October 2011 - Wine-Devel - list.winehq.org

For review please: wineps.drv: Implement PS_USERSTYLE on printers

by Daniel

Hello guys. I would like to get a little review on this patch, a follow up to the patches that fix this problem on the screen. Specifically, I'm most concerned about making sure my dynamically allocated memory is freed under all conditions and there's no potential snafus that I'm not aware of. Then, of course, if somebody sees something off, please do comment. It does indeed completely fix http://bugs.winehq.org/show_bug.cgi?id=26091 (printed a cute piece of music with dashed lines). Thanks all! Daniel

Oct. 13, 2011

Re: [Wine] WineHQ database compromise

by Maarten Lankhorst

Hey, On 10/12/2011 12:46 AM, Josh Juran wrote: > On Oct 11, 2011, at 3:37 PM, Conan Kudo (ニール・ゴンパ) wrote: > >> On Tue, Oct 11, 2011 at 3:39 PM, Josh Juran <josh(a)iswifter.net> wrote: >> >>> Since bugzilla passwords were sent in cleartext anyway, I sincerely hope none of them were otherwise valuable. (Remember FireSheep?) >> Wait, what? Bugzilla sends passwords in cleartext? That isn't very smart... Is there no way to replace this with some sort of client based hashing or something? > To clarify, your browser sends your password to bugzilla in cleartext, since HTTPS isn't an option. > > Firesheep was a lesson that even once passwords are secure, session credentials are still vulnerable to sniffing. Some sites went to HTTPS-only sessions after that. > If I go to any https://*.winehq.org website I get the certificate for test.winehq.org , otherwise you could use the firefox https anywhere to force https on. Or better yet, force automatic redirect to https, with Strict-Transport-Security: https://hacks.mozilla.org/2010/08/firefox-4-http-strict-transport-security-… If winehq can't get more ips for every subdomain (ssl sucks), would the solution be moving it to https://winehq.org/{bugs,appdb,test,source} ? Cheers, Maarten

Oct. 13, 2011

Re: ddraw: Keep track of interface attached by AddAttachedSurface and detach correct interface when parent is released. (try 3)

by Saulius Krasuckas

Hello, Octavian. * On Tue, 11 Oct 2011, Octavian Voicu wrote: > > try 3: > - fix test failure by moving error check from *_DeleteAttachedSurface to > ddraw_surface_delete_attached_surface, after another check (thanks Henri). > > try 2: > - use IUnknown_Release(attached_iface) instead of manual dispatch, > as suggested by Henri; > - change type of attached_iface from void* to IUnknown* to reflect > fact that it's a pointer to an interface; > - add test to show that attaching a surface only attaches a specific > interface and return error if DeleteAttachedSurface is called with > another interface than the attached one (instead of detaching the > surface anyway). > > Fixes a bug that causes a stencil buffer leak in the game The Longest Journey. > Problem can be seen in the console output log attached to bug #11819. > This patch doesn't fix the original bug, but now game exits cleanly. > > The root of the problem is that when releasing a surface, its attached > surfaces are detached using IDirectDraw7_DeleteAttachedSurface, regardless > of what interface was originally attached. I am troubled by seeing (via test.winehq.org) your ddraw:refcount tests to account only results for "VMware SVGA 3D" adapter/driver (and only those with 3D acceleration disabled), I guess. But if this driver is 3D-enabled or just present real physical adapter (with no 3d acceleration) then ddraw:refcount contains 6 static failures such as: refcount.c:214: Test failed: AddAttachedSurface returned 8876000a refcount.c:235: Test failed: AddAttachedSurface returned 8876000a refcount.c:237: Test failed: Got refcount 1, expected 2 refcount.c:262: Test failed: AddAttachedSurface returned 8876000a refcount.c:275: Test failed: AddAttachedSurface returned 8876000a refcount.c:277: Test failed: Got refcount 1, expected 2 refcount: 112 tests executed (0 marked as todo, 6 failures), 0 skipped This relation can be easily tracked by looking at d3d9:visual or (if they aren't present) at opengl32:opgenl tests. Eg. failures occuring here: * Intel(R) 82865G Graphics Controller http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/xp_af-… http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/xp_af-… * NVIDIA GeForce FX 5200 http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/win7_s… http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/win7_s… http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/xp_s2-… http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/xp_s2-… * ATI Radeon HD 4800 Series (telling it has no IDirect3D[7] support for DDraw) http://test.winehq.org/data/a843acef5567bc30901612ce5013da543259b21b/win7_w… http://test.winehq.org/data/a843acef5567bc30901612ce5013da543259b21b/win7_w… * VMware SVGA II http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/2000_f… http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/2000_f… http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/2000_f… http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/2000_f… * VMware SVGA 3D (telling it has not IDirect3D[7] support for DDraw) http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/win7_f… http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/win7_f… All other cases succeed. AFAICS all of them represent the only driver (with 3D support turned off): * VMware SVGA 3D http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/win7_w… visual.c:194: Driver string: "vm3dum.dll" visual.c:195: Description string: "VMware SVGA 3D (Microsoft Corporation - WDDM)" visual.c:197: Device name string: "\\.\DISPLAY1" visual.c:199: Driver version 7.14.1.40 visual.c:12627: Tests skipped: Creating the device failed visual: 5 tests executed (0 marked as todo, 0 failures), 1 skipped. with following results: http://test.winehq.org/data/d0c38ece9db657431559024abb34285cd8b717b6/win7_w… refcount: 121 tests executed (0 marked as todo, 0 failures), 0 skipped. IMHO, it would be nice to conform to real world configuration. Wish you best luck with fixing your tests:) S.

Oct. 13, 2011

Re: 79869: [2/4] gdi32: remove PS_USERSTYLE FIXME and work-arounds (take 4)

by Dan Kegel

Still fails tests here. Sorry if I wasn't clear before. The wine tests are supposed to pass after *every* patch in your series. That means you have to merge patches 2 and 3 together, I think. On Wed, Oct 12, 2011 at 9:27 PM, <buildbot(a)kegel.com> wrote: > This is an experimental automated build and test service. > Please feel free to ignore this email while we work the kinks out. > > For more info about this message, see http://wiki.winehq.org/BuildBot > > The Buildbot has detected a failed build on builder runtests-default while building Wine. > Full details are available at: http://buildbot.kegel.com/builders/runtests-default/builds/297 (though maybe not for long, as I'm still reinstalling the buildbot periodically while experimenting) > BUILD FAILED: failed shell_3 > > Errors: > alarum: failed command was ../../../wine gdi32_test.exe.so pen.c > pen.c:317: Test succeeded inside todo block: expected 7, got 7 > make: *** [pen.ok] Error 1 > * Call to xpconnect wrapped JSObject produced this error: * > * Call to xpconnect wrapped JSObject produced this error: * > GnuTLS error: GnuTLS internal error. > >

Oct. 12, 2011

Re: ntdll: Define PATH_MAX when needed

by Dmitry Timoshkov

André Hentschel <nerv(a)dawncrow.de> wrote: > Am 12.10.2011 23:53, schrieb Dan Kegel: > > When is PATH_MAX not defined? > > > > It's part of posix (see > > http://pubs.opengroup.org/onlinepubs/009695399/basedefs/limits.h.html > > ) > > > > Are you trying to build on Gnu Hurd? > > Yes that's for Hurd. Austin already pointed out dynamic allocation might be a better solution, so... Notice that PATH_MAX and MAX_PATH are completely different things going from different sources which can't be replaced by each other. -- Dmitry.

