https://bugs.winehq.org/show_bug.cgi?id=51928
Bug ID: 51928 Summary: Security cookie in read-only section causes crash on startup Product: Wine Version: unspecified Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: ntdll Assignee: wine-bugs@winehq.org Reporter: vrbuckle@synthtools.co.uk Distribution: ---
After some point, PE binaries are allowed to have the security cookie in a read-only section.
set_security_cookie does not handle this and segfaults trying to write to read-only memory.
Example binary: .NET Native compiler 2.2.x : https://www.nuget.org/api/v2/package/runtime.win10-x64.Microsoft.Net.Native.... this is a zip file, the faulting binary is at tools/x64/ilc/ilc.exe
https://bugs.winehq.org/show_bug.cgi?id=51928
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Version|unspecified |6.20 URL| |https://web.archive.org/web | |/20211026080416/https://glo | |balcdn.nuget.org/packages/r | |untime.win10-x64.microsoft. | |net.native.compiler.2.2.11- | |rel-30601-02.nupkg CC| |focht@gmx.net Status|UNCONFIRMED |NEW Ever confirmed|0 |1 Keywords| |dotnet, download Summary|Security cookie in |Multiple applications crash |read-only section causes |on startup due to security |crash on startup |cookie in read-only section | |(.NET Native compiler | |2.2.x)
--- Comment #1 from Anastasius Focht focht@gmx.net --- Hello folks,
confirming. Filling some fields and adding stable download link via Internet Archive:
https://web.archive.org/web/20211026080416/https://globalcdn.nuget.org/packa...
$ sha1sum runtime.win10-x64.microsoft.net.native.compiler.2.2.11-rel-30601-02.nupkg c7ee5a419159db11c57f7be26bad535c0883f7d4 runtime.win10-x64.microsoft.net.native.compiler.2.2.11-rel-30601-02.nupkg
$ du -sh runtime.win10-x64.microsoft.net.native.compiler.2.2.11-rel-30601-02.nupkg 42M runtime.win10-x64.microsoft.net.native.compiler.2.2.11-rel-30601-02.nupkg
--- snip --- $ WINEDEBUG=+seh,+module wine ./ilc.exe >>log.txt 2>&1
0114:trace:module:get_load_order looking for L"Z:\home\focht\Downloads\unpacked\tools\x64\ilc\ilc.exe" 0114:trace:module:get_load_order got main exe default n,b for L"Z:\home\focht\Downloads\unpacked\tools\x64\ilc\ilc.exe" 0114:trace:module:get_load_order looking for L"Z:\home\focht\Downloads\unpacked\tools\x64\ilc\ilc.exe" 0114:trace:module:get_load_order got main exe default n,b for L"Z:\home\focht\Downloads\unpacked\tools\x64\ilc\ilc.exe" 0114:trace:module:map_image_into_view mapping PE file L"\??\Z:\home\focht\Downloads\unpacked\tools\x64\ilc\ilc.exe" at 0x400000-0x19d7000 0114:trace:module:map_image_into_view mapping L"\??\Z:\home\focht\Downloads\unpacked\tools\x64\ilc\ilc.exe" section .rdata at 0x401000 off 600 size 9dd400 virt 9dd3cc flags 40800040 0114:trace:module:map_image_into_view clearing 0xdde400 - 0xddf000 0114:trace:module:map_image_into_view mapping L"\??\Z:\home\focht\Downloads\unpacked\tools\x64\ilc\ilc.exe" section .data at 0xddf000 off 9dda00 size 11fc00 virt 11fb88 flags c0000040 0114:trace:module:map_image_into_view clearing 0xefec00 - 0xeff000 0114:trace:module:map_image_into_view mapping L"\??\Z:\home\focht\Downloads\unpacked\tools\x64\ilc\ilc.exe" section .rsrc at 0xeff000 off afd600 size 3e00 virt 3c64 flags 40000040 0114:trace:module:map_image_into_view clearing 0xf02e00 - 0xf03000 0114:trace:module:map_image_into_view mapping L"\??\Z:\home\focht\Downloads\unpacked\tools\x64\ilc\ilc.exe" section .text at 0xf03000 off b01400 size 954a00 virt 95489f flags 60000020 0114:trace:module:map_image_into_view clearing 0x1857a00 - 0x1858000 0114:trace:module:map_image_into_view mapping L"\??\Z:\home\focht\Downloads\unpacked\tools\x64\ilc\ilc.exe" section .reloc at 0x1858000 off 1455e00 size 17e400 virt 17e3e0 flags 42000040 0114:trace:module:map_image_into_view clearing 0x19d6400 - 0x19d7000 0114:trace:module:map_image_into_view mapping PE file L"\??\C:\windows\system32\ntdll.dll" at 0x7bc00000-0x7bc7f000 ... 0114:trace:module:set_security_cookie initializing security cookie 0072826C 0114:trace:seh:dispatch_exception code=c0000005 flags=0 addr=7BC2A330 ip=7bc2a330 tid=0114 0114:trace:seh:dispatch_exception info[0]=00000001 0114:trace:seh:dispatch_exception info[1]=0072826c 0114:warn:seh:dispatch_exception EXCEPTION_ACCESS_VIOLATION exception (code=c0000005) raised 0114:trace:seh:dispatch_exception eax=28a68b82 ebx=0032fc60 ecx=0000001f edx=00000002 esi=0072826c edi=00400000 0114:trace:seh:dispatch_exception ebp=0032fc28 esp=0032fa70 cs=0023 ss=002b ds=002b es=002b fs=0063 gs=006b flags=00010202 0114:err:seh:NtRaiseException Unhandled exception code c0000005 flags 0 addr 0x7bc2a330 --- snip ---
$ wine --version wine-6.20-61-gababea0fd70
Regards
https://bugs.winehq.org/show_bug.cgi?id=51928
Felix Schwarz felix.schwarz@oss.schwarz.eu changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |felix.schwarz@oss.schwarz.e | |u
-
WineHQ Bugzilla