[Bug 51630] New: "Enemy Territory: Quake Wars SDK 1.5 (EditWorld)" When typing in dialog forms (values, file names, etc.) program crashes

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=51630

Bug ID: 51630
           Summary: "Enemy Territory: Quake Wars SDK 1.5 (EditWorld)" When
                    typing in dialog forms (values, file names, etc.)
                    program crashes
           Product: Wine
           Version: 6.15
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: shell32
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: Slackware

Created attachment 70486
  --> https://bugs.winehq.org/attachment.cgi?id=70486
console output with WINEDEBUG=+seh,+tid,+loaddll

DESCRIPTION:
-------------
When typing in dialog forms (values, file names, etc.) program crashes on first
character. Pasting text in these forms works with "SHIFT+INS", but confirming
it with "Enter" causes the program crash.

REPRODUCTION:
-------------
# set "Windows Version: Windows XP" with winecfg on new wineprefix
WINEARCH=win32 WINEPREFIX=[WINEPREFIX] winecfg

# install ETQW from disk
WINEPREFIX=[WINEPREFIX] wine /mnt/dvd/setup.exe

# upgrade game to 1.5 version from:
#
https://cdn.splashdamage.com/downloads/games/etqw/ETQW-client-1.0-1.5-update...
# cfdea517cca5c34eda3100d6097f372e30484118  ETQW-client-1.0-1.5-update.exe
WINEPREFIX=[WINEPREFIX] wine ETQW-client-1.0-1.5-update.exe

# install ETQW-SDK-1.5 from:
# https://cdn.splashdamage.com/downloads/games/etqw/ETQW-SDK-1.5.exe
# 6ef6913398aa37401165328b4886bf5b33bd33f7  ETQW-SDK-1.5.exe
WINEPREFIX=[WINEPREFIX] wine ETQW-SDK-1.5.exe

# launch sdklauncher.exe from "SDK 1.5" installation directory
cd [WINEPREFIX]/[PATH]/SDK\ 1.5
WINEPREFIX=[WINEPREFIX] wine sdklauncher.exe

# set the game path and choose the tool to launch: "editWorld"
# click on "Property Editor" tab inside "Inspectors" window
# type something in "Value" form
# at this point the program crashes

ATTACHMENTS:
------------
console output with WINEDEBUG=+seh,+tid,+loaddll: "console.txt"
corresponding backtrace: "backtrace.txt"
images of windows forms: "save.jpg", "value.jpg"

[Bug 51630] "Enemy Territory: Quake Wars SDK 1.5 (EditWorld)" When typing in dialog forms (values, file names, etc.) program crashes

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=51630

--- Comment #1 from [e-mail] ---
Created attachment 70487
  --> https://bugs.winehq.org/attachment.cgi?id=70487
corresponding backtrace

[Bug 51630] "Enemy Territory: Quake Wars SDK 1.5 (EditWorld)" When typing in dialog forms (values, file names, etc.) program crashes

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=51630

--- Comment #2 from [e-mail] ---
Created attachment 70488
  --> https://bugs.winehq.org/attachment.cgi?id=70488
image of windows form: "save.jpg"

[Bug 51630] "Enemy Territory: Quake Wars SDK 1.5 (EditWorld)" When typing in dialog forms (values, file names, etc.) program crashes

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=51630

--- Comment #3 from [e-mail] ---
Created attachment 70489
  --> https://bugs.winehq.org/attachment.cgi?id=70489
image of windows form: "value.jpg"

[Bug 51630] "Enemy Territory: Quake Wars SDK 1.5 (EditWorld)" When typing in dialog forms (values, file names, etc.) program crashes

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=51630

[e-mail] changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download

[Bug 51630] "Enemy Territory: Quake Wars SDK 1.5 (EditWorld)" When typing in dialog forms (values, file names, etc.) program crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=51630

Andrew Nguyen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #70487|0                           |1
        is obsolete|                            |

--- Comment #4 from Andrew Nguyen  ---
Created attachment 78595
  --> http://bugs.winehq.org/attachment.cgi?id=78595
Enemy Territory: Quake Wars crash backtrace

I was able to reproduce the crash with wine-10.8. The issue is in the
invocations of IEnumString::Next on the application-provided string list object
in Wine's shell32 internal enumerate_strings helper. Calling the Next method on
it always yields S_FALSE, but the method never initializes the output
pceltFetched parameter. Thus, the helper always assumes that there are more
string values to be enumerated, which eventually results in a crash.

[Bug 51630] "Enemy Territory: Quake Wars SDK 1.5 (EditWorld)" When typing in dialog forms (values, file names, etc.) program crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=51630

--- Comment #5 from Andrew Nguyen  ---
Created attachment 78596
  --> http://bugs.winehq.org/attachment.cgi?id=78596
Workaround for shell32 crash

The attached workaround avoids the crash by initially setting the output
variable "read" in the shell32 enumerate_strings helper to 0. This allows the
loop reading strings from IEnumStrings::Next to successfully bail out even if
the call to the Next method doesn't initialize the "read" variable.

I'll need to write some tests to check what native is supposed to do in the
face of various unexpected behaviors of the application-supplied string list
object.

[Bug 51630] "Enemy Territory: Quake Wars SDK 1.5 (EditWorld)" When typing in dialog forms (values, file names, etc.) program crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=51630

Andrew Nguyen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #6 from Andrew Nguyen  ---
Confirming the issue.