Oct. 12, 2011

Re: [Wine] WineHQ database compromise

by Marcus Meissner

On Thu, Oct 13, 2011 at 10:23:58AM +0200, Maarten Lankhorst wrote: > Hey, > > On 10/12/2011 12:46 AM, Josh Juran wrote: > > On Oct 11, 2011, at 3:37 PM, Conan Kudo (ニール・ゴンパ) wrote: > > > >> On Tue, Oct 11, 2011 at 3:39 PM, Josh Juran <josh(a)iswifter.net> wrote: > >> > >>> Since bugzilla passwords were sent in cleartext anyway, I sincerely hope none of them were otherwise valuable. (Remember FireSheep?) > >> Wait, what? Bugzilla sends passwords in cleartext? That isn't very smart... Is there no way to replace this with some sort of client based hashing or something? > > To clarify, your browser sends your password to bugzilla in cleartext, since HTTPS isn't an option. > > > > Firesheep was a lesson that even once passwords are secure, session credentials are still vulnerable to sniffing. Some sites went to HTTPS-only sessions after that. > > > If I go to any https://*.winehq.org website I get the certificate for test.winehq.org , otherwise you could use the firefox https anywhere to force https on. > > Or better yet, force automatic redirect to https, with Strict-Transport-Security: > https://hacks.mozilla.org/2010/08/firefox-4-http-strict-transport-security-… > > If winehq can't get more ips for every subdomain (ssl sucks), would the solution be moving it to https://winehq.org/{bugs,appdb,test,source} ? Or a wildcard SSL cert for *.winehq.org. Ciao, Marcus

Oct. 12, 2011

Re: [4/3] gdi32/tests: update test for PS_USERSTYLE

by Daniel

Yeah, I'll recombine them in a bit, but I didn't really remove the test, per-se, I removed the if/else that performs the test with todo_wine when the style is PS_USERSTYLE (see the line below, that, of course, is improperly indented -- why I don't allow single statements in if, else, while, etc. without a {} block in my own projects). Daniel On 10/12/2011 07:12 PM, Austin English wrote: > On Wed, Oct 12, 2011 at 19:06, Daniel <danielfsantos(a)att.net> wrote: >> OK, I hope [4/3] is acceptable. These are the test updates I forgot >> (removes a todo_wine). > Two problems: > A) It needs to be combined with the original patch, so that it passes make test. > B) Why remove the test? Just remove 'todo_wine' itself, since the test > now passes on wine.. >

Oct. 12, 2011

re: [4/3] gdi32/tests: update test for PS_USERSTYLE

by Dan Kegel

> OK, I hope [4/3] is acceptable. It's fine for humans, but for buildbot, you really need to send the whole patch series again, with the test fixes right in the same patch as the code that fixes them (so that the wine tree passes all tests after each patch in the series). Otherwise your code will not be tested.

Oct. 12, 2011

Re: [4/3] gdi32/tests: update test for PS_USERSTYLE

by Austin English

On Wed, Oct 12, 2011 at 19:06, Daniel <danielfsantos(a)att.net> wrote: > OK, I hope [4/3] is acceptable. These are the test updates I forgot > (removes a todo_wine). Two problems: A) It needs to be combined with the original patch, so that it passes make test. B) Why remove the test? Just remove 'todo_wine' itself, since the test now passes on wine.. -- -Austin

Oct. 12, 2011

Re: 79857: [2/3] gdi32: remove PS_USERSTYLE FIXME and work-arounds (take 3)

by Daniel

> Fails the gdi32/pen.ok test here, with error > pen.c:317: Test succeeded inside todo block: expected 7, got 7 > > Looks like you need to update a test. whoops, I forgot about my tests. Will do.

Oct. 12, 2011

Re: 79857: [2/3] gdi32: remove PS_USERSTYLE FIXME and work-arounds (take 3)

by Dan Kegel

Fails the gdi32/pen.ok test here, with error pen.c:317: Test succeeded inside todo block: expected 7, got 7 Looks like you need to update a test. On Wed, Oct 12, 2011 at 4:00 PM, <buildbot(a)kegel.com> wrote: > This is an experimental automated build and test service. > Please feel free to ignore this email while we work the kinks out. > > For more info about this message, see http://wiki.winehq.org/BuildBot > > The Buildbot has detected a failed build on builder runtests-default while building Wine. > Full details are available at: http://buildbot.kegel.com/builders/runtests-default/builds/280 (though maybe not for long, as I'm still reinstalling the buildbot periodically while experimenting) > BUILD FAILED: failed shell_3 > > Errors: > alarum: failed command was ../../../wine gdi32_test.exe.so pen.c > pen.c:317: Test succeeded inside todo block: expected 7, got 7 > make: *** [pen.ok] Error 1 > * Call to xpconnect wrapped JSObject produced this error: * > * Call to xpconnect wrapped JSObject produced this error: * > GnuTLS error: GnuTLS internal error. > >

Oct. 12, 2011

[RFC] Use ICU in wine ?

by Rafał Mużyło

On Mon Oct 10 12:48:27 CDT 2011, André Hentschel wrote a few things: Well, in the bug you've mentioned (#5163) there was a link to that file in mono, but while it seems nice, just looking at mono code makes my eyes bleed and the perspective of rewriting it in perl would fill me with terror. There's also the question of how close did mono get to Windows in this case. Still, that would at most fixed the default table, the tailoring needs to be implemented anyway.

