[Bug 44976] New: ConEmu-Maximus5 Windows console emulator causes crash of builtin ' wineconsole.exe' (division by zero)

https://bugs.winehq.org/show_bug.cgi?id=44976

Bug ID: 44976
           Summary: ConEmu-Maximus5 Windows console emulator causes crash
                    of builtin 'wineconsole.exe' (division by zero)
           Product: Wine
           Version: 3.6
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: programs
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Hello folks,

as it says.

--- snip ---
$ pwd
/home/focht/.wine/drive_c/Program Files/ConEmu

002f:Call KERNEL32.CreateProcessW(00000000,0032f144 L""C:\Program
Files\ConEmu\ConEmu\ConEmuC.exe"
/CheckUnicode",00000000,00000000,00000000,04000030,00000000,00000000,0032ef78,0032efbc)
ret=0046808c
...
0033:Call KERNEL32.__wine_kernel_init() ret=7bc6c1e8
002f:Ret  KERNEL32.CreateProcessW() retval=00000001 ret=0046808c
002f:Call KERNEL32.WaitForSingleObject(000000d0,00001388) ret=004680a1
...
0035:Call KERNEL32.__wine_kernel_init() ret=7bc6c1e8
...
0035:Starting process L"C:\windows\system32\wineconsole.exe"
(entryproc=0x7ec9525c)
...
0035:trace:wineconsole:WINECON_RegLoad loading L"C:\Program
Files\ConEmu\ConEmu\ConEmuC.exe" registry settings.
...
0035:trace:wineconsole:WINECON_DumpConfig load cell=(0,5) cursor=(25,1) attr=07
pop-up=f5 font=L"Lucida Console"/0 hist=50/2 flags=IqX msk=00000000
sb=(80,32766) win=(0,0)x(80,25) edit=0 registry=L"C:_Program
Files_ConEmu_ConEmu_ConEmuC.exe"
0035:trace:wineconsole:WINECON_Init using hConIn 0x1c, hSynchro event 0x20
0035:trace:wineconsole:WINECON_Init using hConOut 0x24 
...
0035:trace:wineconsole:WINECON_DumpConfig first cfg:  cell=(0,0) cursor=(100,1)
attr=0f pop-up=00 font=L""/0 hist=50/2 flags=Iqx msk=00000000 sb=(80,150)
win=(0,0)x(80,25) edit=0 registry=(null)
...
0035:warn:wineconsole:WCUSER_SetFontPmt Couldn't match the font from
registry... trying to find one 
...
0035:trace:wineconsole:WINECON_DumpConfig crsr cell=(8,16) cursor=(100,1)
attr=0f pop-up=00 font=L"Liberation Mono"/400 hist=50/2 flags=Iqx msk=00000000
sb=(80,150) win=(0,0)x(80,25) edit=0 registry=(null) 
...
0035:trace:wineconsole:WINECON_RegLoad loading default registry settings. 
...
0035:trace:wineconsole:WINECON_DumpConfig load cell=(8,16) cursor=(25,1)
attr=0f pop-up=f5 font=L"Liberation Mono"/0 hist=50/2 flags=IqX msk=00000000
sb=(80,25) win=(0,0)x(80,25) edit=0 registry=(null)
0035:trace:wineconsole:WINECON_RegSave saving registry settings.
...
0035:trace:wineconsole:WINECON_DumpConfig save cell=(8,16) cursor=(25,1)
attr=0f pop-up=f5 font=L"Liberation Mono"/0 hist=50/2 flags=IqX msk=00000000
sb=(80,25) win=(0,0)x(80,25) edit=0 registry=(null) 
...
0035:Call user32.SystemParametersInfoW(00000030,00000000,0033fb4c,00000000)
ret=7ec93b16
...
0035:Ret  user32.SystemParametersInfoW() retval=00000001 ret=7ec93b16
0035:trace:seh:raise_exception code=c0000094 flags=0 addr=0x7ec93b8f
ip=7ec93b8f tid=0035
0035:trace:seh:raise_exception  eax=00000780 ebx=00000000 ecx=00000780
edx=00000000 esi=00000000 edi=00000000
0035:trace:seh:raise_exception  ebp=0033fb78 esp=0033fac0 cs=0023 ds=002b
es=002b fs=0063 gs=006b flags=00010202
0035:trace:seh:call_stack_handlers calling handler at 0x7b48fa3c code=c0000094
flags=0
wine: Unhandled division by zero at address 0x7ec93b8f (thread 0035), starting
debugger...
0035:trace:seh:start_debugger Starting debugger "winedbg --auto 52 72"

