wine-bugs November 2022

wine-bugs@winehq.org

1 participants
3901 discussions

[Bug 21483] New: changed token security breaks .NET Framework SDK tools
by wine-bugs＠winehq.org 16 Nov '25

16 Nov '25

http://bugs.winehq.org/show_bug.cgi?id=21483 Summary: changed token security breaks .NET Framework SDK tools Product: Wine Version: 1.1.33 Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: wineserver AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Hello, some of Microsoft's tools from .NET Framework SDKs - namely managed debuggers (CLR) - stopped working after 1.1.33+ release. They seem to be very picky about object security. I bisected this one but technically this isn't a regression because Rob's token patches made Wine more correct - exposing another object security problem. --- snip --- $ git bisect bad bd56916f90e68632993a7275fe30a55a7efa222a is the first bad commit commit bd56916f90e68632993a7275fe30a55a7efa222a Author: Rob Shearman <robertshearman(a)gmail.com> Date: Mon Nov 16 20:11:06 2009 +0000 server: Extend get_token_user server call to also retrieve SIDs for the token's owner or primary group. :040000 040000 829f1543526675ae48f6fde8c8cedff74fd51797 7a77653291795c209ec529dd6660d52fc922a58c M dlls :040000 040000 57735b53b28db37ac4627dc009000e225175164a 4dcc1388cb136e559c06106632c08e8e610fe557 M include :040000 040000 4e83227cb0133c7e288a1e930461d4efe1130882 cf1c3539d6b3c91c854fa2b9b672f68ea601f639 M server --- snip --- "old" behaviour, where default process token was like this: Token owner -> S-1-5-4 "NT AUTHORITY\INTERACTIVE" (well-known group) Token user -> S-1-5-4 "NT AUTHORITY\INTERACTIVE" (well-known group) Token primary group -> S-1-5-32-544 "BUILTIN\Administrators" (alias) NtQueryInformationToken had the token owner info hard-coded (to SECURITY_INTERACTIVE_RID) while Rob's patches moved the actual query to wineserver. --- Basically the app code that verifies the security of created objects goes like this: - get SD from created object (event) handle -> GetKernelObjectSecurity( OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION) - get owner SID of SD -> GetSecurityDescriptorOwner() -> SID1 - get DACL of SD -> GetSecurityDescriptorDacl() - for each ACE from DACL (GetAce) -> SID2: check ACE SID against SD owner SID -> EqualSid( SID1, SID2) - match -> profit! not -> fail! --- snip --- ... 0023: create_event( access=001f0003, attributes=00000080, manual_reset=1, initial_state=0, objattr={rootdir=0014,sd={control=00000004,owner=<not present>,group=<not present>,sacl={},dacl={{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-4}},{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-4}}}},name=L"Global\\CorDBIPCSetupSyncEvent_36"} ) 0023: create_event() = 0 { handle=01c4 } ... 0025:trace:advapi:GetKernelObjectSecurity (0xc4,0x00000005,0x14ef40,0x00000050,0x33f7e8) 0025:trace:ntdll:NtQuerySecurityObject (0xc4,0x00000005,0x14ef40,0x00000050,0x33f7e8) 0025: get_security_object( handle=00c4, security_info=00000005 ) 0025: get_security_object() = 0 { sd_len=00000050, sd={control=00000037,owner={S-1-5-4},group=<not present>,sacl={},dacl={{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-4}},{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-4}}}} } 0025:trace:ntdll:RtlGetDaclSecurityDescriptor (0x14ef40,0x33f7c3,0x33f7ec,0x33f7c2) 0025:trace:ntdll:RtlGetAce (0x14ef60,0,0x33f7f0) 0025:trace:ntdll:RtlLengthSid sid=0x14ef54 0025: open_event( access=001f0003, attributes=00000002, rootdir=0034, name=L"Global\\CorDBIPCLSEventAvailName_36" ) 0025: open_event() = 0 { handle=00c8 } ... --- snip --- "new" behaviour, where default process token is now like this: Token owner -> S-1-5-32-544 "BUILTIN\Administrators" (alias) Token user -> S-1-5-4 "NT AUTHORITY\INTERACTIVE" (well-known group) Token primary group -> S-1-5-32-544 "BUILTIN\Administrators" (alias) --- snip --- ... 0024:trace:ntdll:NtOpenProcessTokenEx (0x1b0,0x00000008,0x00000000,0x318e6d0) 0024: open_token( handle=01b0, access=00000008, attributes=00000000, flags=00000000 ) 0024: open_token() = 0 { token=01b4 } ... 0024:trace:advapi:GetTokenInformation (0x1b4, TokenOwner, 0x184130, 20, 0x318e6e0): 0024:trace:ntdll:NtQueryInformationToken (0x1b4,4,0x184130,20,0x318e6e0) 0024: get_token_sid( handle=01b4, which_sid=00000004 ) 0024: get_token_sid() = 0 { sid_len=16, sid={S-1-5-32-544} } ... 0024: create_event( access=001f0003, attributes=00000080, manual_reset=1, initial_state=0, objattr={rootdir=0018,sd={control=00000004,owner=<not present>,group=<not present>,sacl={},dacl={{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-32-544}},{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-32-544}}}},name=L"Global\\CorDBIPCSetupSyncEvent_37"} ) 0024: create_event() = 0 { handle=01c8 } ... 0026:trace:advapi:GetKernelObjectSecurity (0xc8,0x00000005,(nil),0x00000000,0x33f7e8) 0026:trace:ntdll:NtQuerySecurityObject (0xc8,0x00000005,(nil),0x00000000,0x33f7e8) 0026: get_security_object( handle=00c8, security_info=00000005 ) 0026: get_security_object() = 0 { sd_len=00000058, sd={control=00000037,owner={S-1-5-4},group=<not present>,sacl={},dacl={{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-32-544}},{AceType=ACCESS_ALLOWED_ACE_TYPE,Mask=e01f001f,AceFlags=0,Sid={S-1-5-32-544}}}} } ... --- snip --- Using the "admins" sid (alias) as token user in server/token.c:token_create_admin() instead of current "interactive" sid fixes the problem. Though I don't know if this is the right thing to do. I hope I provided enough infos and let Alexandre handle it ;-) To get detailed token infos/dumps you might be interested in this little console app, from cygwin's Corinna Vinschen ;-) http://www.mail-archive.com/cygwin@cygwin.com/msg71800.html It might provide useful information when run under different security principals. Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 19

