http://bugs.winehq.org/show_bug.cgi?id=10417
Summary: OLEAUT32: crash if >128 methods in an interface
Product: Wine
Version: 0.9.49.
Platform: Macintosh
OS/Version: Mac OS X 10.5
Status: UNCONFIRMED
Severity: normal
Priority: P1
Component: wine-ole
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: mjk(a)cardbox.com
This bug was encountered in build cxoffice-6.2.0rc1-2-g024be42 of Wine (part of
CrossOver Mac). The bug has been identified in the current source code at
http://source.winehq.org/source/dlls/oleaut32/tmarshal.c.
Using any marshaled interface with more than 128 methods causes a crash within
OLEAUT32 if any method at position >=128 is called. This was detected when
using Cardbox (http://www.cardbox.com) and is a SHOW-STOPPER because it makes
the use of VBScript macros impossible.
However, the bug is completely general and applies to any application at all
that has interfaces with large number of methods. It is quite possible that
many random OLE / COM - related bugs that have already been reported have this
bug as their underlying cause.
The version of Cardbox on which the bug was found is more recent than the one
currently available on the web site. If anyone wants to have a copy for
testing, together with instructions for reproducing the crash, please contact
me.
LOCATION OF THE BUG
The bug is in dlls/oleaut32/tmarshal.c. When constructing a proxy interface,
PSFacBuf_CreateProxy at line #1712 constructs the following proxy code for each
method:
popl %eax
pushl <nr>
pushl %eax
call xCall
lret <n> (+4)
where <nr> is the position of the method in the list of methods: 0, 1, 2, and
so on.
The pushl <nr> instruction is defined by following code:
374 BYTE pushlval; // set to 0x6a by line #1712
375 BYTE nr;
The fact that the method position is a byte already limits the maximum size of
an interface to 256 methods, which is less than the 512-method limit of Windows
NT4.0 SP3, and the 1024-method limit of Windows 2000: see "MIDL2362" in
http://msdn2.microsoft.com/en-us/library/aa366756.aspx for details. Thus this
needs to be corrected in any case. The proxy code as it stands will call method
0 instead of method 256, method 1 instead of method 257, and so on, leading to
random behaviour and possible stack corruption.
The crash when method 128 is called has a different cause. The proxy for method
128 contains the instruction 6A 80, because the programmer thought that this
would push 00000080 onto the stack. In fact the PUSH instruction with opcode 6A
SIGN-EXTENDS its operand and does not zero-extend it. Thus the proxy for the
128th method pushes FFFFFF80 onto the stack before calling xCall. xCall
interprets this as a negative number (-128) and thus attempts to synthesize a
call not to method 128 but to a non-existent method -128. In the same way it
will call method -127 instead of method 129,... and so on.
SUGGESTED CORRECTION
The very simple correction to this bug, which is guaranteed to work, is to
alter line 375 to
375 DWORD nr;
and line 1712 to
1712 xasm->pushlval = 0x68;
which expects a 32-bit operand rather than an 8-bit one.
This will result in every proxy using 15 bytes per method instead of 12 bytes.
This does not seem an excessive price to pay for complete reliability in the
future: there will then be no limit to the number of methods that can be
supported.
ALTERNATIVE CORRECTIONS
If the 25% expansion in proxy size is considered unacceptable (it should not
really be: proxies are small) then there are several ways round the problem. An
increase to 256 methods could be achieved simply by adding a line at the very
beginning of xCall:
method &= 0xff;
but this would HAVE to be accompanied by an explicit test for the method count
limit (now 256) in PSFacBuf_CreateProxy so that the attempt to create a proxy
with too methods would simply fail rather than (as now) generate a proxy that
will randomly crash the application.
Another approach would be to create dummy functions (in assembler) that would
add 128, 256, 384, 512, etc to the 'method' argument before forwarding it on to
xCall. In that case, method numbers after 127 would generate proxies that
called one of the variant xCalls instead of the original one. The programming
in PSFacBuf_CreateProxy would be relatively straightforward, and the dummy
functions would not need to do any stack manipulation: they would simply add an
offset to the DWORD at [ESP+8] and then JMP straight to the start of xCall.
This would *still* give a finite limit to the number of methods, but the limit
would be much larger. Again, good engineering practice dictates that
PSFacBuf_CreateProxy should report an error if it encounters a number of
methods beyond the number that it was designed to cope with.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=10536
Summary: ITypeInfo_fnInvoke failed to convert param 0 to VT_BOOL
from VT_BSTR
Product: Wine
Version: 0.9.49.
Platform: PC
URL: http://uniqlo.jp/uniqlock
OS/Version: Linux
Status: UNCONFIRMED
Severity: enhancement
Priority: P2
Component: wine-ole
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: fnjordy(a)gmail.com
Uniqlock screensaver doesn't display anything, presumably it might be related
to the Wine output:
in CSoundUtils constructor:
fixme:win:WIN_CreateWindowEx Parent is HWND_MESSAGE
err:ole:ITypeInfo_fnInvoke failed to convert param 0 to VT_BOOL from VT_BSTR
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=11775
Summary: Oleview does not correctly generate idl files
Product: Wine
Version: 0.9.56.
