February 2020 - Wine-Devel - list.winehq.org

Re: [PATCH 3/3] server: Hold a reference to the file in delete_file().

by Zebediah Figura

On 2/14/20 12:10 PM, Zebediah Figura wrote: > From: Michael Müller <michael(a)fds-team.de> > > Otherwise, we may attempt to access freed memory trawling the device list. > This can occur if a device driver crashes during an IRP_CALL_CLOSE request. > > Signed-off-by: Zebediah Figura <z.figura12(a)gmail.com> > --- > server/device.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/server/device.c b/server/device.c > index b02d965e33..12208ec8a2 100644 > --- a/server/device.c > +++ b/server/device.c > @@ -729,12 +729,18 @@ static void delete_file( struct device_file *file ) > { > struct irp_call *irp, *next; > > + /* The pending requests may be the only thing holding a reference to the > + * file. */ > + grab_object( file ); > + > /* terminate all pending requests */ > LIST_FOR_EACH_ENTRY_SAFE( irp, next, &file->requests, struct irp_call, dev_entry ) > { > list_remove( &irp->mgr_entry ); > set_irp_result( irp, STATUS_FILE_DELETED, NULL, 0, 0 ); > } > + > + release_object( file ); > } > > static void delete_device( struct device *device ) > I'm attaching a diff here which reproduces this issue. The test case is added to httpapi/tests, and intentionally causes a crash in http.sys' IRP_MJ_CLOSE handler (which is artificial, but as I understand it should not be allowed to crash the server). It essentially opens a file on the device, makes one overlapped ioctl which is never completed, and then closes the file. I've also added traces to server/device.c to clearly demonstrate the crash. The server accesses freed memory for me without both of these patches. (In the case of delete_file(), my understanding is that LIST_FOR_EACH_ENTRY_SAFE still dereferences the list on every iteration to determine whether there are more elements.) This doesn't always manifest as a crash, but usually does for me.

Feb. 28, 2020

[PATCH 2/2] vbscript: Don't create script dispatches for items with the SCRIPTITEM_GLOBALMEMBERS flag.

by Jacek Caban

From: Gabriel Ivăncescu <gabrielopcode(a)gmail.com> Signed-off-by: Gabriel Ivăncescu <gabrielopcode(a)gmail.com> Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- dlls/vbscript/compile.c | 1 + dlls/vbscript/tests/vbscript.c | 97 ++++++++++++++++++++++++++++++++-- dlls/vbscript/vbscript.c | 7 ++- 3 files changed, 97 insertions(+), 8 deletions(-)

Feb. 28, 2020

[PATCH 1/2] vbscript: Lookup host global object in interp_me instead of storing it in script context.

by Jacek Caban

Inspired by patch by Gabriel Ivăncescu. Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- dlls/vbscript/interp.c | 19 +++++++++++++------ dlls/vbscript/vbscript.c | 10 ---------- dlls/vbscript/vbscript.h | 2 -- 3 files changed, 13 insertions(+), 18 deletions(-)

Feb. 28, 2020

Re: [PATCH v2] dsound: Make GlobalHandle() for the sound buffer failed.

by Andrew Eikum

On Wed, Feb 26, 2020 at 09:43:03PM +0900, Akihiro Sagawa wrote: > In v2, remove an unreliable conformance test. It crashes on x64 Windows. > Would it be possible to add the test for 32-bit only? Without a test I worry we could lose this change in a future patch. > diff --git a/dlls/dsound/buffer.c b/dlls/dsound/buffer.c > index 8d4a3b9..b019b0d 100644 > --- a/dlls/dsound/buffer.c > +++ b/dlls/dsound/buffer.c > @@ -1054,19 +1054,15 @@ HRESULT secondarybuffer_create(DirectSoundDevice *device, const DSBUFFERDESC *ds > TRACE("capf = 0x%08x, device->drvcaps.dwFlags = 0x%08x\n", capf, device->drvcaps.dwFlags); > > /* Allocate an empty buffer */ > - dsb->buffer = HeapAlloc(GetProcessHeap(),0,sizeof(*(dsb->buffer))); > + dsb->buffer = HeapAlloc(GetProcessHeap(),0,sizeof(*(dsb->buffer)) + dsb->buflen); > if (!dsb->buffer) { > IDirectSoundBuffer8_Release(&dsb->IDirectSoundBuffer8_iface); > return DSERR_OUTOFMEMORY; > } > > - /* Allocate system memory for buffer */ > - dsb->buffer->memory = HeapAlloc(GetProcessHeap(),0,dsb->buflen); > - if (!dsb->buffer->memory) { > - WARN("out of memory\n"); > - IDirectSoundBuffer8_Release(&dsb->IDirectSoundBuffer8_iface); > - return DSERR_OUTOFMEMORY; > - } > + /* Assign subsequent memory for buffer > + to make GlobalHandle(dsb->buffer->memory) call fail */ > + dsb->buffer->memory = (LPBYTE)dsb->buffer + sizeof(*(dsb->buffer)); > I think we need to make sure memory is aligned -- e.g. round up the size of dst->buffer to nearest alignment. Or, some other solution might be more elegant; Zeb suggested VirtualAlloc might solve this? Andrew

