https://bugs.winehq.org/show_bug.cgi?id=48834
Bug ID: 48834
Summary: Rockstar Games Launcher CEF helper crashes (x11drv
use-after-free for HWND_MESSAGE)
Product: Wine
Version: 5.4
Hardware: x86
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: winex11.drv
Assignee: wine-bugs(a)winehq.org
Reporter: bshanks(a)codeweavers.com
Distribution: ---
Created attachment 66751
--> https://bugs.winehq.org/attachment.cgi?id=66751
Valgrind output showing backtraces of UAF
The problem: When the Rockstar Games Launcher is launched, 3 of its helper
processes (SocialClubHelper.exe) crash in XDeleteContext().
SocialClubHelper.exe is part of CEF, and the code causing the crash is ANGLE's
D3D9
renderer.<https://github.com/google/angle/blob/6dfdca836806b661cd0d0e090ef2cf1dc06a2e…>
Here's what I've figured out:
* ANGLE creates an HWND_MESSAGE window.
<https://github.com/google/angle/blob/6dfdca836806b661cd0d0e090ef2cf1dc06a2e…>
In X11DRV_create_win_data(), win_data is not created for the window (comment:
"don't create win data for HWND_MESSAGE windows")
* ANGLE uses the window as the focus window and device window when initializing
D3D9.
* The wined3d CS thread starts and calls wined3d_swapchain_gl_create_context(),
leading to x11drv create_gl_drawable(), then create_client_window().
create_client_window() creates win_data (comment is "explicitly create data for
HWND_MESSAGE windows since they can be used for OpenGL"), using the current
thread's (the CS thread's) Display pointer. I believe this is when the CS
thread calls XOpenDisplay().
* This works ok, until ANGLE shuts down. It first releases all the D3D9
objects:
<https://github.com/google/angle/blob/6dfdca836806b661cd0d0e090ef2cf1dc06a2e…>
Releasing D3D9 triggers wined3d to stop the CS thread, which ends with calling
FreeLibraryAndExitThread(). This eventually calls X11DRV_ThreadDetach(), which
closes the CS thread's Display.
* ANGLE then calls DestroyWindow() on the device/focus window. This leads to
x11drv destroy_whole_window(), which calls XDeleteContext() using the Display
from the win_data. This was the CS thread's Display, which has since been
closed/freed, causing use-after-free and (in this case) a crash.
Commenting out the HWND_MESSAGE exception in X11DRV_create_win_data() does fix
the crash, but this is likely not the correct fix.
I've attached part of a Valgrind output showing the crash and backtraces, and
should be able to add an ANGLE sample exe later that reproduces the bug.
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=46742
Bug ID: 46742
Summary: The Sims 2 demo needs support for ProcessVertices()
with software vertex shaders
Product: Wine
Version: 0.9.35.
Hardware: x86
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: directx-d3d
Assignee: wine-bugs(a)winehq.org
Reporter: z.figura12(a)gmail.com
Distribution: ---
Split off from bug 8051:
"Without ProcessVertices, characters will explode in family thumbnails (and
same if you disable shaders through the game's cheat menu), and explosion of
vertices will also happen with little icons that pop up above characters when
they make a friend or get married (you can realiably observe it by loading
Pleasant family).
In both cases, this pops up:
fixme:d3d:wined3d_device_process_vertices Output vertex declaration not
implemented yet.
err:d3d:get_flexible_vertex_size Unexpected position mask: 0x0"
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=33518
Bug #: 33518
Summary: Some floors in Star Trek (2013) are completely black
Product: Wine
Version: 1.5.29
Platform: x86
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: directx-d3d
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: eurekafag(a)eureka7.ru
Classification: Unclassified
This is how they look like in the game: http://i.imgur.com/sNy2z7l.png
This is how they should look (at least on Xbox360):
http://youtu.be/YQCUUcrLfPc?t=30m30s
Outdoors and everything else seems to be ok: http://i.imgur.com/Rv2O8sM.pnghttp://i.imgur.com/Ytoi8cC.png
I see this repeating message in the terminal: fixme:d3d:resource_check_usage
Unhandled usage flags 0x8.
Sometimes another message appears: fixme:d3d:wined3d_swapchain_present Ignoring
flags 0x80000000.
These two spam the output but nothing else appears while playing. I've run the
game with WINEDEBUG=+d3d and the resulting file is about 600M long compressed
to 23M. Maybe it will help. I launched the game and entered to the buggy room
from the screenshot above, then killed it to prevent extra output.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=48799
Bug ID: 48799
Summary: HOTAS kit Saitek X52 Pro doesn't show all buttons
Product: Wine
Version: 5.4
Hardware: x86
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: joy.cpl
Assignee: wine-bugs(a)winehq.org
Reporter: patola(a)gmail.com
Distribution: Ubuntu
Created attachment 66714
--> https://bugs.winehq.org/attachment.cgi?id=66714
Selecting a button higher than 32 and wine thinking it's button 1
The HOTAS kit Saitek X52 Pro has 9 axes and 39 buttons. Wine only shows 32 and
when a button higher than the 32th is pressed, it either registers it as button
1 or 2 or crashes outright with a dialog the messages:
wine: L"C:\\windows\\system32\\joy.cpl" is a dll, not an executable
wine: Unhandled page fault on write access to 00E06DB8 at address 7D612AE0
(thread 008e), starting debugger...
wine: Unhandled page fault on write access to 00E06DB8 at address 7D611AE0
(thread 0088), starting debugger...
