http://bugs.winehq.org/show_bug.cgi?id=13319
Summary: In dlls/user32/edit.c EDIT_EM_ReplaceSel Clobbers
Important Var When Buffer Overflows
Product: Wine
Version: unspecified
Platform: All
OS/Version: All
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: user32
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: bsmith(a)sudleyplace.com
Please don't hate me, but I don't have git or anything like it installed
to make a formal patch, but I have benefited greatly from your work, so
I'd like to repay the effort by reporting a bug even though I realize
it's not in the correct format.
In a Windows app, I am using edit.c as a replacement for the EDIT
control in Windows. I don't use any of the other WineHQ files.
Here's a short description of the bug:
The handler EDIT_EM_ReplaceSel misbehaves when an insertion triggers a
buffer overflow. The code correctly calls EDIT_NOTIFY_PARENT(es,
EN_MAXTEXT), but shortly thereafter clobbers an important variable
(strl) by using it instead of a temporary.
The relevant OLD code in EDIT_EM_ReplaceSel is as follows:
--------------------------------------------------------------
if ((honor_limit) && (size > es->buffer_limit)) {
EDIT_NOTIFY_PARENT(es, EN_MAXTEXT);
/* Buffer limit can be smaller than the actual length of text
in combobox */
if (es->buffer_limit < (tl - (e-s)))
strl = 0;
else
strl = es->buffer_limit - (tl - (e-s));
}
if (!EDIT_MakeFit(es, tl - (e - s) + strl))
return;
--------------------------------------------------------------
the NEW code is as follows:
--------------------------------------------------------------
if ((honor_limit) && (size > es->buffer_limit)) {
EDIT_NOTIFY_PARENT(es, EN_MAXTEXT);
/* Buffer limit can be smaller than the actual length of text
in combobox */
if (es->buffer_limit < (tl - (e-s)))
strl2 = 0;
else
strl2 = es->buffer_limit - (tl - (e-s));
}
else
strl2 = strl;
if (!EDIT_MakeFit(es, tl - (e - s) + strl2))
return;
--------------------------------------------------------------
The calculation inside the honor_limit bracket of the value to use with
the call to EDIT_MakeFit uses strl as if it were a temp var. This
variable actually holds strlenW (lpsz_replace) and is used in later code
as if it still had the original value. Using a (new) variable strl2
solves that problem -- this variable is declared as a UINT in the
prologue. Perhaps you would prefer a name different from strl2 to
better reflect its temporary nature.
If you agree with the above analysis, I would greatly appreciate it if
someone would make this into a patch and take it from there. I have
make the above changes in my copy of edit.c and it works just fine when
the buffer overflows which is how I stumbled on this bug in the first place.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=10164
Summary: Pool of Radiance 1.4 intermittently shows garbage in
surfaces
Product: Wine
Version: 0.9.47.
Platform: PC
URL: http://www.fileshack.com/file.x/906/Pool+of+Radiance+Dem
o
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: wine-directx-d3d
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: sick_soul(a)yahoo.it
CC: xerox_xerox2000(a)yahoo.co.uk, stefandoesinger(a)gmx.at,
07067514(a)brookes.ac.uk
(see bug #10133)
After reverting d9fef10b71b9add27cfaeffa6d7e3ab42342bba7
I got Pool of Radiance 1.4 to start again.
I found another regression for this application,
in that some surfaces do not get displayed correctly, and some show
quick intermittent garbage in them. This does not happen with older
versions of wine.
I did a regression test for this, which gave me:
3b822b80feba396ec017c9ef0d96d59a1733a2d8 is first bad commit
commit 3b822b80feba396ec017c9ef0d96d59a1733a2d8
Author: Stefan Dösinger <stefan(a)codeweavers.com>
Date: Tue Aug 21 23:24:16 2007 +0200
wined3d: Reject opengl accelerated blits with system memory surfaces.
:040000 040000 8ef4e54af50c3dbd862ff89bc80e1d1b00791f31
dcf76dd03a3451b4eed44796f39ccb1faee4ae6f M dlls
I reverted the change in current git, and the problem went away.
To summarize I could get the application to start, and show
correct surfaces by reverting these two:
http://source.winehq.org/git/wine.git/?a=commitdiff_plain;h=d9fef10b71b9add…http://source.winehq.org/git/wine.git/?a=commitdiff_plain;h=3b822b80feba396…
I hope this information can be useful to you.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=14313
Summary: Areena 5 help pages don't work at all
Product: Wine
Version: 1.1.0
Platform: All
OS/Version: All
Status: UNCONFIRMED
Severity: trivial
Priority: P4
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: ape3000(a)gmail.com
In the game Areena 5, I can't use the help pages at all. They aren't very
important part of the game. In fact the help pages are quite useless, but I
submit a bug report, because I think this bug is blocking the Platinum rating
for the game.
So there is a menu called Apua -> Ohje (in English something like: Help -> Help
Contents). When I click it nothing happens. So the help pages can't be used at
all.
There are AREHELP.HLP and AREHELP.GID files in the game folder. All the help
data can be found the in somewhat packed format.
This will show up every time I click the help:
fixme:ole:OLEPictureImpl_Render Not quite correct implementation of rendering
icons...
