[Bug 24214] New: ole: Java SE JRE subinstaller (msi) dies due to OLE compound storage reader failure on some stream (the one after _StringPool stream)
http://bugs.winehq.org/show_bug.cgi?id=24214
Summary: ole: Java SE JRE subinstaller (msi) dies due to OLE compound storage reader failure on some stream (the one after _StringPool stream) Product: Wine Version: 1.1.21 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: ole AssignedTo: wine-bugs@winehq.org ReportedBy: focht@gmx.net
Hello,
when installing Java SE JRE one of the sub-installers crashes. Though it doesn't seem to affect overall installer result - the installer still reports "success" in the end.
--- snip --- ... 0009:Call KERNEL32.CreateProcessA(00000000,0032ed40 ""C:\windows\system32\msiexec.exe" /i "C:\users\focht\Application Data\Sun\Java\jdk1.6.0_21\jdk1.6.0_21.msi" WRAPPER=1",00000000,00000000,00000000,00000000,00000000,00000000,0032c4d0,0032c514) ret=00401184 .... 001d:trace:msi:ACTION_ProcessComponents Component L"sb160210" (L"14888323ADFE6D117AD8000B0D612001"), Keypath=L"C:\Program Files\Java\jdk1.6.0_21\javadb.msi", RefCount=1 Request=3 ... 001d:trace:msi:MSI_ProcessMessage (nil) (nil) (nil) 0 200 L"File: javadb.msi, Directory: INSTALLDIR, Size: 10566952" ... 001d:trace:msi:cabinet_copy_file extracting L"C:\Program Files\Java\jdk1.6.0_21\javadb.msi" 001d:Call KERNEL32.CreateFileW(00205320 L"C:\Program Files\Java\jdk1.6.0_21\javadb.msi",c0000000,00000000,00000000,00000002,00000080,00000000) ret=683a75f4 001d:Ret KERNEL32.CreateFileW() retval=00000054 ret=683a75f4 ... 001d:trace:msi:ACTION_CustomAction Handling custom action L"installjavadb" (62 L"SystemFolder" L"msiexec.exe /i "[INSTALLDIR]javadb.msi" /qn INSTALLDIR="[JAVADB_DIR]"") ... 001d:trace:msi:HANDLE_CustomType34 executing exe L"msiexec.exe /i "C:\Program Files\Java\jdk1.6.0_21\javadb.msi" /qn INSTALLDIR="C:\Program Files\Sun\JavaDB\"" with working directory L"C:\windows\system32\" ... 000d:Call msi.MsiInstallProductW(0013914e L"C:\Program Files\Java\jdk1.6.0_21\javadb.msi",00139270 L" INSTALLDIR="C:\Program Files\Sun\JavaDB\"") ret=6833da64 000d:trace:msi:MsiInstallProductW L"C:\Program Files\Java\jdk1.6.0_21\javadb.msi" L" INSTALLDIR="C:\Program Files\Sun\JavaDB\"" 000d:trace:msi:MSI_OpenPackageW L"C:\Program Files\Java\jdk1.6.0_21\javadb.msi" 0x33fc1c ... 000d:Call KERNEL32.CopyFileW(0013914e L"C:\Program Files\Java\jdk1.6.0_21\javadb.msi",0033f9b8 L"C:\users\focht\Temp\msi58c.tmp",00000000) ret=683b95ab ... 000d:trace:msi:MSI_OpenPackageW Opening relocated package L"C:\users\focht\Temp\msi58c.tmp" 000d:trace:msi:MSI_OpenDatabaseW L"C:\users\focht\Temp\msi58c.tmp" #0002 000d:Call ole32.StgOpenStorage(0033f9b8 L"C:\users\focht\Temp\msi58c.tmp",00000000,00000012,00000000,00000000,0033f11c) ret=683880da 000d:Call KERNEL32.CreateFileW(0033f9b8 L"C:\users\focht\Temp\msi58c.tmp",c0000000,00000000,00000000,00000003,10000080,00000000) ret=684f87b9 000d:Ret KERNEL32.CreateFileW() retval=00000040 ret=684f87b9 000d:Call KERNEL32.GetFileSize(00000040,00000000) ret=684f87dd 000d:Ret KERNEL32.GetFileSize() retval=00a13d28 ret=684f87dd ... 000d:trace:msidb:enum_stream_names stream 0 -> L"\4840\430f\422f" L"\4840File" ... 