nMaxChars, > + IsWindowUnicode(hWnd) ? "Unicode" : "Ansi"); > + A case this long should be moved into its own function and called from case EM_GETLINE. In fact, most of these should probably be factored into separated functions to reduce clutter. As it stands, RichEditANSIWndProc is a 1048 line function...yikes. -- James Hawkins

1 0

Re: OleView: Added CreateInstanceOn functionality
by James Hawkins June 22, 2006

June 22, 2006

On 6/22/06, Piotr Caban <piotr.caban(a)gmail.com> wrote: > Hi, > > Changelog: > - Added CreateInstanceOn functionality > Make sure you label a series of patches as OleView [1/x] etc. where x is the total number of patches, so if they are received out of order, Alexandre knows what order to apply them in. -- James Hawkins

1 0

Re: msi: Load all components, not just components associated with a feature
by James Hawkins June 22, 2006

June 22, 2006

On 6/21/06, James Hawkins <truiken(a)gmail.com> wrote: > Hi, > > This fixes bug 3590. > > Changelog: > * Load all components, not just components associated with a feature. > Ignore this patch, it's not correct. -- James Hawkins

1 0