- Wine-GitLab - list.winehq.org

[PATCH 0/4] MR8637: mshtml: Handle NULL inputs in some node methods.
by Gabriel Ivăncescu July 24, 2025

July 24, 2025

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/8637

2 5

[PATCH 0/1] MR8639: widl: Generate a _RetVal for proxy _PARAM_STRUCTS.
by Yuxuan Shui (＠yshui) July 24, 2025

July 24, 2025

For calls with return values, we emit a IsReturn parameter for it into __MIDL_ProcFormatString. During the INITOUT phase, client_do_args will try to read at this address. But we do not generate a _RetVal member for the _PARAM_STRUCTS types used by proxies, this means client_do_args will read out of bound. * * * An example is `IDispatchEx_RemoteInvokeEx_Proxy` asan complaint: ``` 015c:0160:err:asan:asan_report ASan: read of 4 bytes at 015A88DC, caller 6A9A0EFA (__asan_report_load4_noabort, /home/shui/programs/wine/dlls/asan_dynamic_thunk/thunk.c:1031,1) 015c:0160:err:asan:asan_report stacktrace: 015c:0160:err:asan:asan_report 6A9A0EFA (__asan_report_load4_noabort, /home/shui/programs/wine/dlls/asan_dynamic_thunk/thunk.c:1031,1) 015c:0160:err:asan:asan_report 6A9ACB2C (client_do_args, /home/shui/programs/wine/dlls/rpcrt4/ndr_stubless.c:511,17) 015c:0160:err:asan:asan_report 6A9C5913 (ndr_client_call, /home/shui/programs/wine/dlls/rpcrt4/ndr_stubless.c:794,9) 015c:0160:err:asan:asan_report 6A965438 (NdrpClientCall2, /home/shui/programs/wine/dlls/rpcrt4/ndr_stubless.c:929,22) 015c:0160:err:asan:asan_report 6A916C77 (NdrClientCall2) 015c:0160:err:asan:asan_report 68662856 (IDispatchEx_RemoteInvokeEx_Proxy, dlls/dispex/i386-windows/disp_ex_p.c:82,15) 015c:0160:err:asan:asan_report 68661D6E (IDispatchEx_InvokeEx_Proxy, /home/shui/programs/wine/dlls/dispex/usrmarshal.c:100,10) 015c:0160:err:asan:asan_report 00401187 (IDispatchEx_InvokeEx, include/dispex.h:319,12) 015c:0160:err:asan:asan_report 00408F36 (test_dispex, /home/shui/programs/wine/dlls/dispex/tests/marshal.c:391,10) 015c:0160:err:asan:asan_report 004061FF (func_marshal, /home/shui/programs/wine/dlls/dispex/tests/marshal.c:433,5) 015c:0160:err:asan:asan_report 00407B60 (run_test, /home/shui/programs/wine/include/wine/test.h:794,9) 015c:0160:err:asan:asan_report 00407426 (main, /home/shui/programs/wine/include/wine/test.h:912,1) 015c:0160:err:asan:asan_report 0040767C (mainCRTStartup, /home/shui/programs/wine/dlls/msvcrt/crt_main.c:60,11) 015c:0160:err:asan:asan_report 7901FA24 (BaseThreadInitThunk) 015c:0160:err:asan:asan_report 7A50E0F7 (call_thread_func_wrapper) 015c:0160:err:asan:asan_report 7A5B6ADD (call_thread_func, /home/shui/programs/wine/dlls/ntdll/signal_i386.c:505,5) 015c:0160:err:asan:asan_report info: 015c:0160:err:asan:asan_report partial granule: 4 015c:0160:err:asan:asan_report stack-buffer-overflow, addr is 4 bytes to the right of the end of stack 015c:0160:err:asan:asan_report stack: [015A8820, 015A8860) 015c:0160:err:asan:asan_report stack pc: 6866252C (IDispatchEx_RemoteInvokeEx_Proxy, dlls/dispex/i386-windows/disp_ex_p.c:54,1), descr: 2 32 4 10 _RetVal:55 48 44 11 __params:69 ``` the parameters info: ``` 0024:trace:rpc:ndr_client_call INITOUT 0024:trace:rpc:client_do_args param[0]: 015EB834 type 08 IsIn IsBasetype 0024:trace:rpc:client_do_args param[1]: 015EB838 type 08 IsIn IsBasetype 0024:trace:rpc:client_do_args param[2]: 015EB83C type 08 IsIn IsBasetype 0024:trace:rpc:client_do_args param[3]: 015EB840 type 16 MustSize MustFree IsIn IsSimpleRef 0024:trace:rpc:client_do_args param[4]: 015EB844 type b4 MustSize MustFree IsOut IsSimpleRef ServerAllocSize = 16 0024:trace:rpc:client_do_args param[5]: 015EB848 type 1a MustSize MustFree IsOut IsSimpleRef ServerAllocSize = 32 0024:trace:rpc:client_do_args param[6]: 015EB84C type 2f MustSize MustFree IsIn 0024:trace:rpc:client_do_args param[7]: 015EB850 type 08 IsIn IsBasetype 0024:trace:rpc:client_do_args param[8]: 015EB854 type 1b MustSize MustFree IsIn IsSimpleRef 0024:trace:rpc:client_do_args param[9]: 015EB858 type 21 MustSize MustFree IsIn IsOut IsSimpleRef 0024:trace:rpc:client_do_args param[10]: 015EB85C type 08 IsOut IsReturn IsBasetype ``` reading of `param[10]` at `015EB85C`, which is the non-existent `_RetVal`, triggers the asan report. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8639