[Bug 45000] New: Ziphead by CNCD & Fairlight fails with GL_OUT_OF_MEMORY
by wine-bugs＠winehq.org 16 Nov '25

16 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=45000 Bug ID: 45000 Summary: Ziphead by CNCD & Fairlight fails with GL_OUT_OF_MEMORY Product: Wine Version: 3.6 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: directx-d3d Assignee: wine-bugs(a)winehq.org Reporter: arabek+wine(a)gmail.com Distribution: --- Created attachment 61129 --> https://bugs.winehq.org/attachment.cgi?id=61129 wine-staging ziphead.log (gzipped) A demoscene demo from 2015 fails to show any kind of output. I'm attaching the log. Expected result: running as under native Windows. Wine version: 3.6 & 3.6-staging (basically the same output, attached is the log from staging). -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 6

[Bug 44899] New: Access violation at address 000406686 read of address FFFFFFFFFE8
by wine-bugs＠winehq.org 16 Nov '25

16 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=44899 Bug ID: 44899 Summary: Access violation at address 000406686 read of address FFFFFFFFFE8 Product: Wine Version: 3.2 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: stevedonato(a)gmail.com Distribution: --- Created attachment 60979 --> https://bugs.winehq.org/attachment.cgi?id=60979 the Program exe attempte to install (PowerISO7-x64.exe) when I got; "Access violation at address 000406686 read of address FFFFFFFFFE8" and no trace dump using wine version 3.2 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 5

[Bug 49987] New: Application freeze when trying to open file chooser dialog
by WineHQ Bugzilla 15 Nov '25

15 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=49987 Bug ID: 49987 Summary: Application freeze when trying to open file chooser dialog Product: Wine Version: 5.19 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: mikrutrafal(a)protonmail.com Distribution: --- Created attachment 68389 --> https://bugs.winehq.org/attachment.cgi?id=68389 Full log When I download my GTK app - https://github.com/qarmin/czkawka/releases/download/1.1.0/windows_czkawka_g… and run it, then when clicking at "+Add" directly below "Included Directories", then app freeze Suspicious errors from console ``` 01d8:fixme:imm:ImmGetOpenStatus (000000000383F3B0): semi-stub 01d8:fixme:imm:ImmReleaseContext (0000000000030082, 000000000383F3B0): stub 01d8:fixme:file:GetLongPathNameW UNC pathname L"\\\\?\\C:\\users\\rafal\\Local Settings\\Application Data\\recently-used.xbel" 01d8:fixme:file:GetLongPathNameW UNC pathname L"\\\\?\\C:\\users\\rafal\\Local Settings\\Application Data\\gtk-3.0\\bookmarks" 01d8:err:shell:SHGetFileInfoW pidl is null! 01d8:err:shell:SHGetFileInfoW pidl is null! (czkawka_gui.exe:468): Gtk-WARNING **: 14:44:44.483: Error loading theme icon 'list-add' for stock: Icon 'list-add' not present in theme Adwaita 01d8:fixme:file:GetLongPathNameW UNC pathname L"\\\\?\\C:\\users\\rafal\\Local Settings\\Application Data\\gtk-3.0\\bookmarks" 01d8:fixme:file:GetLongPathNameW UNC pathname L"\\\\?\\C:\\users\\rafal\\Local Settings\\Application Data\\gtk-3.0\\servers" ``` On Windows none of this errors is shown -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 6