Oct. 12, 2011

Re: ntdll: Define PATH_MAX when needed

by André Hentschel

Am 12.10.2011 23:53, schrieb Dan Kegel: > When is PATH_MAX not defined? > > It's part of posix (see > http://pubs.opengroup.org/onlinepubs/009695399/basedefs/limits.h.html > ) > > Are you trying to build on Gnu Hurd? Yes that's for Hurd. Austin already pointed out dynamic allocation might be a better solution, so... -- Best Regards, André Hentschel

Oct. 12, 2011

Re: wined3d: Report every texture format as filterable and blendable.

by Matteo Bruni

2011/10/12 Dan Kegel <dank(a)kegel.com>: > Fails d3d9's visual tests here. > > os: Linux 3.0.0-12-generic, Ubuntu 11.10 > gpu: GeForce GT 240/PCI/SSE2 3.3.0 NVIDIA 280.13 > > On Wed, Oct 12, 2011 at 2:52 PM, <buildbot(a)kegel.com> wrote: >> This is an experimental automated build and test service. >> Please feel free to ignore this email while we work the kinks out. >> >> For more info about this message, see http://wiki.winehq.org/BuildBot >> >> The Buildbot has detected a failed build on builder runtests-default while building Wine. >> Full details are available at: http://buildbot.kegel.com/builders/runtests-default/builds/273 (though maybe not for long, as I'm still reinstalling the buildbot periodically while experimenting) >> BUILD FAILED: failed shell_3 >> >> Errors: >> alarum: failed command was ../../../wine d3d9_test.exe.so visual.c >> fixme:win:EnumDisplayDevicesW ((null),0,0x33f0cc,0x00000000), stub! >> fixme:d3d_draw:drawPrimitive Using software emulation because manual fog coordinates are provided >> fixme:d3d:state_shademode WINED3DSHADE_PHONG isn't supported >> fixme:d3d:state_shademode WINED3DSHADE_PHONG isn't supported >> visual.c:9147: Tests skipped: D3DFMT_G16R16 textures not supported as render targets. >> visual.c:9239: Test failed: Offscreen failed for D3DFMT_R16F: Got color 0x20ffff, expected 0x18ffff. >> visual.c:9239: Test failed: Offscreen failed for D3DFMT_G16R16F: Got color 0x2010ff, expected 0x1818ff. >> visual.c:9239: Test failed: Offscreen failed for D3DFMT_R32F: Got color 0x20ffff, expected 0x18ffff. >> visual.c:9239: Test failed: Offscreen failed for D3DFMT_G32R32F: Got color 0x2010ff, expected 0x1818ff. >> visual.c:9239: Test failed: Offscreen failed for D3DFMT_A32B32G32R32F: Got color 0x201000, expected 0x181800. >> visual.c:7741: Tests skipped: Card has unconditional pow2 support, skipping conditional NP2 tests >> make: *** [visual.ok] Error 5 >> * Call to xpconnect wrapped JSObject produced this error: * >> * Call to xpconnect wrapped JSObject produced this error: * >> GnuTLS error: GnuTLS internal error. >> >> > Interesting. I didn't test on your kind of GPUs but I understood that it should support the feature I'm enabling. I'm not sure right now if it really doesn't support it or it is a driver bug of some kind. Thank you for catching it, if you have Windows installed on that machine I'll probably ask you to run a small testcase soon...

Oct. 12, 2011

Re: wined3d: Report every texture format as filterable and blendable.

by Dan Kegel

Fails d3d9's visual tests here. os: Linux 3.0.0-12-generic, Ubuntu 11.10 gpu: GeForce GT 240/PCI/SSE2 3.3.0 NVIDIA 280.13 On Wed, Oct 12, 2011 at 2:52 PM, <buildbot(a)kegel.com> wrote: > This is an experimental automated build and test service. > Please feel free to ignore this email while we work the kinks out. > > For more info about this message, see http://wiki.winehq.org/BuildBot > > The Buildbot has detected a failed build on builder runtests-default while building Wine. > Full details are available at: http://buildbot.kegel.com/builders/runtests-default/builds/273 (though maybe not for long, as I'm still reinstalling the buildbot periodically while experimenting) > BUILD FAILED: failed shell_3 > > Errors: > alarum: failed command was ../../../wine d3d9_test.exe.so visual.c > fixme:win:EnumDisplayDevicesW ((null),0,0x33f0cc,0x00000000), stub! > fixme:d3d_draw:drawPrimitive Using software emulation because manual fog coordinates are provided > fixme:d3d:state_shademode WINED3DSHADE_PHONG isn't supported > fixme:d3d:state_shademode WINED3DSHADE_PHONG isn't supported > visual.c:9147: Tests skipped: D3DFMT_G16R16 textures not supported as render targets. > visual.c:9239: Test failed: Offscreen failed for D3DFMT_R16F: Got color 0x20ffff, expected 0x18ffff. > visual.c:9239: Test failed: Offscreen failed for D3DFMT_G16R16F: Got color 0x2010ff, expected 0x1818ff. > visual.c:9239: Test failed: Offscreen failed for D3DFMT_R32F: Got color 0x20ffff, expected 0x18ffff. > visual.c:9239: Test failed: Offscreen failed for D3DFMT_G32R32F: Got color 0x2010ff, expected 0x1818ff. > visual.c:9239: Test failed: Offscreen failed for D3DFMT_A32B32G32R32F: Got color 0x201000, expected 0x181800. > visual.c:7741: Tests skipped: Card has unconditional pow2 support, skipping conditional NP2 tests > make: *** [visual.ok] Error 5 > * Call to xpconnect wrapped JSObject produced this error: * > * Call to xpconnect wrapped JSObject produced this error: * > GnuTLS error: GnuTLS internal error. > >

Oct. 12, 2011

re: ntdll: Define PATH_MAX when needed

by Dan Kegel

When is PATH_MAX not defined? It's part of posix (see http://pubs.opengroup.org/onlinepubs/009695399/basedefs/limits.h.html ) Are you trying to build on Gnu Hurd?

Oct. 12, 2011

Please Test again, user32: use uniscribe in the single line edit control

by Aric Stewart

Apologies I sent this to the wrong list just now. Ok, Thanks to Dan I have found and corrected the issues that this created with the tests. I believe all the tests should continue to pass with this version of the patch. Has anyone tried it live in any applications? -aric --- dlls/user32/edit.c | 252 +++++++++++++++++++++++++++++----------------------- 1 files changed, 142 insertions(+), 110 deletions(-)

Oct. 12, 2011

Re: shell32/tests: Better check the result of SHGetDesktopFolder

by Austin English

2011/10/12 André Hentschel <nerv(a)dawncrow.de>: > Might fix the crash in some NT4 systems > --- > dlls/shell32/tests/brsfolder.c | 3 ++- > 1 files changed, 2 insertions(+), 1 deletions(-) > > diff --git a/dlls/shell32/tests/brsfolder.c b/dlls/shell32/tests/brsfolder.c > index 7b87967..6e5e73b 100644 > --- a/dlls/shell32/tests/brsfolder.c > +++ b/dlls/shell32/tests/brsfolder.c > @@ -331,7 +331,8 @@ static void test_selection(void) > > hr = SHGetDesktopFolder(&desktop_object); > ok (SUCCEEDED(hr), "SHGetDesktopFolder failed with hr 0x%08x\n", hr); > - if (FAILED(hr)) { > + ok (desktop_object, "Expected desktop_object to be a valid interface\n"); > + if (FAILED(hr) || !desktop_object) { > skip("SHGetDesktopFolder failed - skipping\n"); > return; > } > -- > > Best Regards, André Hentschel Causes a compiler warning on Buildbot: Errors: brsfolder.c: In function 'test_selection': brsfolder.c:334:5: error: passing argument 1 of 'winetest_ok' makes integer from pointer without a cast [-Werror] make[1]: *** [brsfolder.o] Error 1 -- -Austin

