[Bug 6775] Sony CD Architect 5.2 crashes on startup (msxml domdoc_createTextNode should access/treat input BSTR data as wide-character string)

http://bugs.winehq.org/show_bug.cgi?id=6775

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
          Component|-unknown                    |msxml3
            Summary|blank menus in cdarchitect  |Sony CD Architect 5.2
                   |5.2                         |crashes on startup (msxml
                   |                            |domdoc_createTextNode
                   |                            |should access/treat input
                   |                            |BSTR data as wide-character
                   |                            |string)
     Ever Confirmed|0                           |1

--- Comment #13 from Anastasius Focht  2012-05-01 16:17:56 CDT ---
Hello,

confirming the crash on startup.
If you use 'winetricks msxml3' the application works fine, explanation follows.

Prerequisite: 'winetricks -q mfc42'

--- snip ---
Unhandled exception: page fault on read access to 0x008da000 in 32-bit code
(0xf7597533).
Register dump:
 CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b
 EIP:f7597533 ESP:028bd2c8 EBP:028bd2f8 EFLAGS:00010202(  R- --  I   - - - )
 EAX:008d9ffc EBX:f75fcff4 ECX:0044c6b9 EDX:028c8c40
 ESI:028bd630 EDI:00000000
...
Backtrace:
=>0 0xf7597533 __memcpy_ssse3_rep+0xd63() in libc.so.6 (0x028bd2f8)
  1 0x7e6a545a SysAllocStringByteLen+0x6f(str="{", len=0x455355)
[/home/focht/projects/wine/wine-git/dlls/oleaut32/oleaut.c:369] in oleaut32
(0x028bd2f8)
  2 0x7e6f1527 VariantCopy+0x290(pvargDest=0x28bd468, pvargSrc=0x28bd560)
[/home/focht/projects/wine/wine-git/dlls/oleaut32/variant.c:781] in oleaut32
(0x028bd368)
  3 0x7e6f19b4 VariantCopyInd+0x1b9(pvargDest=0x28bd468, pvargSrc=0x28bd560)
[/home/focht/projects/wine/wine-git/dlls/oleaut32/variant.c:871] in oleaut32
(0x028bd3f8)
  4 0x7e6f20a5 VariantChangeTypeEx+0x2d8(pvargDest=0x28bd510,
pvargSrc=0x28bd560, lcid=0x400, wFlags=0, vt=0x8)
[/home/focht/projects/wine/wine-git/dlls/oleaut32/variant.c:1041] in oleaut32
(0x028bd4b8)
  5 0x7e6f1dc2 VariantChangeType+0x49(pvargDest=0x28bd510, pvargSrc=0x28bd560,
wFlags=0, vt=0x8)
[/home/focht/projects/wine/wine-git/dlls/oleaut32/variant.c:982] in oleaut32
(0x028bd4f8)
  6 0x7d084216 node_put_value+0x41(This=0x1d1048, value=0x28bd560)
[/home/focht/projects/wine/wine-git/dlls/msxml3/node.c:289] in msxml3
(0x028bd538)
  7 0x7d09e2dd domtext_put_data+0x9c(iface=0x1d1064,
data="{CCAC7B28-CA5C-4520-ABBB-184524C01A51}")
[/home/focht/projects/wine/wine-git/dlls/msxml3/text.c:617] in msxml3
(0x028bd588)
  8 0x7d06961b domdoc_createTextNode+0x14e(iface=0x13fd3a4,
data="{CCAC7B28-CA5C-4520-ABBB-184524C01A51}", text=0x28bd610)
[/home/focht/projects/wine/wine-git/dlls/msxml3/domdoc.c:1614] in msxml3
(0x028bd5e8)
  9 0x35c8ac6c in sfconfigmgr (+0x2ac6b) (0x013fc200)
  10 0x00000001 (0x35c9e950)
  11 0x35c628a0 in sfconfigmgr (+0x289f) (0x35c62940)
  12 0x08244c8b (0x0c24448b)
0xf7597533 __memcpy_ssse3_rep+0xd63 in libc.so.6: repe movq    0x0(%eax),%mm0
--- snip ---

There is a GUID-like string passed to domdoc_createTextNode().

The string is created as _wide_ character string within the application(!)
Dump of string data:

$+0 = (start) address of string passed through API

--- snip ---
$-4       00455355  
$ ==>     0043007B  {C
$+4       00410043  CA
$+8       00370043  C7
$+C       00320042  B2
$+10      002D0038  8-
$+14      00410043  CA
$+18      00430035  5C
$+1C      0034002D  -4
$+20      00320035  52
$+24      002D0030  0-
$+28      00420041  AB
$+2C      00420042  BB
$+30      0031002D  -1
$+34      00340038  84
$+38      00320035  52
$+3C      00430034  4C
$+40      00310030  01
$+44      00350041  A5
$+48      007D0031  1}
$+4C      F7790000  
$+50      006F0053  So
$+54      0079006E  ny
--- snip ---

At $-4 you see the heap magic "USE".
This is a clear indication that this string is _not_ a BSTR.

MSXML interface defines the string type to be BSTR.
Wine code accesses it as such:

SysStringByteLen -> return str ? *((DWORD*)str-1) : 0;

You can imagine that 0x00455355 is not really suitable as length ;-)

The real bug is in the application code.
I debugged it and found no code path that actually makes use of BSTR allocation
API (SysAllocXXX) for this parameter.

Interestingly with native msxml3 override (winetricks) the application call to
msxml to create a text node succeeds.

An educated guess: for whatever reason the input string is not accessed as BSTR
but as wide-character string, which avoids relying on garbage length ($-4).

Source:
http://source.winehq.org/git/wine.git/blob/e983db851888b900873153ce42921aee8...

domdoc_createTextNode -> domtext_put_data ...

This problem might apply to more methods that carry BSTR parameters but I think
getting domdoc_createTextNode -> domtext_put_data to work with pure WCHAR* data
should be ok.
To not change much code down the call tree maybe a temporary "real" BSTR could
be created as soon as possible from input "wide character" string.

$ du -sh cdarchitect52d-trial_enu.exe 
30M    cdarchitect52d-trial_enu.exe

$ sha1sum cdarchitect52d-trial_enu.exe 
045cfb932746810b2bfb52594f31926be11ebb73  cdarchitect52d-trial_enu.exe

$ wine --version
wine-1.5.3-73-g93a0ca7

Regards