2 1

[PATCH 0/1] MR8638: kernel32/tests: Don't go beyond user space virtual address limit.
by Yuxuan Shui (＠yshui) July 24, 2025

July 24, 2025

In get_valloc_info, if mem happens to point to the last chunk of memory in the user space virtual address space, "p += info2.RegionSize" will cause it to go over the limit, and subsequent VirtualQueries will fail, thus info2 won't be changed, thus the loop exit condition is never met (well until p wraps around, that is). * * * Witnessed this in CI: ``` 012c:0130:trace:virtual:NtQueryVirtualMemory (0xffffffffffffffff, 0x7ffffffe0000, info_class=0, 0x442120, 48, 0xfd4a0) 012c:0130:trace:virtual:get_vprot_range_size base 0x7ffffffe0000, size 0x10000, mask 0xbf. 012c:0130:trace:virtual:NtQueryVirtualMemory (0xffffffffffffffff, 0x7ffffffe0000, info_class=0, 0x442170, 48, 0xfd520) 012c:0130:trace:virtual:get_vprot_range_size base 0x7ffffffe0000, size 0x10000, mask 0xbf. 012c:0130:trace:virtual:NtQueryVirtualMemory (0xffffffffffffffff, 0x7fffffff0000, info_class=0, 0x442170, 48, 0xfd5e0) 012c:0130:trace:virtual:NtQueryVirtualMemory (0xffffffffffffffff, 0x800000000000, info_class=0, 0x442170, 48, 0xfd820) 012c:0130:trace:virtual:NtQueryVirtualMemory (0xffffffffffffffff, 0x800000010000, info_class=0, 0x442170, 48, 0xfda60) 012c:0130:trace:virtual:NtQueryVirtualMemory (0xffffffffffffffff, 0x800000020000, info_class=0, 0x442170, 48, 0xfdca0) 012c:0130:trace:virtual:NtQueryVirtualMemory (0xffffffffffffffff, 0x800000030000, info_class=0, 0x442170, 48, 0xfdee0) ... ``` and winetest logs: ``` ... heap.c:3662:3.322 Test failed: init size 0: got 0. heap.c:3662:3.322 Test failed: init size 0: got 0. heap.c:3662:3.322 Test failed: init size 0: got 0. heap.c:3662:3.322 Test failed: init size 0: got 0. heap.c:3662:3.322 Test failed: init size 0: got 0. heap.c:3662:3.322 Test failed: init size 0: got 0. heap.c:3662:3.323 Test failed: init size 0: got 0. heap.c:3662:3.323 Test failed: init size 0: got 0. ... ``` ad infinitum Probably made more likely by ASan since it takes a big chunk of the address space. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8638

2 1

[PATCH v6 0/7] MR7797: Draft: ntdll: Wait for all pending operations to be cancelled in NtCancelIoFile[Ex]().
by Matteo Bruni (＠Mystral) July 24, 2025

July 24, 2025

This fixes Trials Fusion often crashing when disconnecting a controller while there are more still connected. -- v6: hidclass: Set Status for pending IRPs of removed devices to STATUS_DEVICE_NOT_CONNECTED. ntdll/tests: Test IOSB values of the cancel operation. https://gitlab.winehq.org/wine/wine/-/merge_requests/7797

5 29

[PATCH v2 0/14] MR8598: mmdevapi: Fix some failures after !8559.
by Giovanni Mascellani (＠giomasce) July 24, 2025

July 24, 2025

-- v2: windows.media.speech: Disable format check when initializing mmdevapi. winmm: Disable format check when initializing mmdevapi. libs/faudio: Disable format check when initializing mmdevapi. mmdevapi: Disable format check when initializing spatial audio. mmdevapi: Introduce a private interface to disable the format check. mmdevapi/tests: Test 32-bit PCM sample formats. winepulse.drv: Allow 32-bit PCM audio samples. mmdevapi: Allow a sampling rate mismatch when rate adjust is supported. mmdevapi/tests: Test audio client initialization with rate adjust flag. mmdevapi/tests: Add a couple of spatialaudio checks. https://gitlab.winehq.org/wine/wine/-/merge_requests/8598

3 16

[PATCH 0/1] MR8629: urlmon/tests: Fix test_PersistentZoneIdentifier freeing the wrong thing.
by Yuxuan Shui (＠yshui) July 24, 2025

July 24, 2025

Introduced in !8459 -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8629

3 2

Re: [PATCH v2 0/1] MR8626: include: Add _callnewh declaration. - approved
by Alexandre Julliard (＠julliard) July 24, 2025

July 24, 2025

This merge request was approved by Alexandre Julliard. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8626

1 0

Re: [PATCH v2 0/3] MR8617: msvcp: Fix -Wuninitialized-const-pointer warnings. - approved
by Alexandre Julliard (＠julliard) July 24, 2025

July 24, 2025

This merge request was approved by Alexandre Julliard. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8617

1 0

Re: [PATCH v2 0/1] MR8610: crypt32: Retry with CRYPT_MACHINE_KEYSET in CRYPT_AcquirePrivateKeyFromProvInfo(). - approved
by Alexandre Julliard (＠julliard) July 24, 2025

July 24, 2025

This merge request was approved by Alexandre Julliard. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8610

1 0

Re: [PATCH v2 0/1] MR8611: winebth.sys: Only set properties for radio devices after they have been started. - approved
by Alexandre Julliard (＠julliard) July 24, 2025

July 24, 2025

This merge request was approved by Alexandre Julliard. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8611

1 0