April 2025 - Wine-GitLab - list.winehq.org

[PATCH 0/1] MR7798: spoolss: Avoid buffer-overflow when setting numentries. (ASan)
by Bernhard Übelacker April 19, 2025

April 19, 2025

BuildOtherNamesFromMachineName writes sizeof(LPVOID) bytes but the test reserved just sizeof(DWORD), which makes a difference at amd64 and gets detected by ASan. <details> <summary>ASan output</summary> ``` ================================================================= ==spoolss_test.exe==700==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffe1ffba0 at pc 0x6ffffdc53e38 bp 0x7ffffe1ffa40 sp 0x7ffffe1ffa88 WRITE of size 8 at 0x7ffffe1ffba0 thread T0 #0 0x6ffffdc53e37 in BuildOtherNamesFromMachineName .../wine/dlls/spoolss/spoolss_main.c:99:11 #1 0x00014000170e in test_BuildOtherNamesFromMachineName .../wine/dlls/spoolss/tests/spoolss.c:131:11 #2 0x000140001030 in func_spoolss .../wine/dlls/spoolss/tests/spoolss.c:218:5 #3 0x000140003ede in run_test .../wine/include/wine/test.h:765:5 #4 0x000140003a8e in main .../wine/include/wine/test.h #5 0x000140004963 in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:58:11 #6 0x6fffffc3565e in BaseThreadInitThunk .../wine/dlls/kernel32/thread.c:61:24 #7 0x6fffffdbbcc2 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17004bcc2) Address 0x7ffffe1ffba0 is located in stack of thread T0 at offset 64 in frame #0 0x00014000164f in test_BuildOtherNamesFromMachineName .../wine/dlls/spoolss/tests/spoolss.c:122 This frame has 2 object(s): [32, 40) 'buffers' (line 123) [64, 68) 'numentries' (line 124) <== Memory access at offset 64 partially overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp, SEH and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow .../wine/dlls/spoolss/spoolss_main.c:99:11 in BuildOtherNamesFromMachineName Shadow bytes around the buggy address: 0x7ffffe1ff900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ff980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffb00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 =>0x7ffffe1ffb80: 00 f2 f2 f2[04]f3 f3 f3 00 00 00 00 00 00 00 00 0x7ffffe1ffc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffe1ffc80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f8 f8 f8 0x7ffffe1ffd00: f8 f8 f8 f8 f3 f3 f3 f3 00 00 00 00 00 00 00 00 0x7ffffe1ffd80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 0x7ffffe1ffe00: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==spoolss_test.exe==700==ABORTING ``` </details> -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7798

2 3

[PATCH 0/1] MR7801: combase: Add a stub for SetRestrictedErrorInfo().
by Nikolay Sivov (＠nsivov) April 19, 2025

April 19, 2025

Foobar 2000 crashes without it. Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com> -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7801

3 2

[PATCH v3 0/1] MR7838: mfplat/tests: Don't assume video processor MFT can provide samples.
by Charlotte Pabst (＠CharlottePabst) April 19, 2025

April 19, 2025

This fixes a test failure/crash on Windows 8.1 introduced by dd1d82728811c15716eefa0917eb3ecac4b9a85a. -- v3: mfplat/tests: Don't assume video processor MFT can provide samples. https://gitlab.winehq.org/wine/wine/-/merge_requests/7838

3 2

[PATCH 0/3] MR7831: comctl32: Implement MSAA events for listview controls.
by Esme Povirk (＠madewokherd) April 19, 2025

April 19, 2025

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/7831

4 8

[PATCH 0/4] MR7797: ntdll: Wait for all pending operations to be cancelled in NtCancelIoFile[Ex]().
by Matteo Bruni (＠Mystral) April 19, 2025

April 19, 2025

This fixes Trials Fusion often crashing when disconnecting a controller while there are more still connected. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7797

4 12

Re: [PATCH v2 0/1] MR7833: mf: Update state and start clock for both paused and stopped.
by Nikolay Sivov (＠nsivov) April 19, 2025

April 19, 2025

I think what's missing is an audio client Reset(). We currently do Stop+Reset when the clock is stopped, and just Stop when the clock is paused. We don't Reset on pause so we don't lose pending data. But when we restart from at a different timestamp I think we should. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7833#note_101438

1 0

Re: [PATCH v2 0/1] MR7833: mf: Update state and start clock for both paused and stopped.
by Nikolay Sivov (＠nsivov) April 19, 2025

April 19, 2025

On Thu Apr 17 21:23:59 2025 +0000, Brendan McGrath wrote: > I couldn't get this to build unfortunately. But if you can seek in this > program, then you should be able to recreate the issue with pause, seek > and then play. You can seek with it, but it's not implemented on our side yet. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7833#note_101437

1 0

Re: [PATCH v2 0/1] MR7833: mf: Update state and start clock for both paused and stopped.
by Nikolay Sivov (＠nsivov) April 19, 2025

April 19, 2025

On Sat Apr 19 12:53:51 2025 +0000, Brendan McGrath wrote: > Specifically I'm using: > - `IMFMediaEngine::Pause` > - `IMFMediaEngine::SetCurrentTime` > - `IMFMediaEngine::Play` Thanks, makes sense. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/7833#note_101436

1 0

[PATCH v8 0/3] MR7064: ntdll: Check for invalid GS base in the 64-bit segv_handler.
by William Horvath (＠whrvth) April 19, 2025

April 19, 2025

Adapted from [check_invalid_gs](https://gitlab.winehq.org/wine/wine/-/blob/d7a7cae2e2d1ad… in signal_i386.c. This prevents crashing when the %gs register is manipulated, such as in 32-bit code on "new-style" WoW64. "Exertus: Darkness Approaches" is a 32-bit game that triggers this crash (on WoW64), which can be downloaded from the Bugzilla page's attachments. For another example, [test.c](https://bugs.winehq.org/attachment.cgi?id=77444) can reproduce it, courtesy of Fabian Maurer from the Bugzilla comments. This will crash whether it's compiled as 32-bit or 64-bit, while it works fine on Windows. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57444 Also, excuse me if submitting this is against some sort of code-freeze etiquette, it wasn't my intention try to have it merged immediately. -- v8: ntdll/tests: Re-enable a previously crashing test. ntdll: Check for invalid gs_base in the 64-bit segv_handler. ntdll/tests: Add an exception test for accessing a modified %gs on x86_64. https://gitlab.winehq.org/wine/wine/-/merge_requests/7064

6 16

[PATCH 0/3] MR7854: ws2_32: Allow using duplicated socket handles in WS2_sendto().
by Elizabeth Figura (＠zfigura) April 18, 2025

April 18, 2025

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/7854

2 3