https://bugs.winehq.org/show_bug.cgi?id=50603
Bug ID: 50603 Summary: WiX Toolset v3.9 installer crashes when loading update feed XML Product: Wine Version: 6.1 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: msxml3 Assignee: wine-bugs@winehq.org Reporter: focht@gmx.net Distribution: ---
Hello folks,
extracted from bug 37751 ("WiX Toolset v3.9 installer doesn't open with Wine-Mono (metahostpolicy_GetRequestedRuntime returns CLR_E_SHIM_RUNTIME)") to avoid the bug being recycled for multiple problems.
Stable download link via Internet Archive:
https://web.archive.org/web/20200227003934/https://github.com/wixtoolset/wix...
Trace log:
--- snip --- $ WINEDEBUG=+seh,+relay,+msxml wine ./wix311.exe >>log.txt 2>&1 ... 0110:Call KERNEL32.WideCharToMultiByte(0000fde9,00000000,0017babc L"C:\users\focht\Temp\UpdateFeed_20210201195635.xml",ffffffff,7dd4f5a0,00000033,00000000,00000000) ret=7d1d0006 ... 0110:trace:msxml:domdoc_load ret (0) ... 0110:trace:msxml:domdoc_get_documentElement (0x1928b0)->(0x31f714) 0110:trace:msxml:create_node type 1 ... 0110:trace:msxml:create_node type 3 0110:trace:msxml:xmldoc_add_refs (0x7cd8da10)->(9) 0110:trace:msxml:domtext_QueryInterface (0x191088)->({2933bf80-7b36-11d2-b20e-00c04f983e60} 0x31f5fc) 0110:trace:msxml:domtext_AddRef (0x191088)->(2) 0110:trace:msxml:domtext_Release (0x191088)->(1) 0110:trace:msxml:domtext_get_nodeType (0x191088)->(0x31f67c) 0110:trace:msxml:domtext_Release (0x191088)->(0) 0110:trace:msxml:xmldoc_release_refs (0x7cd8da10)->(8) 0110:trace:msxml:xmlnodelist_nextNode (0x191040)->(0x31f668) 0110:trace:msxml:domelem_get_text (0x190dc0)->(0x31f66c) 0110:trace:msxml:node_get_text 0x190dc0 L"<p>Change list:</p> <ul>\n<li>RobMen: WIXBUG:6075 - Fix "Zip Slip" vulnerability in DTF.</li>\n</ul>" 0110:trace:msxml:xmlnodelist_Release (0x191040)->(0) 0110:trace:msxml:xmldoc_release_refs (0x7cd8da10)->(7) 0110:trace:msxml:xmlnodemap_Release (0x180f18)->(0) 0110:trace:msxml:xmldoc_release_refs (0x7cd8da10)->(6) 0110:trace:msxml:domelem_Release (0x190dc0)->(0) 0110:trace:msxml:xmldoc_release_refs (0x7cd8da10)->(5) 0110:trace:msxml:xmlnodelist_nextNode (0x190660)->(0x31f694) 0110:trace:msxml:create_node type 1 0110:trace:msxml:xmldoc_add_refs (0x7cd8da10)->(6) 0110:trace:msxml:domelem_QueryInterface (0x190dc0)->({2933bf80-7b36-11d2-b20e-00c04f983e60} 0x31f61c) 0110:trace:msxml:domelem_AddRef (0x190dc0)->(2) 0110:trace:msxml:domelem_Release (0x190dc0)->(1) 0110:trace:msxml:domelem_get_nodeType (0x190dc0)->(0x31f6a8) 0110:trace:msxml:domelem_get_baseName (0x190dc0)->(0x31f6c4) 0110:trace:msxml:node_get_base_name returning L"version" 0110:trace:msxml:domelem_get_namespaceURI (0x190dc0)->(0x31f694) 0110:trace:msxml:node_get_namespaceURI uri: L"http://appsyndication.org/2006/appsyn" 0110:trace:msxml:domelem_get_baseName (0x190dc0)->(0x31f690) 0110:trace:msxml:node_get_base_name returning L"version" 0110:trace:msxml:domelem_get_text (0x190dc0)->(0x31f68c) 0110:trace:msxml:node_get_text 0x190dc0 L"v3.11.2.4516" 0110:trace:msxml:domelem_get_attributes (0x190dc0)->(0x31f688) 0110:trace:msxml:xmldoc_add_refs (0x7cd8da10)->(7) 0110:trace:msxml:xmlnodemap_nextNode (0x1911b0)->(0x31f698: 0) 0110:trace:msxml:domelem_next_node (0x7dd51190)->(0: 0x31f698) 0110:trace:seh:dispatch_exception code=c0000005 flags=0 addr=00447A55 ip=00447a55 tid=0110 0110:trace:seh:dispatch_exception info[0]=00000000 0110:trace:seh:dispatch_exception info[1]=00000000 0110:trace:seh:dispatch_exception eax=001911e0 ebx=00000000 ecx=0031f668 edx=00000000 esi=00000000 edi=001911e0 0110:trace:seh:dispatch_exception ebp=0031f66c esp=0031f64c cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010202 0110:trace:seh:call_vectored_handlers calling handler at 01CE03D0 code=c0000005 flags=0 0110:trace:seh:call_vectored_handlers handler at 01CE03D0 returned 0 0110:trace:seh:call_vectored_handlers calling handler at 7B00F270 code=c0000005 flags=0 0110:trace:seh:call_vectored_handlers handler at 7B00F270 returned 0 0110:trace:seh:call_stack_handlers calling handler at 00431150 code=c0000005 flags=0 0110:trace:seh:call_stack_handlers handler at 00431150 returned 1 0110:trace:seh:call_stack_handlers calling handler at 7BC52860 code=c0000005 flags=0 0110:trace:seh:start_debugger Starting debugger L"winedbg --auto 268 316" 0110:trace:seh:call_stack_handlers handler at 7BC52860 returned 1 --- snip ---
