https://bugs.winehq.org/show_bug.cgi?id=55000
Bug ID: 55000 Summary: wineserver crashes below save_all_subkeys after RegUnLoadKey Product: Wine Version: 8.9 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: wineserver Assignee: wine-bugs@winehq.org Reporter: bernhardu@mailbox.org Distribution: ---
While trying to reproduce a crash in procexp64 I noticed a crash in wineserver instead.
I think I found the reason in a call to `RegUnLoadKey(HKEY_USERS, ".Default")`, which succeeds in wine while it should maybe not.
Program terminated with signal SIGSEGV, Segmentation fault. 208 struct object *parent = key->obj.name->parent; (gdb) bt #0 get_parent () at server/registry.c:208 #1 dump_path () at server/registry.c:226 #2 save_all_subkeys () at server/registry.c:2008 #3 save_branch (path="userdef.reg") at server/registry.c:2107 #4 save_branch () at server/registry.c:2134 #5 periodic_save () at server/registry.c:2131 #6 periodic_save () at server/registry.c:2124 #7 get_next_timeout () at server/fd.c:959 #8 main_loop_epoll () at server/fd.c:617 #9 main_loop () at server/fd.c:992 #10 main () at server/main.c:237 (gdb) print key->obj.name $3 = (struct object_name *) 0x0
The "name" member got set to NULL here before in wineserver: 424 obj->name = NULL; (rr) bt #0 unlink_named_object () at server/object.c:424 #1 delete_key () at server/registry.c:1089 #2 req_unload_registry () at server/registry.c:2363 #3 call_req_handler () at server/request.c:305 #4 read_request () at server/request.c:360
With the request originating at process side here:
#14 wine_server_call () at dlls/ntdll/unix/server.c:307 #15 NtUnloadKey () at dlls/ntdll/unix/registry.c:767 #16 __wine_syscall_dispatcher ()
https://bugs.winehq.org/show_bug.cgi?id=55000
--- Comment #1 from Bernhard Übelacker bernhardu@mailbox.org --- Created attachment 74555 --> https://bugs.winehq.org/attachment.cgi?id=74555 advapi32/tests: Minimal testcase for wineserver crash in RegUnLoadKey.
This minimal reproducer should help to reproduce the issue.
If one wants to reproduce with procexp64.exe, it was version 16.22 from SysinternalsSuite.zip as of 2018-12-18. 9437013309a88b6cf857e9bcd37a237e procexp64.exe c8e2413db5306c64309456c368848962 ../SysinternalsSuite_2018-12-18.zip
https://bugs.winehq.org/show_bug.cgi?id=55000
Fabian Maurer dark.shadow4@web.de changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |dark.shadow4@web.de
https://bugs.winehq.org/show_bug.cgi?id=55000
--- Comment #2 from Bernhard Übelacker bernhardu@mailbox.org --- Still visible with wine-8.21.
https://bugs.winehq.org/show_bug.cgi?id=55000
Fabian Maurer dark.shadow4@web.de changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, testcase Ever confirmed|0 |1 Status|UNCONFIRMED |NEW
--- Comment #3 from Fabian Maurer dark.shadow4@web.de --- Confirming.
https://bugs.winehq.org/show_bug.cgi?id=55000
Bernhard Übelacker bernhardu@mailbox.org changed:
What |Removed |Added ---------------------------------------------------------------------------- URL| |https://web.archive.org/web | |/20190502025058if_/http://d | |ownload.sysinternals.com/fi | |les/ProcessExplorer.zip Distribution|--- |Debian
https://bugs.winehq.org/show_bug.cgi?id=55000
--- Comment #4 from Bernhard Übelacker bernhardu@mailbox.org --- Submitted merge request: https://gitlab.winehq.org/wine/wine/-/merge_requests/4895
https://bugs.winehq.org/show_bug.cgi?id=55000
Bernhard Übelacker bernhardu@mailbox.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |26e383c8df94d76c849dc6e6199 | |8fd043c2dacdc Resolution|--- |FIXED Status|NEW |RESOLVED
--- Comment #5 from Bernhard Übelacker bernhardu@mailbox.org --- Resolving fixed.
https://bugs.winehq.org/show_bug.cgi?id=55000
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #6 from Alexandre Julliard julliard@winehq.org --- Closing bugs fixed in 9.1.
https://bugs.winehq.org/show_bug.cgi?id=55000
Michael Stefaniuc mstefani@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |9.0.x