[Bug 45044] New: Microsoft Visual C++ 2005, 2008 Redistributable installers fail with 'action L"SxsInstallCA" returned 1603'
https://bugs.winehq.org/show_bug.cgi?id=45044
Bug ID: 45044 Summary: Microsoft Visual C++ 2005, 2008 Redistributable installers fail with 'action L"SxsInstallCA" returned 1603' Product: Wine Version: 3.6 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: msi Assignee: wine-bugs@winehq.org Reporter: focht@gmx.net Distribution: ---
Hello folks,
noticed this on recent Wine build from Git while investigating some other issue. The installer bundles MSVC++ 2005 runtime and it fails to run the sub-installer. This worked in the past.
--- snip --- $ WINEDEBUG=+seh,+relay,+msi wine ./vcredist_x86.exe >>log.txt 2>&1 ... 0032:Call KERNEL32.MultiByteToWideChar(00000000,00000001,00411290 "msiexec /i vcredist.msi",00000018,004112b0,00000018) ret=f7b1c6bf ... 0032:trace:msi:HANDLE_CustomType1 Calling function L"CustomAction_SxsMsmInstall" from L"C:\users\focht\Temp\msi3fd.tmp" 0033:Starting thread proc 0x7ebbc0db (arg=0x1d736c) 0033:trace:msi:DllThread custom action (33) started ... 0033:trace:msi:ACTION_CallDllFunction calling L"CustomAction_SxsMsmInstall" ... 0033:Call msi.MsiGetActiveDatabase(00000002) ret=00402d45 0033:trace:msi:MsiGetActiveDatabase (2) 0033:trace:msi:MsiGetActiveDatabase (1) 0033:trace:msi:alloc_msihandle 0x159508 -> 3 0033:trace:msi:alloc_msi_remote_handle 3 -> 4 0033:Ret msi.MsiGetActiveDatabase() retval=00000004 ret=00402d45 0033:Call msi.MsiDatabaseOpenViewA(00000004,0040146c "SELECT `Component_`, `Guid` FROM `SxsMsmGenComponents`",0061fd28) ret=00402d5e ... 0033:Call msi.MsiDatabaseOpenViewA(00000004,00401290 "SELECT `Directory_`, `ComponentId` FROM `Component` WHERE `Component` = ?",0061fcd8) ret=00402335 0033:trace:msi:MsiDatabaseOpenViewA 4 "SELECT `Directory_`, `ComponentId` FROM `Component` WHERE `Component` = ?" 0x61fcd8 ... 0033:Ret msi.MsiDatabaseOpenViewA() retval=00000000 ret=00402335 ... 0033:Call msi.MsiRecordSetStringA(0000000d,00000001,00411388 "uplevel.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E") ret=00402355 ... 0033:Call msi.MsiViewExecute(00000017,0000000d) ret=00402377 0033:trace:msi:MsiViewExecute 23 13 0033:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebd516c 0033:Ret ntdll.RtlAllocateHeap() retval=001e32a8 ret=7ebd516c 0033:trace:msi:alloc_msihandle 0x1e32a8 -> 24 0033:Ret msi.MsiViewExecute() retval=0061fbe8 ret=00402377 ... 0033:trace:msi:DllThread custom action (33) returned 1603 ... 0032:err:msi:ITERATE_Actions Execution halted, action L"SxsInstallCA" returned 1603 ... 0032:err:msi:ITERATE_Actions Execution halted, action L"ExecuteAction" returned 1603 --- snip ---
Debugger:
--- snip --- $ MsiBreak=CustomAction_SxsMsmInstall wine msiexec -i vcredist.msi ...