Oct. 12, 2011

Re: Warning report for wine-1.3.30-55-g583e887

by Josh Juran

On Oct 12, 2011, at 1:31 PM, Octavian Voicu wrote: > On Wed, Oct 12, 2011 at 11:22 PM, Josh Juran <josh(a)iswifter.net> wrote: >> My understanding is that accessing element n or greater in an array[n] >> is undefined behavior, but declaring a huge array and allocating only >> part of it is valid. > > It's a commonly used pattern in C. Agreed. > You declare a size-one array at the > end of a structure, then you allocate enough memory to hold the > structure plus (n-1) extra elements of the array. In wine size is > usually calculated with the macro FIELD_OFFSET(struct, member[size]). I understand. I'm just passing on what I read on another mailing list, which is that the construction is non-portable (even if it happens to work everywhere), and that might be the justification for the warning. A purist approach would call for avoiding this idiom, but pragmatically, disabling the warning is sufficient. Josh

Oct. 12, 2011

Re: Warning report for wine-1.3.30-55-g583e887

by Octavian Voicu

On Wed, Oct 12, 2011 at 11:22 PM, Josh Juran <josh(a)iswifter.net> wrote: > My understanding is that accessing element n or greater in an array[n] > is undefined behavior, but declaring a huge array and allocating only > part of it is valid. It's a commonly used pattern in C. You declare a size-one array at the end of a structure, then you allocate enough memory to hold the structure plus (n-1) extra elements of the array. In wine size is usually calculated with the macro FIELD_OFFSET(struct, member[size]). Octavian

Oct. 12, 2011

Re: Warning report for wine-1.3.30-55-g583e887

by Josh Juran

On Oct 12, 2011, at 10:11 AM, Dmitry Timoshkov wrote: > Jerome Leclanche <adys.wh(a)gmail.com> wrote: > >> It would be nice to fix the "array subscript is above array bounds" >> warning spam for 1.4.0. They make up 90% of the warnings. > > The compiler is misguided, you can safely ignore those warnings. My understanding is that accessing element n or greater in an array[n] is undefined behavior, but declaring a huge array and allocating only part of it is valid. Josh

Oct. 12, 2011

Re: Warning report for wine-1.3.30-55-g583e887

by Michael Stefaniuc

On 10/12/2011 02:29 PM, Jerome Leclanche wrote: > It would be nice to fix the "array subscript is above array bounds" > warning spam for 1.4.0. They make up 90% of the warnings. The fix would be to add a configure check for that bogus warning on access to the array[n]; n > 1 struct _tag { ... array[1]; } and to add -Wno-array-bounds in that case. bye michael

Oct. 12, 2011

Re: [Corrected^2] dlls/ntdll/serial.c: Generate a single EV_TXEMPTY when the\ TX buffer turns empty

by Alexandre Julliard

Uwe Bonnes <bon(a)elektron.ikp.physik.tu-darmstadt.de> writes: > @@ -807,8 +808,22 @@ typedef struct async_commio > static NTSTATUS get_irq_info(int fd, serial_irq_info *irq_info) > { > NTSTATUS status = STATUS_NOT_IMPLEMENTED; > -#ifdef TIOCGICOUNT > struct serial_icounter_struct einfo; You can't move this out of the #idef. -- Alexandre Julliard julliard(a)winehq.org

Oct. 12, 2011

Re: WineHQ database compromise

by GOUJON Alexandre

On 10/11/2011 09:13 PM, Jeremy White wrote: > I am sad to say that there was a compromise of the WineHQ database system. "Nothing Is Invulnerable" So, now or later, your system will be compromised. The only thing you have to do is to be prepared to face an incident and of course secure your systems to slow the attacker(s) down. The bugzilla case does not really worry me because it's only bugs. But as CEO, you have to protect your company and your customers. I'm of course a simple "user" of wine and I have absolutely not the right to tell you what to do. But something was open, broken or whatever .. and now you have to spend time and energy to try to repair the breach. Just don't let it happen again. There are lots of methods to analyse risk. Depending on what level of security you want, it will cost more or less. Just think about it. Anyway, thanks for the quick reply, communication is really important in this situation.

Oct. 12, 2011

Re: Warning report for wine-1.3.30-55-g583e887

by Dmitry Timoshkov

Jerome Leclanche <adys.wh(a)gmail.com> wrote: > It would be nice to fix the "array subscript is above array bounds" > warning spam for 1.4.0. They make up 90% of the warnings. The compiler is misguided, you can safely ignore those warnings. -- Dmitry.

Oct. 12, 2011

Re: d3d8/tests: skip the visual test if d3d cannot be initialized

by Austin English

On Wed, Oct 12, 2011 at 04:39, Henri Verbeet <hverbeet(a)gmail.com> wrote: > On 12 October 2011 01:51, Austin English <austinenglish(a)gmail.com> wrote: >> Current d3d8 does a win_skip(), while d3d9 does a skip(). This unifies >> the behavior to match the d3d9 behavior. >> > I seem to recall this being intentional, so that you get a failure if > your setup has e.g. no OpenGL. If the goal is to ensure some test fails with that setup, opengl32/tests/opengl.c already ensures that: ../../../tools/runtest -q -P wine -M opengl32.dll -T ../../.. -p opengl32_test.exe.so opengl.c && touch opengl.ok err:wgl:X11DRV_WineGL_InitOpenglInfo couldn't initialize OpenGL, expect problems opengl.c:1295: Test failed: Unable to find pixel format. *** Error code 1 I was looking to make d3d8/d3d9 consistent. Instead we could make d3d9 fail if OpenGL isn't available, as d3d8 does now. -- -Austin

Oct. 12, 2011

Re: [4/4] wined3d: Don't allow fbo blits to frontbuffers that need fixups.