I think that it has pretty much nothing to do with the real problem, but
anyways.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=14296
Summary: winhelp: Extraneous flashing cursor/caret
Product: Wine
Version: 1.1.0
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: trivial
Priority: P2
Component: programs
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: markk(a)clara.co.uk
Wine winhelp shows a flashing cursor/caret symbol when you click somewhere in
the text. Windows winhelp does not do that. That behaviour may be desired, e.g.
it makes selecting text using the keyboard possible. However...
Click in a page so the cursor is shown, then click on a link to go to another
page. A flashing cursor is present at the top left, even before you click in
the page.
On some help pages, the flashing cursor is present at the top left even before
the user clicks in the page. Also, if there is a large graphic at the top left,
the flashing cursor may appear (see cwdeluxe.hlp and click on the picture).
Windows 95 Winhelp does not allow images to be selected.
cwdeluxe.hlp is in winehelp_bugs.tar.bz2 at
http://bugs.winehq.org/attachment.cgi?id=14574
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=9466
Summary: the api status page doesn't work
Product: WineHQ.com
Version: unspecified
Platform: Other
OS/Version: other
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: misc-web
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: bl4ck.3yed(a)gmail.com
This is what it say
Warning: mysql_num_fields(): supplied argument is not a valid MySQL result
resource in /home/winehq/opt/tools/winapi_stats.php on line 118 Warning:
mysql_fetch_array(): supplied argument is not a valid MySQL result resource in
/home/winehq/opt/tools/winapi_stats.php on line 129
last modified: Fri Aug 24 9:53:14 CDT 2007
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=11433
Summary: unimplemented function ole32.dll.OleGetIconOfFile
Product: Wine
Version: 0.9.44.
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ole
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: alex.doll(a)agdconsulting.ca
Created an attachment (id=10561)
--> (http://bugs.winehq.org/attachment.cgi?id=10561)
Backtrace from the shell
Using Lotus Notes, attempted to attach an external file to a document. Notes
tried to determine the icon of the attached item (a PDF) and died:
Unhandled exception: unimplemented function ole32.dll.OleGetIconOfFile called
in 32-bit code (0x7b844852).
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=12799
Summary: Notepad++ : auto-completion window appears with a title
bar which is not the case under windows
Product: Wine
Version: 0.9.60
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: enhancement
Priority: P2
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: leohome(a)free.fr
Auto-completion feature works fine but when I use it, the window appears with
the title bar which is not the case under windows. This title bar hide the text
behind which prevents me to use this feature. (see attachment)
This problem occurs with all wine versions I have tested: 0.9.5x up to 0.9.60.
kubuntu 7.10
notepad++ version: all recent one I have tested
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=12377
Summary: Capella does not load font
Product: Wine
Version: 0.9.58.
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: anhaupt(a)gmx.ch
When Capella tries to load any font available for displaying notes (e.g.
capella3) it displays the following message:
"Damit dieser Stil richtig angezeigt wird, müssen sie die Schriftart
'capella3' installieren." (tranlsation: "To display this style correctly the
font 'capella3' has to be installed.").
The same message appears if you try to load any of the other fonts available
for capella.
Other programs (e.g. notepad) find the capella fonts and display them
correctly.
The problem exists in the current version (Capella 2008) as well as in earlier
versions.
A demo version that shows the error is available here:
http://www.capella.de/download_capella.htm
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=10770
Summary: TomTom HOME 2 does not start
Product: Wine
Version: CVS/GIT
Platform: PC
URL: http://download.tomtom.com/sweet/application/home2latest
/TomTomHOME2winlatest.exe
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: wine-binary
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: alex(a)seewald.at
CC: hans(a)it.vu.nl
TomTom HOME 2 - available at above link - does not start the GUI after
installation. Installation seems to work, all libraries are found, no obvious
system calls are missing, but there is still a problem.
I am using Debian Etch stable (4.0)
[Linux acer 2.6.23-rc3 #8 Thu Aug 30 17:27:22 CEST 2007 i686 GNU/Linux]
I have compiled Wine myself from yesterday's GIT version, as the Debian package
version still had the FindFirstVolumeW bug. I never encountered the text extent
bug, so presumably it has been fixed in that version. I am using gcc (GCC)
4.1.2 20061115 (prerelease) (Debian 4.1.1-21).
[Using built-in specs.
Target: i486-linux-gnu
Configured with: ../src/configure -v
--enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr
--enable-shared --with-system-zlib --libexecdir=/usr/lib
--without-included-gettext --enable-threads=posix --enable-nls
--program-suffix=-4.1 --enable-__cxa_atexit --enable-clocale=gnu
--enable-libstdcxx-debug --enable-mpfr --with-tune=i686
--enable-checking=release i486-linux-gnu
Thread model: posix
gcc version 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)]
Attached you find +relay, +seh and +tid logs, plus the output from configure
--verbose of the compiled version. Note +relay is very long, it seems that wine
switches on the debugger after encountering the error and so does not bail out.
If you need anything else, do tell.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=12185
Summary: Before You Know It crashes with wine v0.9.58 (worked on
9.54)
Product: Wine
Version: 0.9.58.
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: critical
Priority: P2
Component: gdiplus
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: RobMarshall(a)iglide.net
Created an attachment (id=11584)
--> (http://bugs.winehq.org/attachment.cgi?id=11584)
Trace from crash of Before You Know it
I installed and successfully used Transparent languages, "Before You Know It
Lite" (version 3.6) with wine 0.9.54. When I upgraded to 0.9.58 it crashes. I
have attached a trace.
Thanks,
Rob
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.