000d:trace:msidb:enum_stream_names stream 41 -> L"\0005SummaryInformation" L"\0005SummaryInformation" ... 000d:trace:msidb:read_stream_data L"_StringPool" -> L"\4840\3f3f\4577\446c\3e6a\44b2\482f" ... 000d:warn:msidb:read_stream_data read stream failed r = 8003001e! ... 000d:trace:seh:raise_exception code=c0000005 flags=0 addr=0x683d2c6b ip=683d2c6b tid=000d 000d:trace:seh:raise_exception info[0]=00000000 000d:trace:seh:raise_exception info[1]=00000000 000d:trace:seh:raise_exception eax=00000000 ebx=68400df8 ecx=00000000 edx=00000000 esi=001408dc edi=00000000 000d:trace:seh:raise_exception ebp=0033edf8 esp=0033ede0 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010202 000d:trace:seh:call_vectored_handlers calling handler at 0x68c622d0 code=c0000005 flags=0 000d:trace:seh:call_vectored_handlers handler at 0x68c622d0 returned 0 000d:trace:seh:call_stack_handlers calling handler at 0x7bc856a0 code=c0000005 flags=0 000d:Call KERNEL32.UnhandledExceptionFilter(0033e92c) ret=7bc856ed Wine: Unhandled page fault on read access to 0x00000000 at address 0x683d2c6b (thread 000d), starting debugger... 000d:trace:seh:start_debugger Starting debugger "winedbg --auto 11 68" ... ---- snip ---
Using "orca" on the extracted .msi produces the same crash.
The useful "MsiInfo" tool from Platform SDK to verify the integrity of the .msi files (and dump infos) crashes too if used with no options. Backtrace doesn't reveal much. The fault caused in msi_destroy_stringtable() is the result of an earlier failure to read in all OLE streams properly.
When the "verify string pool" option is used, it doesn't crash but shows the STG_E_READFAULT (0x8003001e) error.
--- snip --- $ wine msiinfo.exe crash.msi /D MsiInfo V 4.0 Copyright (c) Microsoft Corporation. All Rights Reserved
String ID size: 2 Code page: 0 Error 0x8003001E. Error Reading Stream err:ole:CoUninitialize Mismatched CoUninitialize --- snip ---
--- snip --- ls -l crash.msi -rw-rw-r--. 1 focht focht 10566952 2010-08-30 21:52 crash.msi --- snip ---
From my investigation it's the stream directly after "_StringPool" stream that
is somehow not processed properly. Wine's OLE streams reader makes a stream access at file offset 10566656 with byte count 512 -> past end of file.
You can use another OLE compound storage viewer to verify: http://www.mitec.cz/ssv.html It's a nice tool with plugin arch that lets you decode any OLE stream - if you write plugins for it ;-)
If you open the .msi with the viewer it reports "sharing violation" which is another Wine bug. Dismiss the dialog and navigate the treeview with all streams listed.
Between stream #22 with 90701 Bytes (-> _StringPool stream) and #24 with 3984 bytes the 0x8003001e error appears. The "faulty" stream #23 has a size of 16168 bytes.
Don't know if this worked in earlier Wine versions, could be a regression though.
Regards
http://bugs.winehq.org/show_bug.cgi?id=24214
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, Installer URL| |http://java.sun.com/javase/ | |downloads/widget/jdk6.jsp Version|1.1.21 |1.3.1
--- Comment #1 from Anastasius Focht focht@gmx.net 2010-08-30 16:14:00 CDT --- Hello,
filling and correcting some fields.
