[Bug 32185] New: Bug in BasePinImp_GetMediaType()

http://bugs.winehq.org/show_bug.cgi?id=32185

Bug #: 32185
           Summary: Bug in BasePinImp_GetMediaType()
           Product: Wine
           Version: 1.5.17
          Platform: x86
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: amstream
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]
    Classification: Unclassified

A bisect shows that the patch below causes a regression in the amstream
conformance tests. See for instance the Winetest results for fg-deb64-t32.

http://test.winehq.org/data/3e264ced0f2502093940ddda21ecbd024b7dd815/linux_f...

commit 7e82db784a448c6802001345d6230f72a711d237
Author: Christian Costa 
Date:   Fri Oct 12 23:07:31 2012 +0200

amstream: Implement BasePinImp_GetMediaType in media stream filter.

:040000 040000 ca189e47205be4d08dd271ba14dc12f6d1c2fced
5fd0731b35d83671c7fb0ecfa622e7834344238b M    dlls

However it's also possible that the bug is in the previous patch as both
functions are used in the test and it's possible that implementing
BasePinImp_GetMediaType() caused BasePinImpl_CheckMediaType() to be called, or
that the bug is in fact in EnumMediaTypes_Construct() (from strmbase).

I tried to figure out the source for the bug but did not get anywhere. What I
gathered is that:
* It looks like a stack corruption issue. Adding traces in the test executable
can make the crash go away and I seem to have more luck reproducing the issue
using the PE test executable.
* A backtrace shows the crash happening in CopyMediaType() (called by
EnumMediaTypes_Construct() from strmbase) due to an insane size for
pSrc->cbFormat.

[Bug 32185] Bug in BasePinImp_GetMediaType()

http://bugs.winehq.org/show_bug.cgi?id=32185

François Gouget  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |regression, source

[Bug 32185] Bug in BasePinImp_GetMediaType()

http://bugs.winehq.org/show_bug.cgi?id=32185

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download

[Bug 32185] Bug in BasePinImp_GetMediaType()

http://bugs.winehq.org/show_bug.cgi?id=32185

François Gouget  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|[e-mail]        |[e-mail]
    Regression SHA1|                            |7e82db784a448c6802001345d62
                   |                            |30f72a711d237

[Bug 32185] Bug in BasePinImp_GetMediaType()

http://bugs.winehq.org/show_bug.cgi?id=32185

--- Comment #1 from Christian Costa  2012-11-09 18:24:33 CST ---
The provided link shows a crash in CoCreateInstance which is very odd.
http://test.winehq.org/data/1262f07609e6722a841f511445f145d941848800/linux_a...
seems to show more what your are describing.
Just check the code an indeed AM_MEDIA_TYPE is not well initialized. I will
send a patch for that.

[Bug 32185] Bug in BasePinImp_GetMediaType()

http://bugs.winehq.org/show_bug.cgi?id=32185

--- Comment #2 from Christian Costa  2012-11-09 18:34:55 CST ---
Created attachment 42464
  --> http://bugs.winehq.org/attachment.cgi?id=42464
Fix

Hope it will not take to long to get in.

[Bug 32185] Bug in BasePinImp_GetMediaType()

http://bugs.winehq.org/show_bug.cgi?id=32185

--- Comment #3 from François Gouget  2012-11-09 19:11:44 CST ---
That patch seems to work. Thanks!

Sorry for the link to the CoCreateInstance() failure. I picked the wrong link.
I'm secretly hoping that failure mode will disappear too.

[Bug 32185] Bug in BasePinImp_GetMediaType()

http://bugs.winehq.org/show_bug.cgi?id=32185

--- Comment #4 from Christian Costa  2012-11-23 15:20:26 CST ---
Fixed by commit 56c0151f6d9b078c79b95ffdf41fa0b9cc0892b1.

[Bug 32185] Bug in BasePinImp_GetMediaType()

http://bugs.winehq.org/show_bug.cgi?id=32185

Bruno Jesus  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|                            |56c0151f6d9b078c79b95ffdf41
                   |                            |fa0b9cc0892b1
             Status|NEW                         |RESOLVED
                 CC|                            |[e-mail]
         Resolution|                            |FIXED

--- Comment #5 from Bruno Jesus  2012-11-23 17:49:08 CST ---
(In reply to comment #4)
> Fixed by commit 56c0151f6d9b078c79b95ffdf41fa0b9cc0892b1.

Thanks.

[Bug 32185] Bug in BasePinImp_GetMediaType()

http://bugs.winehq.org/show_bug.cgi?id=32185

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #6 from Alexandre Julliard  2012-12-07 13:36:11 CST ---
Closing bugs fixed in 1.5.19.

[Bug 32185] Bug in BasePinImp_GetMediaType()

https://bugs.winehq.org/show_bug.cgi?id=32185

Zebediah Figura  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|amstream                    |quartz