[Bug 55152] New: Crash in Notepad++ processing a WM_DRAWITEM message

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=55152

Bug ID: 55152
           Summary: Crash in Notepad++ processing a WM_DRAWITEM message
           Product: Wine
           Version: 8.11
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: win32u
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Running the 32-bit Notepad++ 8.5.4 in new wow64 mode crashes on startup when
processing a WM_DRAWITEM message. The exception is swallowed by win32u so it
still works, but we get a message:

0024:err:seh:KiUserCallbackDispatcher ignoring exception

The root cause is that because Notepad++ added a WH_CALLWNDPROC hook, in win32u
process_message(), instead of returning to SendMessageW and have it call the
winproc, we call it ourselves through KeUserModeCallback. But at that point the
message has been converted to 64-bit so we pass a (truncated) 64-bit lparam to
the 32-bit winproc.

The crash was revealed by a82238fad52761114ab2488d422fad3f70dbb854, which moves
the 64-bit stack to high memory. Previously the lparam pointer would fit in
32-bit which avoided the crash, but it would still point to a 64-bit
DRAWITEMSTRUCT.

[Bug 55152] Crash in Notepad++ processing a WM_DRAWITEM message

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=55152

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
                URL|                            |https://github.com/notepad-
                   |                            |plus-plus/notepad-plus-plus
                   |                            |/releases/download/v8.5.4/n
                   |                            |pp.8.5.4.portable.zip

[Bug 55152] Crash in Notepad++ processing a WM_DRAWITEM message

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=55152

Fabian Maurer  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 55152] Crash in Notepad++ processing a WM_DRAWITEM message

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=55152

Jacek Caban  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED
      Fixed by SHA1|                            |0be20785312676065afd462852d
                   |                            |2411b1891a73b

--- Comment #1 from Jacek Caban  ---
Fixed in git, more details in
https://gitlab.winehq.org/wine/wine/-/merge_requests/3388. Thanks for the
report.

[Bug 55152] Crash in Notepad++ processing a WM_DRAWITEM message

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=55152

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #2 from Alexandre Julliard  ---
Closing bugs fixed in 8.14.