New subject: [Bug 55960] user32: 512 is not enough for LB_ADDSTRING (crash)

29 Nov 2023


      https://bugs.winehq.org/show_bug.cgi?id=55960
Bug ID: 55960
           Summary: user32: 512 is not enough for LB_ADDSTRING
           Product: Wine
           Version: 8.21
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: user32
          Assignee: wine-bugs@winehq.org
          Reporter: galtgendo@o2.pl
      Distribution: ---
So, as noted in bug 54034, while dealing with some out-of-memory crashes, I ran
into an odd one, one that could be triggered even shortly after reload and
acting more like a buffer overflow bug.
Namely, if a certain string that was about to be displayed on the screen was
above 530 chars (but it had newline embedded), the game crashed, but didn't if
the string was manually truncated.
It left me grasping at straws, as my (quite lacking) gdb skills didn't lets me
see where the crash occurred.
So, I was left waiting for some burst of inspiration.
It came today.
For some reason, this felt like I had been hitting some internal limit. I
suspected wine code.
After trying a few debug channel combinations, I eventually tested 'msg'.
The strings were printed using ID3DXFontImpl_DrawTextA.
In the log, I've noted LB_ADDSTRING and - after looking at that code - took a
stab in the dark.
I've set the buffer  size for that message in both WINPROC_CallProcAtoW and
WINPROC_CallProcWtoA to 1536 (yes, likely excessively large). Making this
change has fixed the crash.
I'm marking it wine 8.21, but I expect this has been around as long as wine has
been using too small buffer.
-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 55960] New: user32: 512 is not enough for LB_ADDSTRING