[Bug 50182] New: Hotline Miami 2 GOG version not launch after install.
by WineHQ Bugzilla 14 Nov '25

14 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=50182 Bug ID: 50182 Summary: Hotline Miami 2 GOG version not launch after install. Product: Wine Version: 5.21 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: directx-d3d Assignee: wine-bugs(a)winehq.org Reporter: pamungkassendy(a)gmail.com Distribution: --- Created attachment 68700 --> https://bugs.winehq.org/attachment.cgi?id=68700 Hotline Miami 2 GOG Version Game Didn't launch and instead give a crasth report -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 1

[Bug 47251] New: add support for ConPTY API (pseudo console)
by wine-bugs＠winehq.org 14 Nov '25

14 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=47251 Bug ID: 47251 Summary: add support for ConPTY API (pseudo console) Product: Wine Version: unspecified Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: enhancement Priority: P2 Component: cmd Assignee: wine-bugs(a)winehq.org Reporter: programmerjake(a)gmail.com Distribution: --- as in title. API reference: https://docs.microsoft.com/en-us/windows/console/creating-a-pseudoconsole-s… -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 8

[Bug 52128] New: Hog4PC 3.17 installer VBScript custom action wants scrrun:filesys_MoveFolder implementation
by WineHQ Bugzilla 14 Nov '25

14 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=52128 Bug ID: 52128 Summary: Hog4PC 3.17 installer VBScript custom action wants scrrun:filesys_MoveFolder implementation Product: Wine Version: 6.22 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: scrrun Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, as it says. --- snip --- $ wine msiexec -i Hog_4_PC_3.17.0.3327.msi ... 0184:trace:scrrun:filesys_FolderExists 0362A084 L"C:\\users\\focht\\AppData\\Roaming" 02F0F970 ... 0184:fixme:scrrun:filesys_MoveFolder 0362A084 L"C:\\users\\focht\\AppData\\Roaming" L"C:\\users\\focht\\AppData\\Roaming" ... 0184:err:msi:MsiActiveScriptSite_OnScriptError script error: L"Object doesn't support this action" ... 0184:trace:msi:ScriptThread custom action (184) returned 1603 --- snip --- VBScript custom action scriptlet: --- snip --- Function renamePersistentDir() Dim appDataEnv appDataEnv = shell.expandEnvironmentStrings("%APPDATA%") Dim roamingDir roamingDir = appDataEnv + "\Flying Pig Systems" If ( fso.FolderExists(roamingDir) ) Then fso.MoveFolder roamingDir, appDataEnv + "\High End Systems" fso.MoveFolder appDataEnv + "\High End Systems\Hog 4PC", appDataEnv + "\High End Systems\Hog 4 PC" End If End Function --- snip --- Wine source: https://source.winehq.org/git/wine.git/blob/f03933fbb73152c7a54383fba411a61… --- snip --- 3616 static HRESULT WINAPI filesys_MoveFolder(IFileSystem3 *iface,BSTR Source, 3617 BSTR Destination) 3618 { 3619 FIXME("%p %s %s\n", iface, debugstr_w(Source), debugstr_w(Destination)); 3620 3621 return E_NOTIMPL; 3622 } --- snip --- Stable download link via Internet Archive: https://web.archive.org/web/20211128125004/https://cdn.etcconnect.com/Hog_4… $ sha1sum Hog_4_PC_3.17.0.3327.msi.zip f98421bbbb0590df0e65ac18903471dd5fb61b6a Hog_4_PC_3.17.0.3327.msi.zip $ du -sh Hog_4_PC_3.17.0.3327.msi.zip 361M Hog_4_PC_3.17.0.3327.msi.zip $ sha1sum Hog_4_PC_3.17.0.3327.msi 0d22bf13c5a9bb682820ee6f690a866c1b320d9b Hog_4_PC_3.17.0.3327.msi $ wine --version wine-6.22-204-gf03933fbb73 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 8

