[Bug 28423] New: ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Summary: ImmGetDescriptionW() from imm32 crashes with certain
                    parameters
           Product: Wine
           Version: unspecified
          Platform: x86
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Created an attachment (id=36436)
 --> (http://bugs.winehq.org/attachment.cgi?id=36436)
The test program I did.

When a program calls ImmGetDescriptionW(NULL,NULL,direction), it crashes
instead of returning a direction and the size of it in characters, here is a
test program in the attachments and its source code.

This bug can be solved by adding this or something to allcate memory to imm32,
try it on both windows.

Also, it only occurs in a pointer, not on a finite empty array.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

--- Comment #1 from Knightlain  2011-09-17 20:13:41 CDT ---
Also this is the source code:
#include <windows.h>
#include <stdio.h>
#include <cstdlib>
#include <iostream>
#include <fstream>
#include <wchar.h>
using namespace std;

int main()
{
    unsigned int prueba;
    fstream resultado;
    WCHAR* testptr;
    resultado.open("result.txt",ios::out);
    prueba = ImmGetDescriptionW(NULL,testptr,255);
    resultado << "Address: " << testptr << endl;
    resultado << "Character length: " << prueba << endl;
    resultado.close();
}

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

--- Comment #2 from Nikolay Sivov  2011-09-18 00:53:33 CDT ---
(In reply to comment #1)
> int main()
> {
>     unsigned int prueba;
>     fstream resultado;
>     WCHAR* testptr;
>     resultado.open("result.txt",ios::out);
>     prueba = ImmGetDescriptionW(NULL,testptr,255);
>     resultado << "Address: " << testptr << endl;
>     resultado << "Character length: " << prueba << endl;
>     resultado.close();
> }

testptr is uninitialized so results are unreliable. Please add a test like
ImmGetDescriptionW/A(NULL, NULL, 1) to imm32/tests.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

--- Comment #3 from Nikolay Sivov  2011-09-18 00:53:59 CDT ---
What Wine version by the way?

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Knightlain  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unspecified                 |1.3.28

--- Comment #4 from Knightlain  2011-09-18 08:27:28 CDT ---
(In reply to comment #3)
> What Wine version by the way?

Forgot to tell it is 1.3.28, added to the description.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

--- Comment #5 from Knightlain  2011-09-18 08:28:52 CDT ---
if(!hKL && !lpszDescription) 
{
    lpszDescription = (WCHAR*)HeapAlloc(HeapCreate( 0, 0, 255
),HEAP_ZERO_MEMORY,255);
}
Those are the lines that fixed it for me, but I don't know to make a patch and
I know more implementation is needed for the function to be correct.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

--- Comment #6 from Bruno Jesus  2011-09-18 18:22:34 CDT ---
Created an attachment (id=36456)
 --> (http://bugs.winehq.org/attachment.cgi?id=36456)
Avoid null pointer copy

What application depends on this? Is it available for download?

Please, test the attached patch. It makes your test not crash.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

--- Comment #7 from Knightlain  2011-09-19 07:14:05 CDT ---
(In reply to comment #6)
> Created an attachment (id=36456)

--> (http://bugs.winehq.org/attachment.cgi?id=36456) [details]
> Avoid null pointer copy
>
> What application depends on this? Is it available for download?
>
> Please, test the attached patch. It makes your test not crash.

(In reply to comment #6)
> Created an attachment (id=36456)

--> (http://bugs.winehq.org/attachment.cgi?id=36456) [details]
> Avoid null pointer copy
>
> What application depends on this? Is it available for download?
>
> Please, test the attached patch. It makes your test not crash.

It is ok, however, it would be better if it returns an address, on windows it
returns an address, and about the application is not exactly an application,
just an attempt to implement that function completely since Phantasy Star
Online calls that function.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Bruno Jesus  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #8 from Bruno Jesus  2011-09-19 12:10:53 CDT ---
Can you provide the source code for the original .exe you posted? Your example
code does not work for me, even fixing the ptr. Return value is always zero.
Tested in Visual C++ 6.

Does the game work with the patch I attached previously?

lpszDescription may be null and in such cases it's not filled. If uBufLen is
zero the returned value is the required size for lpszDescription.

