https://bugs.winehq.org/show_bug.cgi?id=45422
Bug ID: 45422
Summary: ./tools/sfnt2fon/sfnt2fon.c shows a heap buffer
overflow fill_fontinfo()
Product: Wine
Version: 3.11
Hardware: x86
URL: https://bugs.winehq.org/show_bug.cgi?id=40330
OS: Linux
Status: NEW
Keywords: download, source, valgrind
Severity: normal
Priority: P2
Component: tools
Assignee: wine-bugs(a)winehq.org
Reporter: austinenglish(a)gmail.com
Distribution: Gentoo
First noticed in #40330, with ASAN:
../tools/sfnt2fon/sfnt2fon -o sserifee.fon ms_sans_serif.ttf -d 129 13,1250,5
16,1250,7
=================================================================
==18356==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf5a06ab3 at
pc 0x5658546e bp 0xffd67ec8 sp 0xffd67eb8
READ of size 1 at 0xf5a06ab3 thread T0
#0 0x5658546d in fill_fontinfo
(/var/lib/jenkins/home/workspace/wine-gcc-asan/tools/sfnt2fon/sfnt2fon+0x946d)
#1 0x56585da8 in main
(/var/lib/jenkins/home/workspace/wine-gcc-asan/tools/sfnt2fon/sfnt2fon+0x9da8)
#2 0xf7680302 in __libc_start_main (/lib32/libc.so.6+0x18302)
#3 0x56582070
(/var/lib/jenkins/home/workspace/wine-gcc-asan/tools/sfnt2fon/sfnt2fon+0x6070)
0xf5a06ab3 is located 1 bytes to the right of 2-byte region
[0xf5a06ab0,0xf5a06ab2)
allocated by thread T0 here:
#0 0xf7a42ed4 in malloc
(/usr/lib/gcc/x86_64-pc-linux-gnu/7.3.0/32/libasan.so.4+0xe5ed4)
#1 0xf785e437 (/usr/lib32/libfreetype.so.6+0x9437)
SUMMARY: AddressSanitizer: heap-buffer-overflow
(/var/lib/jenkins/home/workspace/wine-gcc-asan/tools/sfnt2fon/sfnt2fon+0x946d)
in fill_fontinfo
Shadow bytes around the buggy address:
0x3eb40d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x3eb40d10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x3eb40d20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x3eb40d30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x3eb40d40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x3eb40d50: fa fa fa fa fa fa[02]fa fa fa fd fa fa fa fd fa
0x3eb40d60: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
0x3eb40d70: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fd
0x3eb40d80: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x3eb40d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x3eb40da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==18356==ABORTING
Using Valgrind gets better line numbers:
austin@valgrindbox ~/wine-valgrind/fonts $ .
~/src/wine-valgrind/scripts/vg-wrapper.sh
austin@valgrindbox ~/wine-valgrind/fonts $ valgrind make sserifee.fon
../tools/sfnt2fon/sfnt2fon -o sserifee.fon ms_sans_serif.ttf -d 129 13,1250,5
16,1250,7
==20606== Invalid read of size 1
==20606== at 0x10A91E: fill_fontinfo (sfnt2fon.c:577)
==20606== by 0x10AD1F: main (sfnt2fon.c:729)
==20606== Address 0x4be6f03 is 1 bytes after a block of size 2 alloc'd
==20606== at 0x482D58B: malloc (vg_replace_malloc.c:299)
==20606== by 0x487DD87: ft_alloc (ftsystem.c:102)
==20606== by 0x488592E: ft_mem_qalloc (ftutil.c:76)
==20606== by 0x488592E: ft_mem_alloc (ftutil.c:55)
==20606== by 0x488632E: ft_glyphslot_alloc_bitmap (ftobjs.c:490)
==20606== by 0x48C2D62: tt_sbit_decoder_alloc_bitmap (ttsbit.c:628)
==20606== by 0x48C2D62: tt_sbit_decoder_load_bitmap (ttsbit.c:1234)
==20606== by 0x48C2D62: tt_sbit_decoder_load_image (ttsbit.c:1439)
==20606== by 0x48C8265: tt_face_load_sbit_image (ttsbit.c:1616)
==20606== by 0x489F269: load_sbit_image (ttgload.c:2308)
==20606== by 0x489F269: TT_Load_Glyph (ttgload.c:2716)
==20606== by 0x489F269: tt_glyph_load (ttdriver.c:468)
==20606== by 0x4882E0F: FT_Load_Glyph (ftobjs.c:913)
==20606== by 0x488371D: FT_Load_Char (ftobjs.c:1051)
==20606== by 0x10A9F7: fill_fontinfo (sfnt2fon.c:550)
==20606== by 0x10AD1F: main (sfnt2fon.c:729)
==20606==
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=52294
Bug ID: 52294
Summary: DYSMANTLE seems to need
d3d11_device_CreateRasterizerState1
Product: Wine
Version: 7.0-rc3
Hardware: x86-64
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: directx-d3d
Assignee: wine-bugs(a)winehq.org
Reporter: berillions(a)gmail.com
Distribution: ---
Created attachment 71440
--> https://bugs.winehq.org/attachment.cgi?id=71440
ogl +d3d log
Hello,
I tried this d3d11 game with OpenGL and Vulkan renderer from Wine.