Feb. 28, 2020

Re: [PATCH v2 2/3] msvcrt: Silence wide environment inisialization debug messages.

by Zhiyi Zhang

Hi Jacek, There is a typo in the this one's subject line as well. Thanks, Zhiyi On 2/28/20 9:39 PM, Jacek Caban wrote: > Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> > --- > dlls/msvcrt/data.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >

Feb. 28, 2020

[PATCH v3 1/3] ucrtbase: Add exe entry points implementation.

by Jacek Caban

Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- v3: Thanks Jeff dlls/msvcrt/crt_main.c | 16 +++++++++++++++- dlls/msvcrt/crt_wmain.c | 16 +++++++++++++++- dlls/ucrtbase/Makefile.in | 5 +++++ 3 files changed, 35 insertions(+), 2 deletions(-)

Feb. 28, 2020

Re: [PATCH v2 1/3] ucrtbase: Add exe exntry points implementation.

by Jeff Smith

Hi Jacek, Spelling in title still needs fixed (exntry -> entry) Thanks, Jeff On Fri, Feb 28, 2020 at 7:40 AM Jacek Caban <jacek(a)codeweavers.com> wrote: > > Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> > --- > dlls/msvcrt/crt_main.c | 16 +++++++++++++++- > dlls/msvcrt/crt_wmain.c | 16 +++++++++++++++- > dlls/ucrtbase/Makefile.in | 5 +++++ > 3 files changed, 35 insertions(+), 2 deletions(-) > >

Feb. 28, 2020

Re: [PATCH] vbscript/tests: Get rid of strcmp_wa()

by Jacek Caban

Signed-off-by: Jacek Caban <jacek(a)codeweavers.com>

Feb. 28, 2020

Re: [PATCH v2 3/3] makedep: Build builtin programs with ucrt.

by Marvin

Hi, While running your changed tests, I think I found new failures. Being a bot and all I'm not very good at pattern recognition, so I might be wrong, but could you please double-check? Full results can be found at: https://testbot.winehq.org/JobDetails.pl?Key=65992 Your paranoid android. === debian10 (build log) === /home/winetest/tools/testbot/var/wine-win32/programs/cabarc/../../../wine/programs/cabarc/cabarc.c:107: undefined reference to `_imp__printf' /home/winetest/tools/testbot/var/wine-win32/programs/cabarc/../../../wine/programs/cabarc/cabarc.c:338: undefined reference to `_imp__wprintf' /usr/bin/i686-w64-mingw32-ld: /home/winetest/tools/testbot/var/wine-win32/programs/cabarc/../../../wine/programs/cabarc/cabarc.c:346: undefined reference to `_imp__wprintf' /home/winetest/tools/testbot/var/wine-win32/programs/cabarc/../../../wine/programs/cabarc/cabarc.c:405: undefined reference to `_imp__wprintf' collect2: error: ld returned 1 exit status /home/winetest/tools/testbot/var/wine-win32/programs/chcp.com/../../../wine/programs/chcp.com/main.c:32: undefined reference to `_imp__printf' collect2: error: ld returned 1 exit status /home/winetest/tools/testbot/var/wine-win32/programs/cmd/../../../wine/programs/cmd/wcmdmain.c:2451: undefined reference to `time' collect2: error: ld returned 1 exit status Task: The win32 build failed === debian10 (build log) === /home/winetest/tools/testbot/var/wine-wow64/programs/cabarc/../../../wine/programs/cabarc/cabarc.c:107: undefined reference to `__imp_printf' /home/winetest/tools/testbot/var/wine-wow64/programs/cabarc/../../../wine/programs/cabarc/cabarc.c:338: undefined reference to `__imp_wprintf' /usr/bin/x86_64-w64-mingw32-ld: /home/winetest/tools/testbot/var/wine-wow64/programs/cabarc/../../../wine/programs/cabarc/cabarc.c:346: undefined reference to `__imp_wprintf' /home/winetest/tools/testbot/var/wine-wow64/programs/cabarc/../../../wine/programs/cabarc/cabarc.c:405: undefined reference to `__imp_wprintf' collect2: error: ld returned 1 exit status /home/winetest/tools/testbot/var/wine-wow64/programs/chcp.com/../../../wine/programs/chcp.com/main.c:32: undefined reference to `__imp_printf' collect2: error: ld returned 1 exit status Task: The wow64 build failed

Feb. 28, 2020

[PATCH 2/2] winegcc: Don't pass ld command to winebuild when building PE file.

by Jacek Caban

It's not used anyway. Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- tools/winegcc/winegcc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

Feb. 28, 2020