by Stefan Dösinger

On Wednesday 12 October 2011 11:35:48 Henri Verbeet wrote: > On 11 October 2011 22:31, Stefan Dösinger <stefan(a)codeweavers.com> wrote: > > static BOOL fbo_blit_supported(const struct wined3d_gl_info *gl_info, > > enum wined3d_blit_op blit_op, > > > > const RECT *src_rect, DWORD src_usage, WINED3DPOOL src_pool, > > const struct wined3d_format *src_format, > > > > - const RECT *dst_rect, DWORD dst_usage, WINED3DPOOL dst_pool, > > const struct wined3d_format *dst_format) + const RECT *dst_rect, > > DWORD dst_usage, WINED3DPOOL dst_pool, const struct wined3d_format > > *dst_format, + const struct wined3d_surface *dst_surface) > > I don't think we want this. Does this actually ever happen? I had to double-check this. It used to be a problem before you introduced the shadow ddraw frontbuffer. Now it works by luck because the shadow frontbuffer has a palette set and is converted on upload time, so it is a RGB surface that doesn't need read-time conversion. There are two things that make the fbo blit work correctly although it should be broken: *) The offscreen P8 surfaces should be converted with the destination's palette. The palette happens to be the same for the shadow frontbuffer, but for no other surface. *) The shadow frontbuffer has SFLAG_CONVERTED set. Thus blits to it happen in software, otherwise we'd write P8 data to it that had no palette when it was converted to RGB(the ERR in d3dfmt_p8_init_palette). So in the end we never happen to have a P8 surface that only has GL_ALPHA8 data right now. No surface uses COMPLEX_FIXUP_P8 right now. It will be a problem again once we load offscreen surfaces(render target or just offscreenplain) with GL_ALPHA8 textures that require COMPLEX_FIXUP_P8. I'll send the patch again with the patchset that re-enables shader P8 conversion. And yeah, we don't actually want to pass the destination surface to fbo_blit_supported. It can go away again once we have the shadow frontbuffers in wined3d instead of ddraw. The ARB and FFP blitter have a similar problem when blitting to onscreen P8 surfaces, but unlike the FBO blitter they can do the palette lookup. They can accept the blit no matter what the destination is, but they have to make sure to select the right color fixup and palette.

Oct. 12, 2011

Re: 79794: Help Test Please: use uniscribe in the single line edit control

by Aric Stewart

Thank Dan, I had not gotten to a full test run. I will look into those. -aric On 10/11/11 8:01 PM, Dan Kegel wrote: > Hi Aric, > failed again on second run, > http://buildbot.kegel.com:8010/builders/runtests-default/builds/209 > > Failing tests are > comctl32_test.exe.so listview.c > comctl32_test.exe.so updown.c > user32_test.exe.so edit.c > > On Tue, Oct 11, 2011 at 1:26 PM, Dan Kegel<dank(a)kegel.com> wrote: >> Hey Aric, >> don't know if I trust the bot at the moment, but it says the tests >> failed here... >> I'll rerun them to see if the failure is repeatable. >> >> ---------- Forwarded message ---------- >> From:<buildbot(a)kegel.com> >> Date: Tue, Oct 11, 2011 at 1:21 PM >> Subject: Re: 79794: Help Test Please: use uniscribe in the single line >> edit control >> To: dank(a)kegel.com, wine-tests-results(a)winehq.org >> >> >> This is an experimental automated build and test service. >> Please feel free to ignore this email while we work the kinks out. >> >> For more info about this message, see http://wiki.winehq.org/BuildBot >> >> The Buildbot has detected a failed build on builder runtests-default >> while building Wine. >> Full details are available at: >> http://buildbot.kegel.com/builders/runtests-default/builds/186 (though >> maybe not for long, as I'm still reinstalling the buildbot >> periodically while experimenting) >> BUILD FAILED: failed shell_3 >> >> Errors: >> alarum: Timeout! Killing child ../../../wine. >> alarum: failed command was ../../../wine comctl32_test.exe.so listview.c >> alarum: ../../../wine terminated abnormally >> make: *** [listview.ok] Error 99 >> alarum: Timeout! Killing child ../../../wine. >> alarum: failed command was ../../../wine comctl32_test.exe.so updown.c >> alarum: ../../../wine terminated abnormally >> make: *** [updown.ok] Error 99 >> * Call to xpconnect wrapped JSObject produced this error: * >> * Call to xpconnect wrapped JSObject produced this error: * >> alarum: failed command was ../../../wine user32_test.exe.so edit.c >> edit.c:1138: Test failed: expected 1 got 0 >> edit.c:1156: Test failed: expected 1 got 0 >> edit.c:1174: Test failed: expected 1 got 0 >> make: *** [edit.ok] Error 3 >> GnuTLS error: GnuTLS internal error. >>

Oct. 12, 2011

Re: [PATCH 5/5] server/named_pipe.c: remove the ps_disconnected_server state, if DisconnectNamedPipe is called, the server i

by Marvin

Hi, While running your changed tests on Windows, I think I found new failures. Being a bot and all I'm not very good at pattern recognition, so I might be wrong, but could you please double-check? Full results can be found at http://testbot.winehq.org/JobDetails.pl?Key=14844 Your paranoid android. === WNT4WSSP6 (32 bit pipe) === pipe.c:1603: Test failed: expected ERROR_CANNOT_IMPERSONATE, got 203 === W2KPROSP4 (32 bit pipe) === pipe.c:1603: Test failed: expected ERROR_CANNOT_IMPERSONATE, got 997

Oct. 12, 2011

Re: [PATCH 4/5] kernel32, ntdll: implement most of GetNamedPipeHandleState (try 2)

by Marvin

Hi, While running your changed tests on Windows, I think I found new failures. Being a bot and all I'm not very good at pattern recognition, so I might be wrong, but could you please double-check? Full results can be found at http://testbot.winehq.org/JobDetails.pl?Key=14843 Your paranoid android. === WNT4WSSP6 (32 bit pipe) === pipe.c:1559: Test failed: expected ERROR_CANNOT_IMPERSONATE, got 203 === W2KPROSP4 (32 bit pipe) === pipe.c:1559: Test failed: expected ERROR_CANNOT_IMPERSONATE, got 997