In the both case, the game crashes with the same stub :
****
010c:fixme:d3d11:d3d11_device_CreateRasterizerState1 iface 0000000001057A50,
desc 000000000011FAF0, state 000000000011FAE8 stub!
****
With DXVK, there is not issue, the game launches correctly.
I attach the OGL and Vulkan +d3d log
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=52048
Bug ID: 52048
Summary: CreateProcess() might not spawn console for new
process
Product: Wine
Version: 6.21
Hardware: x86-64
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: kernel32
Assignee: wine-bugs(a)winehq.org
Reporter: colin1207(a)gmx.net
Distribution: ---
Created attachment 71059
--> https://bugs.winehq.org/attachment.cgi?id=71059
demo programs (see description)
When launching a console application by calling CreateProcess() without any
process creation flags, wine will not spawn a new console window if the parent
process is not currently attached to a console that the child could inherit,
unless explicitly requested with the CREATE_NEW_CONSOLE flag.
Windows defaults to the behaviour of allocating a new console for the process,
even without explicit request, while wine will not.
This might break several applications that assume to have a console attached
and will crash, for example, when trying to initialize curses.
Attached is a demo application:
Running launcher.exe on windows will successfully open a console for
helloworld.exe after the CreateProcess call.
All tested wine versions however, will not allocate a new console.
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=51017
Bug ID: 51017
Summary: Microsoft PowerToys installer crashes
Product: Wine
Version: 6.6
Hardware: x86-64
URL: https://web.archive.org/web/20210403201453/https://github.com/microsoft/PowerToys/releases/download/v0.35.0/
PowerToysSetup-0.35.0-x64.exe
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: -unknown
Assignee: wine-bugs(a)winehq.org
Reporter: the.ideals(a)gmail.com
Distribution: ---
Created attachment 69864
--> https://bugs.winehq.org/attachment.cgi?id=69864
log
https://github.com/microsoft/PowerToys/
.NET Core 3.1.13 is used with Release v0.35.0.
0114:fixme:kernelbase:AppPolicyGetThreadInitializationType FFFFFFFFFFFFFFFA,
000000000136FE10
0110:fixme:combase:RoGetActivationFactory (L"",
{44a9796f-723e-4fdf-a218-033e75b0c084}, 000000000011E720): semi-stub
wine: Unhandled page fault on read access to 0000001600000001 at address
000000007B0524B1 (thread 0110), starting debugger...
Unhandled exception: page fault on read access to 0x1600000001 in 64-bit code
(0x000000007b0524b1).
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=35436
Bug ID: 35436
Summary: NeteaseMusic client can't play music
Product: Wine
Version: 1.7.11
Hardware: x86
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: -unknown
Assignee: wine-bugs(a)winehq.org
Reporter: fangpeishi(a)gmail.com
Classification: Unclassified
Created attachment 47292
--> http://bugs.winehq.org/attachment.cgi?id=47292
the terminal output
steps:
1.install&open client;
2.add songs to playlist;
3.click the play button.
