http://bugs.winehq.org/show_bug.cgi?id=17530
Summary: netapi32:access crashes if +heap enabled Product: Wine Version: 1.1.15 Platform: PC URL: http://test.winehq.org/data/b86552f58d96f3bf3b324a6ed115 a1c4a846174d/wine_ae-ub-904-heap/netapi32:access.html OS/Version: Linux Status: NEW Keywords: download, source, testcase Severity: enhancement Priority: P2 Component: -unknown AssignedTo: wine-bugs@winehq.org ReportedBy: austinenglish@gmail.com
There's a +relay,+seh,+tid attached to bug 17415. Should be easy to reproduce.
http://bugs.winehq.org/show_bug.cgi?id=17530
--- Comment #1 from Juan Lang juan_lang@yahoo.com 2009-02-25 11:37:25 --- (In reply to comment #0)
Should be easy to reproduce.
Not here: $ WINEDEBUG=warn+heap make access.ok warn:heap:HEAP_Decommit Could not decommit 003e0000 bytes at 0xbfc20000 for heap 0xbfc00000 warn:heap:HEAP_Decommit Could not decommit 003e0000 bytes at 0xbfc20000 for heap 0xbfc00000 (some netapi32 fixmes) warn:heap:HEAP_Decommit Could not decommit 003e0000 bytes at 0xbf820000 for heap 0xbf800000 warn:heap:HEAP_Decommit Could not decommit 003e0000 bytes at 0xbf820000 for heap 0xbf800000
That is, no error. Also tried WINEDEBUG=+heap make access.ok and it didn't fail either.
http://bugs.winehq.org/show_bug.cgi?id=17530
--- Comment #2 from Austin English austinenglish@gmail.com 2009-02-25 14:36:32 --- (In reply to comment #1)
(In reply to comment #0)
Should be easy to reproduce.
Not here: $ WINEDEBUG=warn+heap make access.ok warn:heap:HEAP_Decommit Could not decommit 003e0000 bytes at 0xbfc20000 for heap 0xbfc00000 warn:heap:HEAP_Decommit Could not decommit 003e0000 bytes at 0xbfc20000 for heap 0xbfc00000 (some netapi32 fixmes) warn:heap:HEAP_Decommit Could not decommit 003e0000 bytes at 0xbf820000 for heap 0xbf800000 warn:heap:HEAP_Decommit Could not decommit 003e0000 bytes at 0xbf820000 for heap 0xbf800000
That is, no error. Also tried WINEDEBUG=+heap make access.ok and it didn't fail either.
Hmm, strange. That passes here as well. The crosstest always fails. And running:
austin@midna:~/wine-git/dlls/netapi32/tests$ rm access.ok ; rm -rf ~/.wine ; WINEDEBUG=+heap wine netapi32_test.exe.so access &> /dev/null && echo good || echo fail
Fails consistently. Can you try that?
http://bugs.winehq.org/show_bug.cgi?id=17530
--- Comment #3 from Juan Lang juan_lang@yahoo.com 2009-02-25 15:02:12 --- (In reply to comment #2)
austin@midna:~/wine-git/dlls/netapi32/tests$ rm access.ok ; rm -rf ~/.wine ; WINEDEBUG=+heap wine netapi32_test.exe.so access &> /dev/null && echo good || echo fail
Fails consistently. Can you try that?
That fails for me too. I removed the redirect to see what's going on, and this pops up in the output: wineserver: could not save registry branch to system.reg : No such file or directory wineserver: could not save registry branch to userdef.reg : No such file or directory wineserver: could not save registry branch to user.reg : No such file or directory
Those seem like the issue, not the failing test. For reference, here's the command line I used: $ rm access.ok ; rm -rf ~/.wine ; WINEDEBUG=warn+heap wine netapi32_test.exe.so access
It looks to me, at first glance, like a race condition in the creation of the ~/.wine directory.
http://bugs.winehq.org/show_bug.cgi?id=17530
--- Comment #4 from Austin English austinenglish@gmail.com 2009-02-25 15:07:41 --- (In reply to comment #3)
(In reply to comment #2)
austin@midna:~/wine-git/dlls/netapi32/tests$ rm access.ok ; rm -rf ~/.wine ; WINEDEBUG=+heap wine netapi32_test.exe.so access &> /dev/null && echo good || echo fail
Fails consistently. Can you try that?