[Bug 52251] New: Airport tycoon crashes
by WineHQ Bugzilla 14 Nov '25

14 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=52251 Bug ID: 52251 Summary: Airport tycoon crashes Product: Wine Version: 7.0-rc2 Hardware: x86-64 URL: https://www.fileplanet.com/archive/p-30575/Airline-Tyc oon-Demo/download OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: jeremielapuree(a)yahoo.fr Distribution: Ubuntu Created attachment 71372 --> https://bugs.winehq.org/attachment.cgi?id=71372 console output Airport tycoon crashes when loading. The welcome picture appears but game crashes early. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 4

[Bug 48109] New: Lynx web browser shows console window that gradually gets smaller and then quits
by WineHQ Bugzilla 14 Nov '25

14 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=48109 Bug ID: 48109 Summary: Lynx web browser shows console window that gradually gets smaller and then quits Product: Wine Version: 4.20 Hardware: x86-64 URL: ftp://ftp.invisible-island.net/lynx/lynx2.8.9rel.1-set up.exe OS: Mac OS X Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: tobbi.bugs(a)googlemail.com Created attachment 65693 --> https://bugs.winehq.org/attachment.cgi?id=65693 screencast $ wine --version wine-4.20 $ openssl sha256 lynx2.8.9rel.1-setup.exe SHA256(lynx2.8.9rel.1-setup.exe)= 89673bb3b5a8c85dbcd9ada860d5cedeae760ea9c302884b9e6108b5b59722a5 When I try to start the lynx web browser it just shows a console window that gradually gets smaller, then the app quits. Shown in the attached screencast. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 4

[Bug 51630] New: "Enemy Territory: Quake Wars SDK 1.5 (EditWorld)" When typing in dialog forms (values, file names, etc.) program crashes
by WineHQ Bugzilla 14 Nov '25

14 Nov '25

https://bugs.winehq.org/show_bug.cgi?id=51630 Bug ID: 51630 Summary: "Enemy Territory: Quake Wars SDK 1.5 (EditWorld)" When typing in dialog forms (values, file names, etc.) program crashes Product: Wine Version: 6.15 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: shell32 Assignee: wine-bugs(a)winehq.org Reporter: tx3nl5aq(a)protonmail.com Distribution: Slackware Created attachment 70486 --> https://bugs.winehq.org/attachment.cgi?id=70486 console output with WINEDEBUG=+seh,+tid,+loaddll DESCRIPTION: ------------- When typing in dialog forms (values, file names, etc.) program crashes on first character. Pasting text in these forms works with "SHIFT+INS", but confirming it with "Enter" causes the program crash. REPRODUCTION: ------------- # set "Windows Version: Windows XP" with winecfg on new wineprefix WINEARCH=win32 WINEPREFIX=[WINEPREFIX] winecfg # install ETQW from disk WINEPREFIX=[WINEPREFIX] wine /mnt/dvd/setup.exe # upgrade game to 1.5 version from: # https://cdn.splashdamage.com/downloads/games/etqw/ETQW-client-1.0-1.5-updat… # cfdea517cca5c34eda3100d6097f372e30484118 ETQW-client-1.0-1.5-update.exe WINEPREFIX=[WINEPREFIX] wine ETQW-client-1.0-1.5-update.exe # install ETQW-SDK-1.5 from: # https://cdn.splashdamage.com/downloads/games/etqw/ETQW-SDK-1.5.exe # 6ef6913398aa37401165328b4886bf5b33bd33f7 ETQW-SDK-1.5.exe WINEPREFIX=[WINEPREFIX] wine ETQW-SDK-1.5.exe # launch sdklauncher.exe from "SDK 1.5" installation directory cd [WINEPREFIX]/[PATH]/SDK\ 1.5 WINEPREFIX=[WINEPREFIX] wine sdklauncher.exe # set the game path and choose the tool to launch: "editWorld" # click on "Property Editor" tab inside "Inspectors" window # type something in "Value" form # at this point the program crashes ATTACHMENTS: ------------ console output with WINEDEBUG=+seh,+tid,+loaddll: "console.txt" corresponding backtrace: "backtrace.txt" images of windows forms: "save.jpg", "value.jpg" -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 10

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

wine-bugs November 2022