Platform: Other
OS/Version: other
Status: NEW
Severity: enhancement
Priority: P2
Component: ole
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: m.b.lankhorst(a)gmail.com
When looking at the ipodservice typelib (install itunes v7.6, then look at the
typelib in C:\Program Files\iPod Service\bin\iPodService.exe in wine oleview,
it will generate wrong code.
HRESULT foo([in]long pointer, [out, retval]VARIANT_BOOL *rar);
is turned into:
VARIANT_BOOL foo([in]long pointer);
This happens for example with IItunesDevice_IsMounted.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=15384
Summary: Incorrect behaviour when using BIF_RETURNONLYFSDIRS |
BIF_BROWSEINCLUDEFILES
Product: Wine
Version: 1.0.0
Platform: All
OS/Version: Linux
Status: UNCONFIRMED
Severity: enhancement
Priority: P2
Component: shell32
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: boris.seve(a)drillscan.com
When calling SHBrowseForFolder with both BIF_RETURNONLYFSDIRS and
BIF_BROWSEINCLUDEFILES flags the 'Ok' button is incorrectly disabled when a
file is selected (button is enabled however when a directory is selected)
If only the BIF_BROWSEINCLUDEFILES flag is set the 'Ok' button is correctly
enabled when a file is selected.
AFAIK (and confirmed on Windows XP SP3) the 'Ok' should be enabled when a
directory is selected AND when a file is selected if both flags are set.
This holds true whether BIF_NEWDIALOGSTYLE is set or not.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=11096
Summary: Adobe AIR / Adobe Media Player pre 2 installer crashes
during MsiViewExecute
Product: Wine
Version: CVS/GIT
Platform: Other
OS/Version: other
Status: NEW
Keywords: download, Installer
Severity: normal
Priority: P2
Component: msi
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: dank(a)kegel.com
After working around bug 11094 by doing "wine regsvr32 rsaenh",
the next bug is a crash that is at least near
some MSI code, so I'll risk the MSI maintainer's wrath
and put it in that category :-)
To repeat:
download
http://fpdownload.macromedia.com/get/flashplayer/current/install_flash_play…
download http://download.macromedia.com/pub/labs/air/air_b3_win_121207.exe
download
http://download.macromedia.com/pub/labs/mediaplayer/adobemediaplayer_p2_122…
wineserver -k
rm -rf .wine
wine install_flash_player.exe
wine air_b3_win_121207.exe
wine regsvr32 rsaenh
wine ~/.wine/drive_c/Program\ Files/Common\ Files/Adobe\
AIR/Versions/1.0.6/Adobe\ AIR\ Application\ Installer.exe
adobemediaplayer_p2_122007.air
Crashes; +relay,+msi,+msidb,+seh seems to show the exception
happens in MsiViewExecute:
trace:msi:MSI_ViewExecute 0x171f40 0x18e3d0
trace:msidb:UPDATE_execute 0x172310 0x18e3d0
trace:msidb:SELECT_execute 0x1722d8 (nil)
trace:msidb:WHERE_execute 0x19db08 (nil)
trace:msidb:TABLE_execute 0x173268 (nil)
trace:msidb:TABLE_execute There are 2 columns
trace:msidb:TABLE_get_dimensions 0x173268 0x33e8c8 (nil)
0009:Call ntdll.RtlAllocateHeap(00110000,00000008,00000094) ret=7e3779f1
0009:Ret ntdll.RtlAllocateHeap() retval=0018dba0 ret=7e3779f1
trace:seh:raise_exception code=c0000005 flags=0 addr=0x7e35f539
I'll attach a full log.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=11094
Summary: Adobe AIR can't install Adobe Media Player pre 2
Product: Wine
Version: CVS/GIT
Platform: Other
OS/Version: other
Status: NEW
Keywords: download, Installer
Severity: normal
Priority: P2
Component: crypt32
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: dank(a)kegel.com
This is the next bug after bug 10956.
To reproduce, run the script
http://bugs.winehq.org/attachment.cgi?id=9893
Adobe media player prerelease 2,
http://labs.adobe.com/technologies/mediaplayer/install/
install fails.
It's kind of hard to tell, but I suspect it might be that
a crypto provider wasn't found:
trace:crypt:CryptAcquireContextW Did not find registry entry of crypto provider
for L"Software\\Microsoft\\Cryptography\\Defaults\\Provider Types\\Type 001".
... 49000 lines deleted ...