$ winedbg
Wine-dbg>attach 0x8
Wine-dbg>c DbgBreakPoint () at /home/focht/projects/wine/wine.repo/src/include/winternl.h:2223 0x7b442fe0 DbgBreakPoint+0x4 [/home/focht/projects/wine/wine.repo/src/include/winternl.h:2223] in kernel32: nop 2223 static inline void WINAPI DbgBreakPoint(void) { __asm__ __volatile__("int3"); }
$ Wine-dbg>b MsiViewExecute 002f:fixme:dbghelp_dwarf:dwarf2_parse_const_type Unsupported children Breakpoint 1 at 0x7ebe87b9 MsiViewExecute [/home/focht/projects/wine/wine.repo/src/dlls/msi/msiquery.c:475] in msi
Wine-dbg>c Stopped on breakpoint 1 at 0x7ebe87b9 MsiViewExecute [/home/focht/projects/wine/wine.repo/src/dlls/msi/msiquery.c:475] in msi MsiViewExecute () at /home/focht/projects/wine/wine.repo/src/dlls/msi/msiquery.c:475
Wine-dbg>c Stopped on breakpoint 1 at 0x7ebe87b9 MsiViewExecute [/home/focht/projects/wine/wine.repo/src/dlls/msi/msiquery.c:475] in msi
Wine-dbg>c Stopped on breakpoint 1 at 0x7ebe87b9 MsiViewExecute [/home/focht/projects/wine/wine.repo/src/dlls/msi/msiquery.c:475] in msi
Wine-dbg>c Stopped on breakpoint 1 at 0x7ebe87b9 MsiViewExecute [/home/focht/projects/wine/wine.repo/src/dlls/msi/msiquery.c:475] in msi
Wine-dbg>c Stopped on breakpoint 1 at 0x7ebe87b9 MsiViewExecute [/home/focht/projects/wine/wine.repo/src/dlls/msi/msiquery.c:475] in msi
Wine-dbg>b copy_remote_record Breakpoint 2 at 0x7ebf6888 copy_remote_record [/home/focht/projects/wine/wine.repo/src/dlls/msi/record.c:1059] in msi
Wine-dbg>c Stopped on breakpoint 2 at 0x7ebf6888 copy_remote_record [/home/focht/projects/wine/wine.repo/src/dlls/msi/record.c:1059] in msi copy_remote_record () at /home/focht/projects/wine/wine.repo/src/dlls/msi/record.c:1059
Wine-dbg>bt
Backtrace: =>0 0x7ebf6888 copy_remote_record(in=0x1d3b0c, out=0x1f) [/home/focht/projects/wine/wine.repo/src/dlls/msi/record.c:1059] in msi (0x0061fc18) 1 0x7ebe9d3e remote_ViewExecute+0x29(view=<couldn't compute location>, remote_rec=<couldn't compute location>) [/home/focht/projects/wine/wine.repo/src/dlls/msi/msiquery.c:1106] in msi (0x0061fc48) 2 0x7ebe8894 MsiViewExecute+0xda(hView=<couldn't compute location>, hRec=<couldn't compute location>) [/home/focht/projects/wine/wine.repo/src/dlls/msi/msiquery.c:497] in msi (0x0061fc98) 3 0x00402377 in msifcec.tmp (+0x2376) (0x0061fce0) 4 0x00402fd6 in msifcec.tmp (+0x2fd5) (0x0061fd38) 5 0x00403336 in msifcec.tmp (+0x3335) (0x0061fd48) 6 0x7ebbbd2e CUSTOMPROC_wrapper+0xd() in msi (0x0061fd58) 7 0x7ebbbf19 ACTION_CallDllFunction+0x1e8(guid=0x1c585c) [/home/focht/projects/wine/wine.repo/src/dlls/msi/custom.c:564] in msi (0x0061fe98) 8 0x7ebbc14d DllThread+0x71(arg=<couldn't compute location>) [/home/focht/projects/wine/wine.repo/src/dlls/msi/custom.c:598] in msi (0x0061fed8) 9 0x7bc95468 call_thread_func_wrapper+0xb() in ntdll (0x0061feec) 10 0x7bc954ce call_thread_func+0x63(entry=0x7ebbc0db, arg=0x1c585c) [/home/focht/projects/wine/wine.repo/src/dlls/ntdll/signal_i386.c:2625] in ntdll (0x0061ffdc) 11 0x7bc9545a call_thread_entry+0x9() in ntdll (0x0061ffec)
Wine-dbg>info locals 0x7ebf6888 copy_remote_record: (0061fc18) struct wire_record* in=0x1d3b0c (parameter [ESP+4]) MSIHANDLE out=0x1f (parameter [ESP+8]) MSIRECORD* rec=0x61fc60 (local [ESP-24]) unsigned int i=0x7ebf6a82 (local [ESP-16]) UINT r=0x61fc18 (local [ESP-20])
Wine-dbg>n 1064 if (!(rec = msihandle2msiinfo(out, MSIHANDLETYPE_RECORD))) Wine-dbg>n 1067 for (i = 0; i <= in->count; i++) Wine-dbg>n 1067 for (i = 0; i <= in->count; i++) Wine-dbg>n 1069 switch (in->fields[i].type) Wine-dbg>n 1072 MSI_FreeField(&rec->fields[i]); Wine-dbg>n 1073 rec->fields[i].type = MSIFIELD_NULL; Wine-dbg>n 1074 break; Wine-dbg>n 1089 if (r) Wine-dbg>n 1091 msiobj_release(&rec->hdr); Wine-dbg>n 1092 return r; --- snip ---
Two cases of the switch use uninitialized 'r' value.
Source:
https://source.winehq.org/git/wine.git/blob/a373054b72f396a04ab4f191e1f6c2c9...
--- snip --- 1058 UINT copy_remote_record(const struct wire_record *in, MSIHANDLE out) 1059 { 1060 MSIRECORD *rec; 1061 unsigned int i; 1062 UINT r; 1063 1064 if (!(rec = msihandle2msiinfo(out, MSIHANDLETYPE_RECORD))) 1065 return ERROR_INVALID_HANDLE; 1066 1067 for (i = 0; i <= in->count; i++) 1068 { 1069 switch (in->fields[i].type) 1070 { 1071 case MSIFIELD_NULL: 1072 MSI_FreeField(&rec->fields[i]); 1073 rec->fields[i].type = MSIFIELD_NULL; 1074 break; 1075 case MSIFIELD_INT: 1076 r = MSI_RecordSetInteger(rec, i, in->fields[i].u.iVal); 1077 break; 1078 case MSIFIELD_WSTR: 1079 r = MSI_RecordSetStringW(rec, i, in->fields[i].u.szwVal); 1080 break; 1081 case MSIFIELD_STREAM: 1082 r = MSI_RecordSetIStream(rec, i, in->fields[i].u.stream); 1083 break; 1084 default: 1085 ERR("invalid field type %d\n", in->fields[i].type); 1086 break; 1087 } 1088 1089 if (r) 1090 { 1091 msiobj_release(&rec->hdr); 1092 return r; 1093 } 1094 } 1095 1096 msiobj_release(&rec->hdr); 1097 return ERROR_SUCCESS; 1098 } --- snip ---
The custom action dll later converts the garbage value 0x61fc18 to 0x8007FC18 (meaningless) but ultimately to 1603.
