[revisited] [OLE #31] Dynamically Allocate the MTA

[Dustin Navea]

> Vincent Béron wrote:
> > Le mar 11/01/2005 à 14:03, Robert Shearman a écrit :
> > > Changelog:
> > > - Make MTA dynamically allocated so that proxies and other resources

are
> > > freed at the proper time.
> > > - Changed/removed some incorrect comments regarding apartments.
> >
> > This patch broke wineprefixcreate invocation for me.
> >
> > What happens is I get a:
> > X Error of failed request:  BadWindow (invalid Window parameter)
> >  Major opcode of failed request:  18 (X_ChangeProperty)
> >  Resource id in failed request:  0x77e61740
> >  Serial number of failed request:  107
> >  Current serial number in output stream:  114
> > error while wineprefixcreate runs "wine rundll32.exe
> > setupapi.dll,InstallHinfSection DefaultInstall 128 wine.inf".
> >
> > The error do go away if one of avifil32.dll or devenum.dll is commented
> > out in [RegisterDllsSection] in wine.inf.
> >
> > My personal guess is that one (or both) of those dlls do something which
> > they should not, and we end up with using freed or unallocated memory.
>
> I don't see the problem on my machine. Do the tests in dlls/ole32/tests
> work for you?
> Is it possible to capture a +ole log for the wineprefixcreate >invocation?
> I'll do a review of the code paths that patch touches anyway, but I
> don't see how it could affect things - devenum does not use MTAs and
> avifil32 does not use COM.
>
> Rob

Apparently this is affecting more than 1 user (see bug 2398).  Was the 
cause (and a proper fix) ever found for this problem other than 
commenting out the necessary line?  The reporter of that bug was going 
to do a regression test, and the Jan release was the last official 
release that worked, so of course this problem affected him until he 
found that mail.  I assume so since we havent gotten any more reports of 
this, but I want to make sure, and find out when the problem was fixed.

Dustin

[Mike Hearn]

On Thu, 05 May 2005 16:44:24 -0500, Dustin Navea wrote:
> Apparently this is affecting more than 1 user (see bug 2398).  Was the 
> cause (and a proper fix) ever found for this problem other than 
> commenting out the necessary line?

Yes, I fixed it. It was heap arena corruption in Quartz.

thanks -mike

[Rob Shearman]

Dustin Navea wrote:
> > Vincent Béron wrote:
> > > Le mar 11/01/2005 à 14:03, Robert Shearman a écrit :
> > > > Changelog:
> > > > - Make MTA dynamically allocated so that proxies and other
>
> resources are
> > > > freed at the proper time.
> > > > - Changed/removed some incorrect comments regarding apartments.
> > >
> > > This patch broke wineprefixcreate invocation for me.
> > >
> > > What happens is I get a:
> > > X Error of failed request:  BadWindow (invalid Window parameter)
> > >  Major opcode of failed request:  18 (X_ChangeProperty)
> > >  Resource id in failed request:  0x77e61740
> > >  Serial number of failed request:  107
> > >  Current serial number in output stream:  114
> > > error while wineprefixcreate runs "wine rundll32.exe
> > > setupapi.dll,InstallHinfSection DefaultInstall 128 wine.inf".
> > >
> > > The error do go away if one of avifil32.dll or devenum.dll is commented
> > > out in [RegisterDllsSection] in wine.inf.
> > >
> > > My personal guess is that one (or both) of those dlls do something
>
> which
> > > they should not, and we end up with using freed or unallocated memory.
> >
> > I don't see the problem on my machine. Do the tests in dlls/ole32/tests
> > work for you?
> > Is it possible to capture a +ole log for the wineprefixcreate 
> > invocation?
> > I'll do a review of the code paths that patch touches anyway, but I
> > don't see how it could affect things - devenum does not use MTAs and
> > avifil32 does not use COM.
> >
> > Rob
>
> Apparently this is affecting more than 1 user (see bug 2398).  Was the 
> cause (and a proper fix) ever found for this problem other than 
> commenting out the necessary line?

The problem was a heap overrun in quartz. The bug was fixed. I haven't 
seen any more reports of this problem with cvs Wine.

Rob

[Dustin Navea]

Rob Shearman wrote:
> The problem was a heap overrun in quartz. The bug was fixed. I haven't 
> seen any more reports of this problem with cvs Wine.
>
> Rob

Ok, thanks.  He is having to use the jan copy to regression test.  Could 
you provide me a link to the cvs patch that fixed it so he can download 
it and apply it to the jan copy, since he is doing a regression test? 
That way he can have a proper test.

Thanks

Dustin

[Robert Shearman]

Dustin Navea wrote:
> Rob Shearman wrote:
> > The problem was a heap overrun in quartz. The bug was fixed. I 
> > haven't seen any more reports of this problem with cvs Wine.
>
> Ok, thanks.  He is having to use the jan copy to regression test.  
> Could you provide me a link to the cvs patch that fixed it so he can 
> download it and apply it to the jan copy, since he is doing a 
> regression test? That way he can have a proper test.

Mike Hearn 
Fix heap corruption in quartz server registration, add
some whitespace, break out of loop if out of memory

--- dlls/quartz/regsvr.c  (revision 109)
+++ dlls/quartz/regsvr.c  (local)
@@ -577,7 +577,6 @@ static HRESULT register_filters(struct r
     IFilterMapper2* pFM2 = NULL;

CoInitialize(NULL);
-    
     hr = CoCreateInstance(&CLSID_FilterMapper2, NULL, CLSCTX_INPROC_SERVER, &IID_IFilterMapper2, (LPVOID*)&pFM2);

if (SUCCEEDED(hr)) {
@@ -585,6 +584,7 @@ static HRESULT register_filters(struct r
        REGFILTER2 rf2;
        REGFILTERPINS2* prfp2;
        int i;
+
        for (i = 0; list->pins[i].flags != 0xFFFFFFFF; i++) ;
        rf2.dwVersion = 2;
        rf2.dwMerit = list->merit;
@@ -598,6 +598,7 @@ static HRESULT register_filters(struct r
    	REGPINTYPES* lpMediatype;
    	CLSID* lpClsid;
    	int j, nbmt;
+                
    	for (nbmt = 0; list->pins[i].mediatypes[nbmt].majortype; nbmt++) ;
    	/* Allocate a single buffer for regpintypes struct and clsids */
    	lpMediatype = (REGPINTYPES*) CoTaskMemAlloc(nbmt*(sizeof(REGPINTYPES) + 2*sizeof(CLSID)));
@@ -627,10 +628,17 @@ static HRESULT register_filters(struct r
    	prfp2[i].clsPinCategory = NULL;
        }

+	    if (FAILED(hr)) {
+		ERR("failed to register with hresult 0x%lx\n", hr);
+		break;
+	    }
+
        hr = IFilterMapper2_RegisterFilter(pFM2, list->clsid, list->name, NULL, list->category, NULL, &rf2);

-	    while (i--)
+	    while (i) {
    	CoTaskMemFree((REGPINTYPES*)prfp2[i-1].lpMediaType);
+		i--;
+	    }
        CoTaskMemFree(prfp2);
    }
     }