[Bug 40425] PsList from Sysinternals crashes when trying to retrieve performance counter data

https://bugs.winehq.org/show_bug.cgi?id=40425

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download
            Summary|Page fault in PsList from   |PsList from Sysinternals
                   |sysinternals                |crashes when trying to
                   |                            |retrieve performance
                   |                            |counter data
                 CC|                            |[e-mail]
                URL|                            |https://docs.microsoft.com/
                   |                            |en-us/sysinternals/download
                   |                            |s/pslist
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
          Component|-unknown                    |advapi32

--- Comment #5 from Anastasius Focht  ---
Hello folks,

confirming, still present. Also adding download link.

--- snip ---
$ WINEDEBUG=+seh,+relay,+reg wine ./pslist.exe >>log.txt 2>&1
...
002f:Call advapi32.RegOpenKeyExA(80000002,0041f7e8
"software\microsoft\windows
nt\currentversion\perflib",00000000,00020019,0033f418) ret=00402aae
002f:trace:reg:open_key (0x28,L"software\microsoft\windows
nt\currentversion\perflib",20019,0x33f418)
002f:trace:reg:open_key <- 0x54
002f:Ret  advapi32.RegOpenKeyExA() retval=00000000 ret=00402aae
002f:Call advapi32.RegQueryValueExA(00000054,0041f7c0 "Last
Counter",00000000,00000000,0033f520,0033f408) ret=00402acb
002f:trace:reg:RegQueryValueExA (0x54,"Last
Counter",(nil),(nil),0x33f520,0x33f408=4)
002f:trace:reg:NtQueryValueKey (0x54,L"Last Counter",2,0x33f240,256)
002f:Ret  advapi32.RegQueryValueExA() retval=00000000 ret=00402acb
002f:Call advapi32.RegCloseKey(00000054) ret=00402ae9
002f:Ret  advapi32.RegCloseKey() retval=00000000 ret=00402ae9
002f:Call advapi32.RegQueryValueExA(80000004,0041f7b4 "Counter
009",00000000,00000000,00000000,0033f40c) ret=00402afb
002f:trace:reg:RegQueryValueExA (0x80000004,"Counter
009",(nil),(nil),(nil),0x33f40c=525469)
002f:Ret  advapi32.RegQueryValueExA() retval=000000ea ret=00402afb
002f:Call KERNEL32.IsBadStringPtrA(0041ff4c,ffffffff) ret=00405af4
002f:Ret  KERNEL32.IsBadStringPtrA() retval=00000000 ret=00405af4
002f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=0040659e
002f:Ret  ntdll.RtlAllocateHeap() retval=00157e10 ret=0040659e
002f:Call KERNEL32.GetLastError() ret=0040a9ec
002f:Ret  KERNEL32.GetLastError() retval=00000000 ret=0040a9ec
002f:Call KERNEL32.GetLastError() ret=0040a9ec
002f:Ret  KERNEL32.GetLastError() retval=00000000 ret=0040a9ec
002f:Call KERNEL32.IsBadStringPtrA(00157e10,ffffffff) ret=00402c03
002f:Ret  KERNEL32.IsBadStringPtrA() retval=00000000 ret=00402c03
002f:trace:seh:raise_exception code=c0000005 flags=0 addr=0x402c23 ip=00402c23
tid=002f
002f:trace:seh:raise_exception  info[0]=00000000
002f:trace:seh:raise_exception  info[1]=00000004
002f:trace:seh:raise_exception  eax=00000000 ebx=00157e10 ecx=0033f520
edx=00157e1a esi=00000001 edi=0033f520
002f:trace:seh:raise_exception  ebp=0033f2c4 esp=0033f2b8 cs=0023 ds=002b
es=002b fs=0063 gs=006b flags=00010206
002f:trace:seh:call_stack_handlers calling handler at 0x418a21 code=c0000005
flags=0 
...
--- snip ---

Source:
https://source.winehq.org/git/wine.git/blob/6500f882dad29eb417107d2f73589b31...

--- snip ---
1625 static DWORD query_perf_data(const WCHAR *query, DWORD *type, void *data,
DWORD *ret_size)
1626 {
1627     static const WCHAR SZ_SERVICES_KEY[] = { 'S','y','s','t','e','m','\',
1628        
'C','u','r','r','e','n','t','C','o','n','t','r','o','l','S','e','t','\',
1629         'S','e','r','v','i','c','e','s',0 };
1630     DWORD err, i, data_size;
1631     HKEY root;
1632     PERF_DATA_BLOCK *pdb;
1633 
1634     if (!ret_size)
1635         return ERROR_INVALID_PARAMETER;
1636 
1637     data_size = *ret_size;
1638     *ret_size = 0;
1639 
1640     if (type)
1641         *type = REG_BINARY;
1642 
1643     if (!data || data_size < sizeof(*pdb))
1644         return ERROR_MORE_DATA;
--- snip ---

Microsoft Docs:
https://docs.microsoft.com/en-us/windows/desktop/api/winreg/nf-winreg-regque...

--- quote ---
If hKey specifies HKEY_PERFORMANCE_DATA and the lpData buffer is not large
enough to contain all of the returned data, RegQueryValueEx returns
ERROR_MORE_DATA and the value returned through the lpcbData parameter is
undefined. This is because the size of the performance data can change from one
call to the next. In this case, you must increase the buffer size and call
RegQueryValueEx again passing the updated buffer size in the lpcbData
parameter. Repeat this until the function succeeds. You need to maintain a
separate variable to keep track of the buffer size, because the value returned
by lpcbData is unpredictable.
--- quote ---

Returning 'ERROR_MORE_DATA' when the app just wants to query the buffer size is
not correct. Another example from Microsoft Docs, showing this:

https://docs.microsoft.com/en-us/windows/desktop/PerfCtrs/retrieving-counter...

--- snip ---
...
    // Query the size of the text data so you can allocate the buffer.
    status = RegQueryValueEx(HKEY_PERFORMANCE_DATA, wszSourceAndLangId, NULL,
NULL, NULL, &dwBufferSize);
    if (ERROR_SUCCESS != status)
    {
        wprintf(L"RegQueryValueEx failed getting required buffer size. Error is
0x%x.\n", status);
        goto cleanup;
    }
...
--- snip ---

$ sha1sum PSTools.zip 
1e562ff2bae38856f8dcf3f939cdbe8e1bf6ccf3  PSTools.zip

$ du -sh PSTools.zip 
2.8M    PSTools.zip

$ wine --version
wine-3.12-110-g414fe80aeb

Regards