Oct. 12, 2011

Re: [2/4] wined3d: reject ARB shader blits if the destination is not fbo attachable

by Stefan Dösinger

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Am 12.10.2011 um 11:26 schrieb Henri Verbeet: > On 11 October 2011 22:30, Stefan Dösinger <stefan(a)codeweavers.com> wrote: >> + if (wined3d_settings.offscreen_rendering_mode == ORM_FBO) >> + { >> + if (!((dst_format->flags & WINED3DFMT_FLAG_FBO_ATTACHABLE) || (dst_usage & WINED3DUSAGE_RENDERTARGET))) >> + return FALSE; >> + } >> + else if (!(dst_usage & WINED3DUSAGE_RENDERTARGET)) >> + { >> + return FALSE; >> + } > Formats are never FBO-attachable if we don't have > FBOs. It's not clear this is what you want either way though. This > pretty much looks like a copy/paste from fbo_blit_supported(), and the > WINED3DUSAGE_RENDERTARGET check there is to allow formats that don't > have a FBO-attachable internal format, but were created with the > rtInternal format (which should always be attachable). There's really > no equivalent check for backbuffer ORM, it just renders something and > hopes we can read it back. I'm not sure I see what you mean. What I want is to make sure the blitter doesn't draw to a surface that GL can't draw to. In the FBO ORM case the fbo_attachable || rendertarget case seems just right, for the reasons you mention. With backbuffer ORM we don't really know where we can draw(e.g. stuff like surface size vs framebuffer size comes into play), but I think RENDERTARGET usage is a decent heuristic since we'll probably have to be able to draw to it anyways, or things fails. I could add some surface_is_drawable() function or equivalent surface flag. That might be a good idea on its own, but I don't see a better way to define if a surface can be rendered to than the above statement. -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) iQIcBAEBAgAGBQJOlYhaAAoJEN0/YqbEcdMwpxgQAJTF3i75QLb+gosDaGkFODbk nhNUt/PHRw7k8yTVFBHp5aBWNCROdcr9yFANMj4AD74ii1HGNj9jzGISyfogvfqv RNHHHvwdff7b8Ev8MtKBEY3w9fTPvl7w0FzdzoSTFBF2SxkeEMc6QnecaHIfcepr SCf69/FFeVkPniOiVa3RCbLXyvrWG6ifMpJpXV8DFw23NTqb/JGyQIjodW2hc+Qy Gpgz4hwBw/jywOeFPCyOXtpR0bTBdD03mix3XWeYYaZg1Ukm+jyARQOvBSFU0dgB xhEcVTR0aNGA5WAgpKxUT1f3jRQc9f36U7HS5jTZemFR71wAXFPO0pMm7RNNrMXQ imhzE9+56OS7o96Vk4Rz8UdFYDBgDvTjO8nlp9j5aDOi8ylsX9TstDdRi2kh3ILI Satb83g0brU6JZaDqsLd5xZI8ZTPL55MniKRGvXJ1EEepViC0isgvMmrM1b/I2Wo N0FSoLkukXAfJHcal9YD6nAQeoI1HbM9HNNmAMPMCtDb9Y8Q0VSSWoeh71iP8cGF DziZZ3uSnX90kDrt7q6maXDFSWUS8YKZz2lviRxupb2LzwaSMAP2Aw1XEQz/YImH HxZkPuY4kZdQNShcYOyv9ZqNKUBrD5geFhmErYqxSL+Ede1nM7Lcp52NhbVRnTLI 9ksujocgWYGZYbzbhwym =04xu -----END PGP SIGNATURE-----

Oct. 12, 2011

Warning report for wine-1.3.30-55-g583e887

by Jerome Leclanche

It would be nice to fix the "array subscript is above array bounds" warning spam for 1.4.0. They make up 90% of the warnings. Apart from those, theres 25 more warning blocks to fix, most of them unused-but-set-variables. JL

Oct. 12, 2011

Re: [1/4] wined3d: Use an rbtree for the blit programs

by Stefan Dösinger

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Am 12.10.2011 um 11:57 schrieb Henri Verbeet: > You already have the P8 shader. My bad. What will actually be added is the NONE conversion with color keying. But adding a color keying flag is what makes the current approach unsustainable because it's orthogonal to the other properties. > In the case of color keying it should > probably at least be in the same series as the code that uses it, I can resend the patch later, but IMO getting rid of the current spaghetti shader selection code makes sense on its own. > but > I'm not sure an rbtree would really have a lot of advantages over a > simple array there. I chose the rbtree for consistency with the ffp and pshader/vshader selection, but an array is probably more efficient because I don't expect to have more than 4 different blit shaders at a time. -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) iQIcBAEBAgAGBQJOlXiYAAoJEN0/YqbEcdMwXLMP/0OUs1gZK6lJDmTOo7/HJRqt xh0+4pTZqWfQsPOePPJ9Erz5wtPSToKayShimwpbdvsmfdUgsGuWGqR22MipgADJ Q7t8muOEe8K9tFb5QgLwNhK39VQMASh+WohuUNFazMmBXbRIETT2UaGkh/VipihK gkI/7JnA8ju/Y41golqiEdnYShnmSTcnTXgaQp4NZDYZDgkT9IFHOmdd+uE4NvE2 ngYciZywyA8Rt37On4DjEMw9Jv32NKpnfoocXx7sPWFFpcqeDejCqIj32yVbWZBo Wj8gi4IbfAE+xdMWFBS2PIlCR1rbv6wwfaC9jB9rAYVpKin4hvk7DDPr4fqCTJ5q eTi5w1ehoH4MOeH8YPnu9BtxrKkrUwXYGKsivKB2jDBTzjm0G+IiZxKT00rvBrmL WpId1Y3Zau7TkTKeoy/W6LThjZzLeyw48Mmf5XTUabp8U/TBIwbPHzn5bHuYZJle AFt/74iWwbIfMVgeRGgSbXXCk56aV1+ykK9HT7DrH4Ne/74tZjZM4+kf54s/H9T+ hjj9lmR3mdm6wCnJqPdX+9+DyiYLSCgkdVa3Cd9TDaElsoMaggJIraxU8PFidU7c 3tzyg5AE+7QjqjKgv1ZZQhyYUWK85Z29iij5BWpzlqvaqfsKQD0fC6inaRhbkLG6 t5j6zcErEey2yeNttNas =3kLs -----END PGP SIGNATURE-----

Oct. 12, 2011

Re: [1/4] wined3d: Use an rbtree for the blit programs

by Henri Verbeet

On 12 October 2011 11:47, Stefan Dösinger <stefan(a)codeweavers.com> wrote: > Because when we add more conversions(P8) and settings(color keying) the current approach will result ugly unmaintainable if blocks. > You already have the P8 shader. In the case of color keying it should probably at least be in the same series as the code that uses it, but I'm not sure an rbtree would really have a lot of advantages over a simple array there.