0090:fixme:dbghelp:elf_search_auxv can't find symbol in module
Specifically, when button 35 is pressed (button 34 on jscal-gtk which counts
from 0 to 38), the crash happens. The two screenshots show three applications
using the joystick -- wine control panel, antimicro and jstest-gtk (which uses
through linux input (js) instead of evdev but it's the same hardware).
Also, enabling the js device "Logitech X52 Professional H.O.T.A.S. (js)" leads
to an inconditional crash when selecting it on the "test joystick" tab but I
understand this might be another issue. I need the HOTAS in evdev mode only.
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=46770
Bug ID: 46770
Summary: Splinter Cell: Blacklist crashes in DX9 mode when
using FAudio
Product: Wine
Version: 4.3
Hardware: x86-64
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: xaudio2
Assignee: wine-bugs(a)winehq.org
Reporter: andrey.goosev(a)gmail.com
Distribution: ---
Created attachment 63782
--> https://bugs.winehq.org/attachment.cgi?id=63782
log
No crash in DX11 mode.
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47254
Bug ID: 47254
Summary: Unhandled exception: page fault on write access in
32-bit code
Product: Wine
Version: 4.0.1
Hardware: x86-64
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: -unknown
Assignee: wine-bugs(a)winehq.org
Reporter: scw189(a)cox.net
Distribution: ---
Created attachment 64540
--> https://bugs.winehq.org/attachment.cgi?id=64540
Back trace dump from Wine crash.
Used to run Legacy9 (genealogy software). Mostly runs Ok. But, there are
latency issues There is a problem with buffering keyboard input characters. If
you select an input field and start typing too fast, the first two characters
will generally be ignored. There also seem to be issues with background
processes where after changing windows you need to wait 4-6 seconds before
input keystrokes are accepted (they are also not buffered).
Randomly, the system will display a message box about "the system has
experienced a serious error..." and a crash dump is displayed: "Unhandled
exception: page fault on write access to 0x6d4a95c8 in 32-bit code
(0x7b476e81)." The message box allows a backtrace dump to be saved.
The Legacy9 program is then locked on the last display screen and is
un-responsive to keyboard or mouse clicks, although the mouse pointer is still
active. The computer itself is not locked up. Closing the program error message
box also closes the Legacy9 application. The Legacy9 application can be
restarted at that time.
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=40945
Bug ID: 40945
Summary: Post provider setup of WMI core 1.5 installer needs
Product: Wine
Version: 0.9.34.
Hardware: x86
URL: https://web.archive.org/web/*/http://download.microsof
t.com/download/platformsdk/wmi9x/1.5/W9X/EN-US/wmi9x.e
xe
OS: Linux
Status: NEW
Keywords: download, Installer, patch
Severity: minor
Priority: P2
Component: advapi32
Assignee: wine-bugs(a)winehq.org
Reporter: austinenglish(a)gmail.com
Distribution: ---
Follow up to bug 37429
You'll need to grab the exe from archive.org. Set your wineprefix to win98, and
install. It will crash late in the process, with:
Unhandled exception: page fault on read access to 0x00000004 in 32-bit code
(0x7da6799f).
Register dump:
CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b
EIP:7da6799f ESP:0033c590 EBP:0033c5c8 EFLAGS:00210202( R- -- I - - - )
EAX:7d895869 EBX:7da81000 ECX:0033c580 EDX:7ffdf000
ESI:01419738 EDI:00000000
Stack dump:
0x0033c590: 7d98a460 014192b8 00000000 014192e0
0x0033c5a0: 0033c630 01419b50 0000c5d0 7d98a460
0x0033c5b0: 00000020 7da67946 0033c5dc 00b81aa0
0x0033c5c0: 00000000 0033cbe0 0033c5f8 6206ccb5
0x0033c5d0: 00000000 0033cbe0 6206ccb5 01419b50
0x0033c5e0: 00000000 0033c630 00e90690 00000000
Backtrace:
=>0 0x7da6799f class_object_SpawnInstance+0x6f(iface=<couldn't compute
location>, lFlags=<couldn't compute location>, ppNewInstance=<couldn't compute
location>) [/home/austin/wine-git/dlls/wbemprox/class.c:221] in wbemprox
(0x0033c5c8)
1 0x6206ccb5 in mofd (+0xccb4) (0x0033c5f8)
2 0x6206e94a in mofd (+0xe949) (0x0033c680)
3 0x62062199 in mofd (+0x2198) (0x0033cbec)
4 0x62074d0a in mofd (+0x14d09) (0x0033d1bc)
5 0x003428bc in wbemupgd (+0x28bb) (0x0033d408)
6 0x003410ac in wbemupgd (+0x10ab) (0x0033d9a4)