--- snip ---
Unhandled exception: divide by zero in 32-bit code (0x7ec93b8f).
...
Backtrace:
=>0 0x7ec93b8f WINECON_SetConfig+0x2a2(data=0x110870, cfg=0x33fc50)
[/home/focht/projects/wine/wine.repo/src/programs/wineconsole/wineconsole.c:457]
in wineconsole (0x0033fb78)
  1 0x7ec94913 WINECON_Init+0x3db(hInst=0x7ec80000, pid=0, appname="C:\Program
Files\ConEmu\ConEmu\ConEmuC.exe", backend=0x7ec91ff9, nCmdShow=0)
[/home/focht/projects/wine/wine.repo/src/programs/wineconsole/wineconsole.c:731]
in wineconsole (0x0033fd68)
  2 0x7ec94e77 WinMain+0x8c(hInst=<couldn't compute location>, hPrev=<couldn't
compute location>, lpCmdLine=<couldn't compute location>, nCmdShow=<couldn't
compute location>)
[/home/focht/projects/wine/wine.repo/src/programs/wineconsole/wineconsole.c:897]
in wineconsole (0x0033fde8)
  3 0x7ec953bb main+0xeb(argc=<couldn't compute location>, argv=<couldn't
compute location>)
[/home/focht/projects/wine/wine.repo/src/dlls/winecrt0/exe_main.c:49] in
wineconsole (0x0033fe68)
  4 0x7ec952b3 __wine_spec_exe_entry+0x56(peb=<couldn't compute location>)
[/home/focht/projects/wine/wine.repo/src/dlls/winecrt0/exe_entry.c:36] in
wineconsole (0x0033fea8)
  5 0x7b46d7f0 call_process_entry+0xb() in kernel32 (0x0033fec8)
  6 0x7b46d931 start_process+0x132(entry=<couldn't compute location>,
peb=<couldn't compute location>)
[/home/focht/projects/wine/wine.repo/src/dlls/kernel32/process.c:1099] in
kernel32 (0x0033ffd8)
  7 0x7b46d7fe start_process_wrapper+0x9() in kernel32 (0x0033ffec)
0x7ec93b8f WINECON_SetConfig+0x2a2
[/home/focht/projects/wine/wine.repo/src/programs/wineconsole/wineconsole.c:457]
in wineconsole: divl    %ebx,%eax
457                req->max_width  = (r.right - r.left) / cfg->cell_width;

Wine-dbg>p *cfg
{color_map={0, 0x800000, 0x8000, 0x808000, 0x80, 0x800080, 0x8080, 0xc0c0c0,
0x808080, 0xff0000, 0xff00, 0xffff00, 0xff, 0xff00ff, 0xffff, 0xffffff},
cell_width=0, cell_height=0x5, cursor_size=0x19, cursor_visible=0x1,
def_attr=0x7, popup_attr=0xf5, face_name={0x4c, 0x75, 0x63, 0x69, 0x64, 0x61,
0x20, 0x43, 0x6f, 0x6e, 0x73, 0x6f, 0x6c, 0x65, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0}, font_weight=0, history_size=0x32, history_nodup=0,
insert_mode=0x1, menu_mask=0, quick_edit=0, sb_width=0x94, sb_height=0x7ffe,
win_width=0x94, win_height=0x23, win_pos={X=0, Y=0}, exit_on_die=0x1,
edition_mode=0, registry="C:_Program Files_ConEmu_ConEmu_ConEmuC.exe"}

Wine-dbg>p *data
{curcfg={color_map={0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
cell_width=0x8, cell_height=0x10, cursor_size=0x64, cursor_visible=0x1,
def_attr=0xf, popup_attr=0, face_name={0x4c, 0x69, 0x62, 0x65, 0x72, 0x61,
0x74, 0x69, 0x6f, 0x6e, 0x20, 0x4d, 0x6f, 0x6e, 0x6f, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0}, font_weight=0x190, history_size=0x32,
history_nodup=0, insert_mode=0x1, menu_mask=0, quick_edit=0, sb_width=0x50,
sb_height=0x96, win_width=0x50, win_height=0x19, win_pos={X=0, Y=0},
exit_on_die=0, edition_mode=0, registry=0x0(nil)}, cells=0x13b108, cursor={X=0,
Y=0}, hConIn=0x1c, hConOut=0x24, hSynchro=0x20, hProcess=0x0(nil),
hWnd=0x10094, nCmdShow=0, in_set_config=0x1, in_grab_changes=0, dying=0,
fnMainLoop=0x7ec91ea3, fnPosCursor=0x7ec8ece3, fnShapeCursor=0x7ec8ed80,
fnComputePositions=0x7ec8f00f, fnRefresh=0x7ec90494,
fnResizeScreenBuffer=0x7ec8eccc, fnSetTitle=0x7ec8f241, fnScroll=0x7ec90671,
fnSetFont=0x7ec8fc22, fnDeleteBackend=0x7ec91da0, private=0x110a00}
--- snip ---

