[Bug 8222] Adobe Photoshop Album Starter Edition 3.2 fails to install

[Wine Bugs]

http://bugs.winehq.org/show_bug.cgi?id=8222

------- Additional Comments From [e-mail]  2007-30-04 07:13 -------
Hello,

looks like an application bug to me (in custom installer dll).

Here is my own trace with relevant parts:

--- snip trace ---
...
0028:Call msi.MsiGetPropertyA(00000001,00730460
"AUMUSEORIGINALAPPID",00000000,615f1514) ret=1001a525
0028:trace:msi:MSI_GetProperty 1 L"AUMUSEORIGINALAPPID" (nil) 0x615f1514
...
0028:Call kernel32.WideCharToMultiByte(00000000,00000000,0066b2a8
L"True",ffffffff,00000000,00000000,00000000,00000000) ret=601b99f7
0028:Ret  kernel32.WideCharToMultiByte() retval=00000005 ret=601b99f7
0028:Call kernel32.WideCharToMultiByte(00000000,00000000,0066b2a8
L"True",ffffffff,00000000,00000000,00000000,00000000) ret=601b9a4f
0028:Ret  kernel32.WideCharToMultiByte() retval=00000005 ret=601b9a4f
...
0028:Ret  msi.MsiGetPropertyA() retval=00000000 ret=1001a525
0028:Call ntdll.RtlAllocateHeap(00730000,00000000,00000004) ret=10029d46
0028:Ret  ntdll.RtlAllocateHeap() retval=00730488 ret=10029d46
0028:Call msi.MsiGetPropertyA(00000001,00730460
"AUMUSEORIGINALAPPID",00730488,615f1514) ret=1001a57f
...
0028:Call kernel32.WideCharToMultiByte(00000000,00000000,0066b2a8
L"True",ffffffff,00000000,00000000,00000000,00000000) ret=601b99f7
0028:Ret  kernel32.WideCharToMultiByte() retval=00000005 ret=601b99f7
0028:Call kernel32.WideCharToMultiByte(00000000,00000000,0066b2a8
L"True",ffffffff,00730488,00000004,00000000,00000000) ret=601b9a4f
0028:Ret  kernel32.WideCharToMultiByte() retval=00000000 ret=601b9a4f
0028:Ret  msi.MsiGetPropertyA() retval=000000ea ret=1001a57f
--- snip trace ---

First, they determine necessary buffer length for MsiGetProperty().
Returned length is 4 -> strlen("True")
MSDN states:

"When the function returns ERROR_SUCCESS, this variable contains the size of the
data copied to szValueBuf, not including the terminating null character."

The caller reserves 4 bytes of memory and passes it to msi.

RtlAllocateHeap(00730000,00000000,00000004)

Now guess.

The second MsiGetProperty() fails because the NULL terminator can't be stuffed
into result buffer (supplied buffer len = 4, string len = 4).

Hence the "msi.MsiGetPropertyA() retval=000000ea" -> 234 -> ERROR_MORE_DATA.

Clearly sloppy devs... they should reserve memory for NULL terminator too. :)
Just curious ... does this installer work on windows?
If yes, windows might be braindamaged once more :)

This is the installer MD5sum with the bug (just in case adobe silently replaces
their buggy stuff):

5f28c010a854dbff6a8b329ec31a5c66  Photoshop_albumSE_en_us_320.exe

Regards