'winetricks -q msxml3' works around (https://bugs.winehq.org/show_bug.cgi?id=37751#c19)
$ sha1sum wix311.exe 3f619089b46df893f55e58832ce442678fb0635f wix311.exe
$ du -sh wix311.exe 27M wix311.exe
$ wine --version wine-6.1
Regards
https://bugs.winehq.org/show_bug.cgi?id=50603
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, Installer URL| |https://web.archive.org/web | |/20200227003934/https://git | |hub.com/wixtoolset/wix3/rel | |eases/download/wix3111rtm/w | |ix311.exe
https://bugs.winehq.org/show_bug.cgi?id=50603
Damjan Jovanovic damjan.jov@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |damjan.jov@gmail.com
--- Comment #1 from Damjan Jovanovic damjan.jov@gmail.com --- If I just take that last msxml function call before the crash:
---snip--- 0110:trace:msxml:domelem_next_node (0x7dd51190)->(0: 0x31f698) ---snip---
and I patch that function to return S_FALSE if the nextNode is NULL:
---snip--- + if (*nextNode == NULL) return S_FALSE; return S_OK; } ---snip---
the crash is avoided, and the installer proceeds to asking to install .NET 4.
It can't be that simple, can it?
(Note I used dotnet48 here, as Wine-Mono dies from another error (something about font metrics?). With corefonts Wine-Mono gets further, but still crashes elsewhere before opening that installation dialog with various options.)
https://bugs.winehq.org/show_bug.cgi?id=50603
--- Comment #2 from Damjan Jovanovic damjan.jov@gmail.com --- All current msxml unit tests pass. Let's add a new one for this patch.
https://bugs.winehq.org/show_bug.cgi?id=50603
Damjan Jovanovic damjan.jov@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |patch, source, testcase
--- Comment #3 from Damjan Jovanovic damjan.jov@gmail.com --- Patch sent: https://source.winehq.org/patches/data/207997
As explained in the patch:
Currently Wine return S_FALSE when IXMLDOMNamedNodeMap::nextNode() has run out of attributes to return, but when an XML node has no attributes at all, it returns S_OK despite setting the nextNode output parameter to NULL, causing the caller to crash when it accesses this pointer. Return S_FALSE in this case instead.
I can't believe this bug went undetected for so long.
https://bugs.winehq.org/show_bug.cgi?id=50603
Damjan Jovanovic damjan.jov@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |06cd8d3d2eb09ffb19f26e95360 | |c3ddcc4caf46d Status|NEW |RESOLVED Resolution|--- |FIXED
--- Comment #4 from Damjan Jovanovic damjan.jov@gmail.com --- Patch committed, resolving fixed.
Thank you for your bug report.
https://bugs.winehq.org/show_bug.cgi?id=50603
Damjan Jovanovic damjan.jov@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|WiX Toolset v3.9 installer |WiX Toolset v3.11 installer |crashes when loading update |crashes when loading update |feed XML |feed XML
--- Comment #5 from Damjan Jovanovic damjan.jov@gmail.com --- The WiX version in the attached binary is 3.11, not 3.9.
https://bugs.winehq.org/show_bug.cgi?id=50603
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #6 from Alexandre Julliard julliard@winehq.org --- Closing bugs fixed in 6.12.
https://bugs.winehq.org/show_bug.cgi?id=50603
Michael Stefaniuc mstefani@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |6.0.x
https://bugs.winehq.org/show_bug.cgi?id=50603
Michael Stefaniuc mstefani@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|6.0.x |---
--- Comment #7 from Michael Stefaniuc mstefani@winehq.org --- Removing the 6.0.x milestone from bug fixes included in 6.0.3.
-
WineHQ Bugzilla