BUT Netease music client did not start playing.
download url:
Netease music client(网易云音乐客户端): http://music.163.com/#/download
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=51903
Bug ID: 51903
Summary: Nokia SDK 2.0: Can't detect Java RMI ports
Product: Wine
Version: 6.16
Hardware: x86-64
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: -unknown
Assignee: wine-bugs(a)winehq.org
Reporter: joseskvolpe(a)gmail.com
Distribution: ---
Created attachment 70854
--> https://bugs.winehq.org/attachment.cgi?id=70854
Screenshot
Wine fails to connect Nokia SDK to a open Java RMI port. After opening the
software ($NOKIADIR/bin/emulator.exe), it shows a pop-up with a message saying:
"The internal RMI registry port 1099 may be in use by another application. If
the SDK does not start select the Networking tab and enter another internal RMI
registry port number."
Forcing to initialize the RMI from Wine (wine start
$JDK_DIR/bin/rmiregistry.exe $PORT) or from Java for Linux (rmiregistry $PORT),
or changing the port number, doesn't changes the result.
After pressing Ok, the applciation crashes with this message on Wine CMD:
Error: invalid query
"Nokia SDK 2.0 for Java" Connection Terminated
I'm reporting it on Wine 6.16 because that's currently the latest version for
my distribution, but i've tried it on Wine 6.19 too.
I've reported it in the forum with some screenshots:
https://forum.winehq.org/viewtopic.php?f=8&t=35774
I've also reported it on AppDB:
https://appdb.winehq.org/objectManager.php?sClass=version&iId=40335
Procedures:
1 - First, that's needed to install 32-Bits Java 1.6 for Windows to run this
application. Java 1.7 works too according to the software changelogs. You can
download it from Oracle but you'll need to login:
https://www.oracle.com/java/technologies/downloads/archive/
2 - Install Nokia SDK 2.0
3 - Run it from the shortcut or from the EXE located in bin/emulator.exe
Download for Nokia SDK 2.0:
https://www.softpedia.com/get/Programming/SDK-DDK/Nokia-SDK.shtml
SHA1 (Offline installer): 969dc440a420a7a3a210518f7fc4730f52826ad2
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=48210
Bug ID: 48210
Summary: tax2019-installer crashes at start
Product: Wine
Version: 4.21
Hardware: x86
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: windowscodecs
Assignee: wine-bugs(a)winehq.org
Reporter: peter.huyoff(a)gmx.de
Distribution: ---
Created attachment 65844
--> https://bugs.winehq.org/attachment.cgi?id=65844
backtrace-dump
When i attempt to start installation, the installer aborts
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=52160
Bug ID: 52160
Summary: How to get Office 365 help?
Product: Packaging
Version: unspecified
Hardware: x86-64
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: wine-packages
Assignee: wine-bugs(a)winehq.org
Reporter: davidjones64619(a)gmail.com
CC: dimesio(a)earthlink.net
Distribution: ---
You can either get an answer to your query in the community forum of Microsoft
365. Or you can also submit your service request. For Office 365 help, do the
following.
Login to Microsoft 365 and tap ‘Support.’
Now choose ‘New service request.’
You can also call the toll free number for seeking support.
https://www.emailsupport.us/microsoft-office-365-support
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=52135
Bug ID: 52135
Summary: Failed to connect to the mount manager in Wine-Staging
Product: Wine-staging
Version: 6.22
Hardware: x86-64
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: -unknown
Assignee: wine-bugs(a)winehq.org
Reporter: gyebro69(a)gmail.com
CC: leslie_alistair(a)hotmail.com, z.figura12(a)gmail.com
Distribution: ArchLinux
Created attachment 71178
--> https://bugs.winehq.org/attachment.cgi?id=71178
terminal output
The problem appeared in Staging a couple days ago: when running 'winecfg' to
create a new prefix or update an existing one, winecfg crashes and the 'Drives'
tab is blank showing an error: Failed to connect to the mount manager; the
drive configuration cannot be edited.
According to the regression test I performed between upstream Wine and
Wine-Staging the Staging patch to blame:
https://github.com/wine-staging/wine-staging/blob/master/patches/ntdll-Crit…
The first upstream commit when the bug appears:
95615a4afbac69b171d54533a4494e43f7811b55
mountmgr: Move the DBus support to the Unix library.
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.