https://bugs.winehq.org/show_bug.cgi?id=41132
Bug ID: 41132 Summary: Invalid Font Files Can Cause Wine To Crash Unexpectedly Product: Wine Version: 1.9.16 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs@winehq.org Reporter: thexzoron@riseup.net Distribution: ---
If wine picks up an invalid font file in /usr/share/fonts it can cause some programs to crash unexpectedly https://a.desu.sh/quohkg.log (warning opening this in browser can cause it to crash/hang)
https://bugs.winehq.org/show_bug.cgi?id=41132
--- Comment #1 from thexzoron@riseup.net --- the package ttf-monoid-ibx from the infinality-bundle-fonts repo for archlinux was causing steam to crash instantly on startup.
https://bugs.winehq.org/show_bug.cgi?id=41132
--- Comment #2 from thexzoron@riseup.net --- (In reply to thexzoron from comment #1)
the package ttf-monoid-ibx from the infinality-bundle-fonts repo for archlinux was causing steam to crash instantly on startup.
http://bohoomil.com/repo/fonts/
https://bugs.winehq.org/show_bug.cgi?id=41132
Sebastian Lackner sebastian@fds-team.de changed:
What |Removed |Added ---------------------------------------------------------------------------- URL| |http://bohoomil.com/repo/fo | |nts/ttf-monoid-ibx-0.61-1-a | |ny.pkg.tar.xz Summary|Invalid Font Files Can |Invalid font files can |Cause Wine To Crash |cause Steam to crash |Unexpectedly |unexpectedly CC| |sebastian@fds-team.de
--- Comment #3 from Sebastian Lackner sebastian@fds-team.de --- Thanks for the report. Relevant lines from the log file:
--- snip --- 0056:Call KERNEL32.CreateFileW(00d18350 L"Z:\usr\share\fonts\ttf-monoid-ibx\Monoid-Retina.ttf",80000000,00000003,00000000,00000003,00000080,00000000) ret=7d793aec 0056:Ret KERNEL32.CreateFileW() retval=00000138 ret=7d793aec [...] 0056:Call ntdll.RtlFreeHeap(00110000,00000000,001ecda0) ret=7d792a16 0056:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7d792a16 0056:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7d79ade8 ip=7d79ade8 tid=0056 0056:trace:seh:raise_exception info[0]=00000000 0056:trace:seh:raise_exception info[1]=00000000 0056:trace:seh:raise_exception eax=00000000 ebx=00000000 ecx=0033d7d6 edx=00000000 esi=00000000 edi=00d183c0 0056:trace:seh:raise_exception ebp=0033e268 esp=0033d6f0 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00210246 0056:trace:seh:call_stack_handlers calling handler at 0x3f02d560 code=c0000005 flags=0 --- snip ---
I've also added a direct link to the ttf-monoid-ibx package above.
https://bugs.winehq.org/show_bug.cgi?id=41132
Sebastian Lackner sebastian@fds-team.de changed:
What |Removed |Added ---------------------------------------------------------------------------- Component|-unknown |dwrite Summary|Invalid font files can |Specific font files can |cause Steam to crash |cause Steam to crash |unexpectedly |unexpectedly CC| |bunglehead@gmail.com
--- Comment #4 from Sebastian Lackner sebastian@fds-team.de --- I tracked the issue down to a bug in dwrite. The issue occurs while resolving the stretch name, see:
http://source.winehq.org/git/wine.git/blob/HEAD:/dlls/dwrite/font.c#l3098
In this case font->stretch == DWRITE_FONT_STRETCH_SEMI_CONDENSED, but the stretchnamesW[] array contains a NULL pointer for this entry. It seems like the index -> name mapping are shifted by one because DWRITE_FONT_STRETCH_UNDEFINED is missing.
@Nikolay: Since its your area, could you maybe take a look?
https://bugs.winehq.org/show_bug.cgi?id=41132
Nikolay Sivov bunglehead@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |NEW Ever confirmed|0 |1
--- Comment #5 from Nikolay Sivov bunglehead@gmail.com --- Yes, that makes sense, thanks. 'make test' will trigger a crash, so no specific application is needed. I resent simplified version of your patch and another fix that will fix having undefined stretch (0) in a first place:
https://www.winehq.org/pipermail/wine-patches/2016-August/153492.html https://www.winehq.org/pipermail/wine-patches/2016-August/153493.html
https://bugs.winehq.org/show_bug.cgi?id=41132
Nikolay Sivov bunglehead@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED Fixed by SHA1| |1540a19359ff14a8380578c1ce7 | |f81f16a859dd3
--- Comment #6 from Nikolay Sivov bunglehead@gmail.com --- Fixed with http://source.winehq.org/git/wine.git/?a=commit;h=1540a19359ff14a8380578c1ce....
https://bugs.winehq.org/show_bug.cgi?id=41132
Nikolay Sivov bunglehead@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC|bunglehead@gmail.com |
https://bugs.winehq.org/show_bug.cgi?id=41132
Michael Stefaniuc mstefani@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |1.8.x CC| |mstefani@redhat.com
https://bugs.winehq.org/show_bug.cgi?id=41132
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #7 from Alexandre Julliard julliard@winehq.org --- Closing bugs fixed in 1.9.17.
https://bugs.winehq.org/show_bug.cgi?id=41132
Michael Stefaniuc mstefani@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|1.8.x |---
--- Comment #8 from Michael Stefaniuc mstefani@redhat.com --- Removing 1.8.x milestone from bugs included in 1.8.4.
-
wine-bugs＠winehq.org