Oct. 12, 2011

Re: [1/4] wined3d: Use an rbtree for the blit programs

by Stefan Dösinger

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Am 12.10.2011 um 11:26 schrieb Henri Verbeet: > Why do you need this? Because when we add more conversions(P8) and settings(color keying) the current approach will result ugly unmaintainable if blocks. -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) iQIcBAEBAgAGBQJOlWIoAAoJEN0/YqbEcdMwdsoP/1FWotm97eiLNanErb/fXL6C t9dlTzVVXbcUboFSw9uBhSY+GQNj+sjZ3sQ5wLJSsQbsypW4MMOYjoBIUD4n+N91 6QY2xK5Bys7DnE7l8T9k3jCss5Fi93TpOkrQjDi0I7C0OreL7/yueM3NJQwn4PiS PJE9C5upvARhPII158NqYtVrd5TmImpLes6yshI9k4gQc4XfDZt9n0x0ERWmL8ag zS8nVR2Zaa3HaRuk/BMnf5X8FWiImwT/JapK9AyroWV4Lcg4MlKaOLGl43KaRTjQ 8IbMDPxFdWOFyU4yOfu8MEwLPDj1g7wG/CxCDNrKXMgRxgTmam9mtogM+e/dGWFX H8x+Td7h56syIU9l7g+L/4ODVugIKBxBlDdeJVUYbjOOpxuaUjsiQXG5aUcfYLf2 +1hVoKXuk7XfobCF3XKRW0hQIZGW9iJ2NAfLQ6OWK/tCZIsQ+GQafjJRPSAMgC7E y/WQ6YuuTA9eGo9si8wiuzJ5xCJoqjG7Y4oB7aih/l0DjG8MwKwWuxk85kcMg6xF 9Hnkz7738HyXhb6Y2cyUtPVsJTao5DZkBFXKs+SiCQhOnLFKPrXyIB8Zk2R4uLl3 9v+OU9khdzjTvu+f8uRw+V3HW4X+inDdS2UueGNlRHh/rYFMHX8GIYKeVK+8PS/C 1ZEjQ+1hE7S664QuNv3g =Ptfk -----END PGP SIGNATURE-----

Oct. 12, 2011

Re: d3d8/tests: skip the visual test if d3d cannot be initialized

by Henri Verbeet

On 12 October 2011 01:51, Austin English <austinenglish(a)gmail.com> wrote: > Current d3d8 does a win_skip(), while d3d9 does a skip(). This unifies > the behavior to match the d3d9 behavior. > I seem to recall this being intentional, so that you get a failure if your setup has e.g. no OpenGL.

Oct. 12, 2011

Re: [4/4] wined3d: Don't allow fbo blits to frontbuffers that need fixups.

by Henri Verbeet

On 11 October 2011 22:31, Stefan Dösinger <stefan(a)codeweavers.com> wrote: > static BOOL fbo_blit_supported(const struct wined3d_gl_info *gl_info, enum wined3d_blit_op blit_op, > const RECT *src_rect, DWORD src_usage, WINED3DPOOL src_pool, const struct wined3d_format *src_format, > - const RECT *dst_rect, DWORD dst_usage, WINED3DPOOL dst_pool, const struct wined3d_format *dst_format) > + const RECT *dst_rect, DWORD dst_usage, WINED3DPOOL dst_pool, const struct wined3d_format *dst_format, > + const struct wined3d_surface *dst_surface) I don't think we want this. Does this actually ever happen?

Oct. 12, 2011

Re: [3/4] wined3d: reject ffp blits if the destination is not fbo attachable

by Henri Verbeet

On 11 October 2011 22:30, Stefan Dösinger <stefan(a)codeweavers.com> wrote: > + if (wined3d_settings.offscreen_rendering_mode == ORM_FBO) > + { > + if (!((dst_format->flags & WINED3DFMT_FLAG_FBO_ATTACHABLE) || (dst_usage & WINED3DUSAGE_RENDERTARGET))) > + return FALSE; > + } > + else if (!(dst_usage & WINED3DUSAGE_RENDERTARGET)) > + { > + return FALSE; > + } Same consideration as for 2/4. Guess I should have caught this when bccfd7cc introduced it.

Oct. 12, 2011

Re: [1/4] wined3d: Use an rbtree for the blit programs

by Henri Verbeet

Why do you need this?

Oct. 12, 2011

Re: [2/4] wined3d: reject ARB shader blits if the destination is not fbo attachable

by Henri Verbeet

On 11 October 2011 22:30, Stefan Dösinger <stefan(a)codeweavers.com> wrote: > + if (wined3d_settings.offscreen_rendering_mode == ORM_FBO) > + { > + if (!((dst_format->flags & WINED3DFMT_FLAG_FBO_ATTACHABLE) || (dst_usage & WINED3DUSAGE_RENDERTARGET))) > + return FALSE; > + } > + else if (!(dst_usage & WINED3DUSAGE_RENDERTARGET)) > + { > + return FALSE; > + } This is redundant. Formats are never FBO-attachable if we don't have FBOs. It's not clear this is what you want either way though. This pretty much looks like a copy/paste from fbo_blit_supported(), and the WINED3DUSAGE_RENDERTARGET check there is to allow formats that don't have a FBO-attachable internal format, but were created with the rtInternal format (which should always be attachable). There's really no equivalent check for backbuffer ORM, it just renders something and hopes we can read it back.

Oct. 12, 2011

Re: 79794: Help Test Please: use uniscribe in the single line edit control

by Dan Kegel

Hi Aric, failed again on second run, http://buildbot.kegel.com:8010/builders/runtests-default/builds/209 Failing tests are comctl32_test.exe.so listview.c comctl32_test.exe.so updown.c user32_test.exe.so edit.c On Tue, Oct 11, 2011 at 1:26 PM, Dan Kegel <dank(a)kegel.com> wrote: > Hey Aric, > don't know if I trust the bot at the moment, but it says the tests > failed here... > I'll rerun them to see if the failure is repeatable. > > ---------- Forwarded message ---------- > From: <buildbot(a)kegel.com> > Date: Tue, Oct 11, 2011 at 1:21 PM > Subject: Re: 79794: Help Test Please: use uniscribe in the single line > edit control > To: dank(a)kegel.com, wine-tests-results(a)winehq.org > > > This is an experimental automated build and test service. > Please feel free to ignore this email while we work the kinks out. > > For more info about this message, see http://wiki.winehq.org/BuildBot > > The Buildbot has detected a failed build on builder runtests-default > while building Wine. > Full details are available at: > http://buildbot.kegel.com/builders/runtests-default/builds/186 (though > maybe not for long, as I'm still reinstalling the buildbot > periodically while experimenting) > BUILD FAILED: failed shell_3 > > Errors: > alarum: Timeout! Killing child ../../../wine. > alarum: failed command was ../../../wine comctl32_test.exe.so listview.c > alarum: ../../../wine terminated abnormally > make: *** [listview.ok] Error 99 > alarum: Timeout! Killing child ../../../wine. > alarum: failed command was ../../../wine comctl32_test.exe.so updown.c > alarum: ../../../wine terminated abnormally > make: *** [updown.ok] Error 99 > * Call to xpconnect wrapped JSObject produced this error: * > * Call to xpconnect wrapped JSObject produced this error: * > alarum: failed command was ../../../wine user32_test.exe.so edit.c > edit.c:1138: Test failed: expected 1 got 0 > edit.c:1156: Test failed: expected 1 got 0 > edit.c:1174: Test failed: expected 1 got 0 > make: *** [edit.ok] Error 3 > GnuTLS error: GnuTLS internal error. >