--- snip --- 004022E6 56 PUSH ESI 004022E7 E8 63F5FFFF CALL 0040184F 004022EC 85FF TEST EDI,EDI ; 0x0061FC18 004022EE 7E 0C JLE SHORT 004022FC 004022F0 81E7 FFFF0000 AND EDI,0FFFF ; 0x0000FC18 004022F6 81CF 00000780 OR EDI,80070000 ; 0x8007FC18 004022FC 837D FC 00 CMP DWORD PTR SS:[EBP-4],0 00402300 74 08 JE SHORT 0040230A 00402302 FF75 FC PUSH DWORD PTR SS:[EBP-4] 00402305 E8 30150000 CALL 0040383A 0040230A 837D F8 00 CMP DWORD PTR SS:[EBP-8],0 0040230E 74 08 JE SHORT 00402318 00402310 FF75 F8 PUSH DWORD PTR SS:[EBP-8] 00402313 E8 22150000 CALL 0040383A --- snip ---
This is a regression, introduced by https://source.winehq.org/git/wine.git/commitdiff/bbf0f2da8211da73066fb36a44... ("msi: Make MsiProcessMessage() RPC-compatible") which introduced a buggy 'unmarshal_record' helper.
The code was later refactored into 'copy_remote_record' helper:
https://source.winehq.org/git/wine.git/commitdiff/c79fbc241e3c9a62ab50fb0826... ("msi: Make MsiViewModify() RPC-compatible.")
'MsiViewExecute' modified to call the remote wrappers which contain the bug:
https://source.winehq.org/git/wine.git/commitdiff/afb5eede24c35308d2370fd3b4... ("msi: Make MsiViewExecute() RPC-compatible.")
With a fix applied to properly initialize 'r', the installers work again.
$ ha1sum vcredist_x86.EXE b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847 vcredist_x86.EXE
$ du -sh vcredist_x86.EXE 2.6M vcredist_x86.EXE
$ wine --version wine-3.6-138-ga373054b72
Regards
https://bugs.winehq.org/show_bug.cgi?id=45044
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, Installer, | |regression Regression SHA1| |afb5eede24c35308d2370fd3b49 | |2545aed607ce6 URL| |https://download.microsoft. | |com/download/8/B/4/8B42259F | |-5D70-43F4-AC2E-4B208FD8D66 | |A/vcredist_x86.EXE
--- Comment #1 from Anastasius Focht focht@gmx.net --- Hello folks,
using https://source.winehq.org/git/wine.git/commitdiff/afb5eede24c35308d2370fd3b4... as regression part. The buggy code was introduced earlier but not used by 'MsiViewExecute' up to this point.
Regards
https://bugs.winehq.org/show_bug.cgi?id=45044
Nikolay Sivov bunglehead@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |z.figura12@gmail.com
https://bugs.winehq.org/show_bug.cgi?id=45044
--- Comment #2 from Zebediah Figura z.figura12@gmail.com --- Ack, thanks for the report. I'm not sure why the compiler didn't catch this one... perhaps it can't handle unions correctly.
https://bugs.winehq.org/show_bug.cgi?id=45044
--- Comment #3 from Gijs Vermeulen gijsvrm@gmail.com --- Fixed by https://source.winehq.org/git/wine.git/commit/859f455cb95a37e11f1187731be530...
https://bugs.winehq.org/show_bug.cgi?id=45044
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED Fixed by SHA1| |859f455cb95a37e11f1187731be | |530fc9b48da8a
--- Comment #4 from Anastasius Focht focht@gmx.net --- Hello folks,
indeed fixed by https://source.winehq.org/git/wine.git/commitdiff/859f455cb95a37e11f1187731b...
Thanks Zebediah
Regards
https://bugs.winehq.org/show_bug.cgi?id=45044
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #5 from Alexandre Julliard julliard@winehq.org --- Closing bugs fixed in 3.7.
https://bugs.winehq.org/show_bug.cgi?id=45044
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- URL|https://download.microsoft. |https://web.archive.org/web |com/download/8/B/4/8B42259F |/20180413004726/https://dow |-5D70-43F4-AC2E-4B208FD8D66 |nload.microsoft.com/downloa |A/vcredist_x86.EXE |d/8/B/4/8B42259F-5D70-43F4- | |AC2E-4B208FD8D66A/vcredist_ | |x86.EXE
-
wine-bugs＠winehq.org -
WineHQ Bugzilla