$ sha1sum ConEmuSetup.180409.exe 
5b8b0e78789027841f5312e132101408b292996c  ConEmuSetup.180409.exe

$ du -sh ConEmuSetup.180409.exe 
6.3M    ConEmuSetup.180409.exe

$ wine --version
wine-3.6

Regards

[Bug 44976] ConEmu-Maximus5 Windows console emulator causes crash of builtin ' wineconsole.exe' (division by zero)

https://bugs.winehq.org/show_bug.cgi?id=44976

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download
                URL|                            |https://github.com/Maximus5
                   |                            |/ConEmu/releases

[Bug 44976] ConEmu-Maximus5 Windows console emulator causes crash of builtin ' wineconsole.exe' (division by zero)

https://bugs.winehq.org/show_bug.cgi?id=44976

Fabian Maurer  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #1 from Fabian Maurer  ---
The program creates a config under HKEY_CURRENT_USER/Console, setting FontSize
to 0x50000. Wine reads that setting wrong.

wineconsole/registry.c
> count = sizeof(val);
> if (!RegQueryValueExW(hConKey, wszFontSize, 0, &type, (LPBYTE)&val, &count))
> {
>     cfg->cell_height = HIWORD(val);
>     cfg->cell_width  = LOWORD(val);
> }

cell_width end up being zero, and Wine take it as that. But that's not what's
supposed to happen, and it later divides by zero.

MSDN Page relevant to this issue:
https://technet.microsoft.com/en-us/library/cc978575.aspx
> A value of 0x0 is not a null value, but reflects the default window settings.

I'll send in a test and a fix later.

[Bug 44976] ConEmu-Maximus5 Windows console emulator causes crash of builtin ' wineconsole.exe' (division by zero)

https://bugs.winehq.org/show_bug.cgi?id=44976

--- Comment #2 from Fabian Maurer  ---
Sent in a patch: https://source.winehq.org/patches/data/144803

[Bug 44976] ConEmu-Maximus5 Windows console emulator causes crash of builtin ' wineconsole.exe' (division by zero)

https://bugs.winehq.org/show_bug.cgi?id=44976

tokktokk  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 44976] ConEmu-Maximus5 Windows console emulator causes crash of builtin ' wineconsole.exe' (division by zero)

https://bugs.winehq.org/show_bug.cgi?id=44976

Fabian Maurer  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
      Fixed by SHA1|                            |37654ceba8cf4bf2d654f94d51c
                   |                            |7551f9f52af5c
             Status|NEW                         |RESOLVED

--- Comment #3 from Fabian Maurer  ---
Fixed as of
https://source.winehq.org/git/wine.git/?a=commit;h=37654ceba8cf4bf2d654f94d5...

[Bug 44976] ConEmu-Maximus5 Windows console emulator causes crash of builtin ' wineconsole.exe' (division by zero)

https://bugs.winehq.org/show_bug.cgi?id=44976

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #4 from Alexandre Julliard  ---
Closing bugs fixed in 3.8.

[Bug 44976] ConEmu-Maximus5 Windows console emulator causes crash of builtin ' wineconsole.exe' (division by zero)

https://bugs.winehq.org/show_bug.cgi?id=44976

Michael Stefaniuc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |3.0.x

[Bug 44976] ConEmu-Maximus5 Windows console emulator causes crash of builtin ' wineconsole.exe' (division by zero)

https://bugs.winehq.org/show_bug.cgi?id=44976

Michael Stefaniuc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|3.0.x                       |---

--- Comment #5 from Michael Stefaniuc  ---
Removing the 3.0.x milestone from bugs included in 3.0.3.

[Bug 44976] ConEmu-Maximus5 Windows console emulator causes crash of builtin 'wineconsole.exe' (division by zero)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=44976

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|https://github.com/Maximus5 |https://web.archive.org/web
                   |/ConEmu/releases            |/20210726130402/https://git
                   |                            |hub.com/Maximus5/ConEmu/rel
                   |                            |eases/download/v18.04.09/Co
                   |                            |nEmuSetup.180409.exe