--- snip --- $ ls -l jdk-6u21-windows-i586.exe -rw-rw-r--. 1 focht focht 79595288 2010-08-30 20:38 jdk-6u21-windows-i586.exe
$ sha1sum jdk-6u21-windows-i586.exe 02ae1e00b196b6c3055e6d3c8eab45cc7d75772b jdk-6u21-windows-i586.exe --- snip ---
Regards
http://bugs.winehq.org/show_bug.cgi?id=24214
--- Comment #2 from Vincent Povirk madewokherd@gmail.com 2010-08-30 16:26:33 CDT --- If you're using Wine from Git, please try with the 1.3.1 release.
Do I have to do anything special to get the javadb.msi file?
http://bugs.winehq.org/show_bug.cgi?id=24214
Vincent Povirk madewokherd@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Component|ole |ole32
http://bugs.winehq.org/show_bug.cgi?id=24214
--- Comment #3 from Anastasius Focht focht@gmx.net 2010-08-30 16:44:55 CDT --- Hello,
--- quote --- If you're using Wine from Git, please try with the 1.3.1 release. --- quote ---
No, 1.3.1 and today GIT show same problem (crash).
--- quote --- Do I have to do anything special to get the javadb.msi file? --- quote ---
Start the installer. Deselect all features except "Public JRE" (to save time). "Next" -> installer starts. Another dialog pops up after some processing. "Next" -> sub installer starts. Crash happens -> Wine crash handler is invoked, displaying "Program Error". Don't dismiss the message box yet. Go to the install WINEPREFIX, "c:\users\yourusername\Temp". Locate a single msixxxx.tmp with size 10566952 bytes. Save that file outside of temp folder to play with.
Regards
http://bugs.winehq.org/show_bug.cgi?id=24214
--- Comment #4 from Vincent Povirk madewokherd@gmail.com 2011-04-25 17:40:58 CDT --- I just tried this in wine-1.3.18-200-gd16bed1, and I didn't get a crash in the sub installer.
http://bugs.winehq.org/show_bug.cgi?id=24214
Vincent Povirk madewokherd@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |madewokherd@gmail.com
http://bugs.winehq.org/show_bug.cgi?id=24214
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED
--- Comment #5 from Anastasius Focht focht@gmx.net 2011-04-26 04:20:16 CDT --- Hello Vincent,
--- quote --- I just tried this in wine-1.3.18-200-gd16bed1, and I didn't get a crash in the sub installer. --- quote ---
well it was fixed by yourself ;-)
http://source.winehq.org/git/wine.git/commit/2752c3bcd07806a84894eaad5b2c229...
(ole32: Don't fail if the file ends during a big block.)
Part of Wine 1.3.3 release.
Thanks.
Regards
http://bugs.winehq.org/show_bug.cgi?id=24214
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #6 from Alexandre Julliard julliard@winehq.org 2011-04-29 13:15:45 CDT --- Closing bugs fixed in 1.3.19.
http://bugs.winehq.org/show_bug.cgi?id=24214
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |2752c3bcd07806a84894eaad5b2 | |c2299d139b1e8
--- Comment #7 from Anastasius Focht focht@gmx.net 2011-10-11 15:03:57 CDT --- Hello,
filling/correcting fields ...
Regards
https://bugs.winehq.org/show_bug.cgi?id=24214
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- URL|http://java.sun.com/javase/ |https://web.archive.org/web |downloads/widget/jdk6.jsp |/20210712085527/https://dow | |nload.oracle.com/otn/java/j | |dk/6u21-b07/jdk-6u21-window | |s-i586.exe?AuthParam=162608 | |0233_3af4125da1d1835d6a14a5 | |8c31e16cfa
-
wine-bugs＠winehq.org -
WineHQ Bugzilla