001d:Call gdi32.GetTextExtentPoint32A(00000314,006722f8 "The application could
not be installed because the AIR file is damaged. Try obtaining a new AIR
file",00000064,0033eff4) ret=1027b8cc
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=15951
Summary: Origin Pro 6.1 / 7.5 / 8.0 - Dialog in contour-plots
unreachable
Product: WineHQ Bugzilla
Version: unspecified
Platform: Other
URL: http://www.originlab.com/
OS/Version: other
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: bugzilla-unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: frederik(a)ietsmet.nl
In Origin Pro 6.1 / 7.5 / 8.0 the dialog for auto-spacing of levels, colors or
linestyles in contour-plots is unreachable.
I followed the tricks given in AppDB to get it to run in the first place: set
dll's msxml3 and msxml3r to native.
Error on the terminal is:
fixme:storage:StgCreateDocfile Transacted mode not implemented.
Steps to reproduce:
1) Create new matrix
2) menu: Matrix -> Set matrix values -> enter "cos(i/4)*cos(1/2)" (or any other
formula giving some nice contour lines) as value for cell(i,j)= -> OK
3) Create new contour plot via menu: Plot -> Contour plot -> Contour - B/w
Lines + Labels
4) Double-click in the middle of the contour plot -> a dialog Plot Details
appears.
5) try to click on one of the headings Levels / Fill / Line / Labels.
In Windows XP you get a new dialog allowing you to set min / max / # of levels
in either linear or exponential spacing (for the Levels-heading-dialog).
In Wine 1.0.1 this dialog does NOT appear at all and the error message above
appears on the terminal window.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=15253
Summary: Bitmap Font Problem
Product: Wine
Version: 1.1.4
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: fonts
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: giuseppe.adamo(a)gmail.com
Created an attachment (id=16039)
--> (http://bugs.winehq.org/attachment.cgi?id=16039)
Bitmap Font Test Program
I am actually trying to run under Linux a VB6 windows application for CNC
operators.
Everything works fine, but I have found a problem when using bitmap fonts
(tipically a .FON file type).
It seems that only one character is printed to the screen, the char that is
defined as the 'Default char' in the bitmap font header.
I simplified the problem writing a really small VB6 application that only calls
the font dialog using COMDLG32.OCX.
As you can see, even the standard dialog, when pointing to my font (WTerms1x),
prints the test string using only one character.
To setup the wine environment to run my application:
1) Extract the attached .zip archive (BitmapFonts.zip) in a directory of your
choice.
2) Copy the COMDLG32.OCX control in: ~/.wine/drive_c/windows/system32
3) Point to the above directory and register the activeX control by typing:
regsvr32 ./COMDLG32.OCX
4) Copy the SINGOLO.FON font file in: ~/.wine/drive_c/windows/Fonts
5) Run the registry editor by typing 'wine regedit'
6) Register the SINGOLO.FON font so that wine can see it. Point to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
7) Add a string key named WTerms1x with the value: C:\Windows\Fonts\SINGOLO.FON
Now, from the directory where you extracted BitmapFonts.zip, run the command:
wine BMPFontTest.exe then press the button on the main form.
If the font SINGOLO.FON has been correctly registered, you should see the
standard windows font dialog pointing to the font WTerms1x.
Taking a look at the example text in the dialog, you should notice that the
test string is composed all of the same (wrong) character.
To verify that the .FON file is correct and that probably wine prints only the
'Default char', I have included a bitmap font utility, Fony,
that can help you verify the font and change/check the 'Default char'
attribute.
Fony is freeware and can be downloaded from http://hukka.furtopia.org/
I hope for a reply since that problem 'IS A PROBLEM' for my application.
In the meanwhile ... VIVA WINE !!! :D
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=14290
Summary: winhelp: temporary 100% CPU use when loading some help
files
Product: Wine
Version: 1.1.0
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: minor
Priority: P2
Component: programs
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: markk(a)clara.co.uk
When loading some help files, Wine winhelp appears to hang for a while with
100% CPU use.
To demonstrate, download quenzar.hlp from
http://bugs.winehq.org/attachment.cgi?id=14572
and load into Wine winhelp.
CPU usage goes to 100% for about a minute (on my old slow PC), but the help
window does open eventually. There is no delay when opening the same file with
the Windows 95 WINHLP32.EXE under Wine.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=11764
Summary: surround 5.1 sound
Product: Wine
Version: 0.9.53.
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: enhancement
Priority: P2
Component: directx-dsound
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: iugamarian(a)yahoo.com
Winamp with Winamp AC3 Filter 1.01a performs better than Amarok 1.4.
Also the very old game Starcraft has support for surround.
Therefore please give more importance to the following:
Allow DirectSound acces to Alsa, for the rear left, rear right, center and
woofer speakers.
Yes, Linux does support surround. Use "alsamixer" to deactivate the mute
on the other speakers. Use Amarok, Totem, or their base Xine, to test surround.
You have to go to settings, select Xine Engine and select 5.1 surround (in Xine
you should select first "Master of the known universe" :) )
I am attaching an example of a file that the Xine engine cannot play,
but Winamp with Winamp AC3 Filter 1.01a with integrated dts support can.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.