Oct. 11, 2011

Re: [Wine] WineHQ database compromise

by Josh Juran

On Oct 11, 2011, at 3:54 PM, Conan Kudo (ニール・ゴンパ) wrote: > 2011/10/11 Josh Juran <josh(a)iswifter.net> > >> To clarify, your browser sends your password to bugzilla in cleartext, since HTTPS isn't an option. > > Shouldn't it be possible to modify the login environment so that a salted hash of the password is produced before sending it to the server, to strengthen the security a little bit? That protects the password itself, but not the privilege it guards. It also essentially makes Javascript a requirement, which currently it isn't. Josh

Oct. 11, 2011

Re: [Wine] WineHQ database compromise

by Conan Kudo (ニール・ゴンパ)

2011/10/11 Josh Juran <josh(a)iswifter.net> > On Oct 11, 2011, at 3:37 PM, Conan Kudo (ニール・ゴンパ) wrote: > > > On Tue, Oct 11, 2011 at 3:39 PM, Josh Juran <josh(a)iswifter.net> wrote: > > > >> Since bugzilla passwords were sent in cleartext anyway, I sincerely hope > none of them were otherwise valuable. (Remember FireSheep?) > > > > Wait, what? Bugzilla sends passwords in cleartext? That isn't very > smart... Is there no way to replace this with some sort of client based > hashing or something? > > To clarify, your browser sends your password to bugzilla in cleartext, > since HTTPS isn't an option. > > Firesheep was a lesson that even once passwords are secure, session > credentials are still vulnerable to sniffing. Some sites went to HTTPS-only > sessions after that. > > Josh > > > Shouldn't it be possible to modify the login environment so that a salted hash of the password is produced before sending it to the server, to strengthen the security a little bit?

Oct. 11, 2011

Re: [Wine] WineHQ database compromise

by Austin English

2011/10/11 Josh Juran <josh(a)iswifter.net>: > On Oct 11, 2011, at 3:37 PM, Conan Kudo (ニール・ゴンパ) wrote: > >> On Tue, Oct 11, 2011 at 3:39 PM, Josh Juran <josh(a)iswifter.net> wrote: >> >>> Since bugzilla passwords were sent in cleartext anyway, I sincerely hope none of them were otherwise valuable. (Remember FireSheep?) >> >> Wait, what? Bugzilla sends passwords in cleartext? That isn't very smart... Is there no way to replace this with some sort of client based hashing or something? > > To clarify, your browser sends your password to bugzilla in cleartext, since HTTPS isn't an option. > > Firesheep was a lesson that even once passwords are secure, session credentials are still vulnerable to sniffing. Some sites went to HTTPS-only sessions after that. http://bugs.winehq.org/show_bug.cgi?id=23791 -- -Austin

Oct. 11, 2011

Re: [Wine] WineHQ database compromise

by Josh Juran

On Oct 11, 2011, at 3:37 PM, Conan Kudo (ニール・ゴンパ) wrote: > On Tue, Oct 11, 2011 at 3:39 PM, Josh Juran <josh(a)iswifter.net> wrote: > >> Since bugzilla passwords were sent in cleartext anyway, I sincerely hope none of them were otherwise valuable. (Remember FireSheep?) > > Wait, what? Bugzilla sends passwords in cleartext? That isn't very smart... Is there no way to replace this with some sort of client based hashing or something? To clarify, your browser sends your password to bugzilla in cleartext, since HTTPS isn't an option. Firesheep was a lesson that even once passwords are secure, session credentials are still vulnerable to sniffing. Some sites went to HTTPS-only sessions after that. Josh

Oct. 11, 2011

Re: [Wine] WineHQ database compromise

by Conan Kudo (ニール・ゴンパ)

On Tue, Oct 11, 2011 at 3:39 PM, Josh Juran <josh(a)iswifter.net> wrote: > On Oct 11, 2011, at 12:13 PM, Jeremy White wrote: > > > Unfortunately, the attackers were able to download the full login > > database for both the appdb and bugzilla. This means that they have all > > of those emails, as well as the passwords. The passwords are stored > > encrypted, but with enough effort and depending on the quality of the > > password, they can be cracked. > > > > This, I'm afraid, is a serious threat; it means that anyone who uses the > > same email / password on other systems is now vulnerable to a malicious > > attacker using that information to access their account. > > Since bugzilla passwords were sent in cleartext anyway, I sincerely hope > none of them were otherwise valuable. (Remember FireSheep?) > > Josh > > Wait, what? Bugzilla sends passwords in cleartext? That isn't very smart... Is there no way to replace this with some sort of client based hashing or something?

Oct. 11, 2011

Re: WineHQ database compromise

by Jeremy White

> Almost 2 years ago I have sent you an email privately about a security > hole with the database. To be exactly, the date of the email is Wed, > Jul 29, 2009, 12:00 AM (GMT +02:00). I guess that's probably the same > trick the bad guys have used... Hmm. I can't find any such email in my archives - can you resend it to me? Are you sure it was me, and not the other Jeremy? I'd be curious to see if it matches up to the forensics we have. Cheers, Jeremy

Oct. 11, 2011

Re: [PATCH] dsound: Don't claim to support hardware buffers

by Marvin

Hi, While running your changed tests on Windows, I think I found new failures. Being a bot and all I'm not very good at pattern recognition, so I might be wrong, but could you please double-check? Full results can be found at http://testbot.winehq.org/JobDetails.pl?Key=14829 Your paranoid android. === W2K3R2SESP2 (32 bit dsound) === dsound.c:329: Test failed: IDirectSound_CreateSoundBuffer() failed to create a secondary buffer 88780032

Oct. 11, 2011

Re: WineHQ database compromise

by Matijn Woudt

On Tue, Oct 11, 2011 at 9:13 PM, Jeremy White <jwhite(a)codeweavers.com> wrote: > Hi, > > I am sad to say that there was a compromise of the WineHQ database system. > > What we know at this point that someone was able to obtain unauthorized > access to the phpmyadmin utility. We do not exactly how they obtained > access; it was either by compromising an admins credentials, or by > exploiting an unpatched vulnerability in phpmyadmin. > Jeremy, Almost 2 years ago I have sent you an email privately about a security hole with the database. To be exactly, the date of the email is Wed, Jul 29, 2009, 12:00 AM (GMT +02:00). I guess that's probably the same trick the bad guys have used... Kind regards, Matijn Woudt

Oct. 11, 2011

Re: [PATCH] dsound: Don't claim to support hardware buffers

by Chris Robinson

Hi. On Tuesday, October 11, 2011 3:31:59 PM Andrew Eikum wrote: > The specific drvcaps values and error code were tested against Windows > 7. How does this affect the primary buffer? Is it not allowed to be a hardware buffer either?

Oct. 11, 2011