That fails for me too. I removed the redirect to see what's going on, and this pops up in the output: wineserver: could not save registry branch to system.reg : No such file or directory wineserver: could not save registry branch to userdef.reg : No such file or directory wineserver: could not save registry branch to user.reg : No such file or directory
Those seem like the issue, not the failing test. For reference, here's the command line I used: $ rm access.ok ; rm -rf ~/.wine ; WINEDEBUG=warn+heap wine netapi32_test.exe.so access
It looks to me, at first glance, like a race condition in the creation of the ~/.wine directory.
Well, that wouldn't matter if running from winetest, because ~/.wine would have been created long before that.
I tried: rm access.ok ; rm -rf ~/.wine ; wineboot && WINEDEBUG=+heap wine netapi32_test.exe.so access
To be sure (I thought +heap would've had a lot more output, hence my redirect...): fixme:netapi32:NetUserGetInfo Only implemented for local computer, but remote serverL"\\Ba path" was requested. access.c:158: Test failed: Bad Network Path: rc=2351
Relevant code: todo_wine { /* FIXME - Currently Wine can't verify whether the network path is good or bad */ rc=pNetUserGetInfo(sBadNetPath, sTestUserName, 0, (LPBYTE *)&ui0); ok(rc == ERROR_BAD_NETPATH || rc == ERROR_NETWORK_UNREACHABLE, "Bad Network Path: rc=%d\n",rc); }
It's marked todo_wine, so why is it failing...is the +heap screwing the todo_wine up somehow?
http://bugs.winehq.org/show_bug.cgi?id=17530
--- Comment #5 from Austin English austinenglish@gmail.com 2009-02-25 15:08:12 --- Created an attachment (id=19657) --> (http://bugs.winehq.org/attachment.cgi?id=19657) +heap output
Here's the output
http://bugs.winehq.org/show_bug.cgi?id=17530
mrnobo1024@yahoo.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mrnobo1024@yahoo.com
--- Comment #6 from mrnobo1024@yahoo.com 2009-07-28 09:50:28 --- netapi32 has a heap buffer overflow in the NETAPI_IsCurrentUser function, could this be the cause?
curr_user = HeapAlloc(GetProcessHeap(), 0, dwSize); // should be dwSize * sizeof(WCHAR) ... if(!GetUserNameW(curr_user, &dwSize))
http://bugs.winehq.org/show_bug.cgi?id=17530
--- Comment #7 from Nikolay Sivov bunglehead@gmail.com 2009-07-29 08:19:36 --- (In reply to comment #6)
netapi32 has a heap buffer overflow in the NETAPI_IsCurrentUser function, could this be the cause?
This should be fixed anyway, attach a patch here please.
http://bugs.winehq.org/show_bug.cgi?id=17530
--- Comment #8 from mrnobo1024@yahoo.com 2009-07-29 21:33:23 --- Created an attachment (id=22695) --> (http://bugs.winehq.org/attachment.cgi?id=22695) Multiply username buffer sizes by sizeof(WCHAR) when allocating.
Okay. There are two other instances of the same bug; I'll include those in the patch too.
http://bugs.winehq.org/show_bug.cgi?id=17530
--- Comment #9 from Juan Lang juan_lang@yahoo.com 2009-10-09 12:48:49 --- Please send patch to wine-patches@winehq.org (with your real name too, please.)
http://bugs.winehq.org/show_bug.cgi?id=17530
Juan Lang juan_lang@yahoo.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED
--- Comment #10 from Juan Lang juan_lang@yahoo.com 2009-10-14 13:21:02 --- Fixed by commit d5f2172c093e0b4cef04fd3d99639c0b7300907c.
http://bugs.winehq.org/show_bug.cgi?id=17530
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #11 from Alexandre Julliard julliard@winehq.org 2009-10-23 13:18:52 --- Closing bugs fixed in 1.1.32.