7 0x00343528 in wbemupgd (+0x3527) (0x0033d9b8)
8 0x100150d0 in glc96e7.tmp (+0x150cf) (0x0033e3d8)
9 0x1000433e in glc96e7.tmp (+0x433d) (0x0033f1c8)
0x7da6799f class_object_SpawnInstance+0x6f
[/home/austin/wine-git/dlls/wbemprox/class.c:221] in wbemprox: movl
0x4(%edi),%eax
221 if (!(record->fields = heap_alloc( table->num_cols * sizeof(struct
field) )))
wine-1.9.14-15-g1bcc7ce
austin@austin2:~$ sha1sum wmi9x.exe
62752e9c1b879688c26f205eebf07d3783906c3e wmi9x.exe
austin@austin2:~$ du -sh wmi9x.exe
3.0M wmi9x.exe
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=44106
Bug ID: 44106
Summary: Call of Duty Black Ops III Crashes
Product: Wine-staging
Version: 2.21
Hardware: x86-64
OS: Linux
Status: UNCONFIRMED
Severity: major
Priority: P2
Component: -unknown
Assignee: wine-bugs(a)winehq.org
Reporter: lilwins(a)hotmail.com
CC: erich.e.hoover(a)wine-staging.com, michael(a)fds-team.de,
sebastian(a)fds-team.de
Distribution: ---
Created attachment 59829
--> https://bugs.winehq.org/attachment.cgi?id=59829
Call of Duty Black Ops III crash log
Game crashes at start up, having similar issues with other Call of Duty titles.
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=30699
Bug #: 30699
Summary: wine printing: barcode is not printed from VB6
application
Product: Wine
Version: unspecified
Platform: x86-64
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: wineps.drv
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: edwin+winebugs(a)etorok.net
Classification: Unclassified
Created attachment 40201
--> http://bugs.winehq.org/attachment.cgi?id=40201
barcode screenshot
There is an application provided by the Romanian finance administration for
printing Payment sheets with barcodes. I tried to use it in Wine (it appears to
be a VB6 application), and I could enter all the data, and it displayed a
generated barcode.
However when I tried printing it didn't print the barcode. This happens both
when printing to my printer (Samsung ML-2010P), or using CUPS-PDF.
Attached is the PDF produced when printing through CUPS, and a screenshot taken
while printing.
Notice that on the screenshot there is a barcode in the right towards the top,
and in the produced PDF there is no barcode at all.
Attached is also WINEDEBUG=+relay,+seh,+tid,+psdrv output.
How to reproduce (including download URL):
1. Prepare application
mkdir $HOME/.wine-bug
export WINEPREFIX=$HOME/.wine-bug
# create winedir
winecfg
# get program
wget
http://static.anaf.ro/static/10/anaf/aplicatii/op_fv/opfv2010/instal_opfv_2…
unzip instal_OPFV_28032012.zip
wine instal_OPFV_2012.exe
# set locale: if date format is wrong program refuses to work
export LANG=ro_RO.UTF-8 LANGUAGE=ro_RO.UTF-8 LC_TIME=ro_RO.UTF-8
cd '$HOME/.wine-bug/drive_c/Program Files/OPFV 2012'
# enter test data
cat >ordine.txt <<EOF
1,1,1,TEST,1234567897,,,,BUGETUL DE
STAT,1234567897,RO26TREZ57820470101XXXXX,,,BUGETUL DE STAT,16/05/2012,FV
EOF
2. Make sure you have a printer. Bug reproduces with CUPS-PDF too, so edit
$HOME/.wine-bug/drive_c/windows/win.ini, and use these settings for the
printer:
[devices]
PDF=wineps.drv,CUPS:PDF
[PrinterPorts]
PDF=wineps.drv,CUPS:PDF,15,45
[windows]
device=PDF,wineps.drv,CUPS:PDF
3. Run app
wine OPFV_2012.exe
4. Print from the application
- Click on "FV"
- Choose 1,1,FV from the 'Nr. de ordine, Nr. OP/FV' dropdown
- Click "Incarcare"
- Click "Listare"
5. Look at the printed document, or PDF and notice that the barcode on the top
right is missing in the printout.
See attached PDF vs. attached screenshot. The barcode IS visible during
printing, its just never printed.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=19751
Summary: VB6 format function
Product: Wine
Version: 1.1.27
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: hub_hotmail(a)hotmail.com
THIS IS A VB6 PROGRAM
WINDOWS
---------
FormatoBr = "#,##0.00"
debug.print Format(TxtValorCadTituloNUM, FormatoBr), , "ONLY_FORMAT"
= 1,00
debug.print Format(CCur(TxtValorCadTituloNUM), FormatoBr), , "FORMAT_WITH_CCUR"
= 1,00
*****************************************************************************
wine LINUX
----------
FormatoBr = "#,##0.00"
debug.print Format(TxtValorCadTituloNUM, FormatoBr), , "ONLY_FORMAT"
= 100,00
debug.print Format(CCur(TxtValorCadTituloNUM), FormatoBr), , "FORMAT_WITH_CCUR"
= 1,00
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.