The caller must pass a valid pointer to the function, ImmGetDescription should
not allocate memory as far as I can see and even if it did there is no way to
return it to the user judging by it's parameters.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download, testcase

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

JHaleIT  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #9 from JHaleIT  2012-02-28 11:12:02 CST ---
This issue has been fixed.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1

--- Comment #10 from Austin English  2012-02-28 12:24:24 CST ---
(In reply to comment #9)
> This issue has been fixed.

The test program from comment #0 fails here in wine-1.4-rc5-45-g74ddf01.

Bruno's patch works around it.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

--- Comment #11 from JHaleIT  2012-02-28 13:16:50 CST ---
Oh sorry I posted in the wrong bug hahaha

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

--- Comment #12 from Bruno Jesus  2012-02-29 21:20:23 CST ---
Windows 7 and XP must crash if a valid IMM description is to be returned and
lpszDescription is NULL. The main problem here is that wine is not filtering
the NULL (read as "not valid") hkl parameter. If the hkl is invalid
ImmGetDescription should return zero and in some cases set error to invalid
handle.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Jerome Leclanche  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #13 from Jerome Leclanche  2012-03-03 13:56:02 CST ---
(In reply to comment #12)
Tests committed.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Bruno Jesus  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #36456|0                           |1
        is obsolete|                            |

--- Comment #14 from Bruno Jesus  2012-06-16 22:49:08 CDT ---
Created attachment 40573
  --> http://bugs.winehq.org/attachment.cgi?id=40573
Patch to fix the issue in wine 1.5.6

The attached patch will fix the problem but as I could not test it fully in
windows I'm not submitting it yet. None of the machines in testbot returns
valid IMEs to test (tests are skipped).

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Qian Hong  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Aric Stewart  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #15 from Aric Stewart  2013-09-17 13:12:34 CDT ---
(In reply to comment #14)
> Created attachment 40573 [details]
> Patch to fix the issue in wine 1.5.6
>
> The attached patch will fix the problem but as I could not test it fully in
> windows I'm not submitting it yet. None of the machines in testbot returns
> valid IMEs to test (tests are skipped).

Ok I am testing on Japanese windows XP.

ret = ImmGetDescriptionW(hkl, NULL, 100);  -> Causes and exception
ret = ImmGetDescriptionA(hkl, NULL, 100); -> Causes an exception

As for Vista and Windows 7, ImmGetDescription is broken there. It just does not
function.

http://blogs.msdn.com/b/michkap/archive/2008/12/04/9173920.aspx

I can try installing a custom old style IME and see but the above windows XP
behavior seems to imply to me that crashing in the case of HKL, NULL, 100 is
correct.

Back to windows XP;

ret = ImmGetDescriptionW(NULL, NULL, 100);
    ok(!ret, "ImmGetDescriptionW failed, expected 0 received %d.\n", ret);

That works without issue.

that that implys that your 
+  if (!hKL) return 0;

is correct, but that
+  if (!lpszDescription) return 0;

is incorrect.

If there is any other testing I can do please ask.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

--- Comment #16 from Bruno Jesus  2013-09-17 13:18:15 CDT ---
(In reply to comment #15)
> If there is any other testing I can do please ask.

Thank you very much for testing, I gave that patch to Qian Hong since I can't
test and he is currently working in Imm stuff. I hope he will find your results
useful.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Bruno Jesus  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|                            |8b933495fb4b9a874b9f1f35608
                   |                            |47739520ba384
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #17 from Bruno Jesus  2013-09-18 19:48:52 CDT ---
Fixed by 8b933495fb4b9a874b9f1f3560847739520ba384, thanks Aric.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #18 from Alexandre Julliard  2013-09-27 13:40:50 CDT ---
Closing bugs fixed in 1.7.3.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |1.6.x

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

http://bugs.winehq.org/show_bug.cgi?id=28423

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|1.6.x                       |---

--- Comment #19 from Alexandre Julliard  2013-11-15 13:39:33 CST ---
Removing 1.6.x milestone from bugs included in 1.6.1.

[Bug 28423] ImmGetDescriptionW() from imm32 crashes with certain parameters

https://bugs.winehq.org/show_bug.cgi?id=28423

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
          Component|-unknown                    |imm32