May 2025 - wine-gitlab

[PATCH v2 0/1] MR8141: gdiplus: Add check of type parameter to be positive (ASan).
by Bernhard Übelacker (＠bernhardu) 29 May '25

29 May '25

Function GdipGetImageAttributesAdjustedPalette gets [called with type = -1](https://gitlab.winehq.org/wine/wine/-/blob/22af42ac22279e6c0c671f033661f95c1761b4bb/dlls/gdiplus/tests/image.c?page=6#L5649) and therefore accesses several arrays at index -1. This patch adds a helper which additionally checks for `type >= ColorAdjustTypeDefault`. <details> <summary>ASan output</summary> ``` ================================================================= ==gdiplus_test.exe==308==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f21342c57f8 at pc 0x6ffffadfd25b bp 0x7ffffe1ff750 sp 0x7ffffe1ff798 READ of size 4 at 0x7f21342c57f8 thread T0 #0 0x6ffffadfd25a in apply_image_attributes .../dlls/gdiplus/graphics.c:929:41 #1 0x6ffffae5c2f2 in GdipGetImageAttributesAdjustedPalette .../dlls/gdiplus/imageattributes.c:123:5 #2 0x000140084b59 in test_getadjustedpalette .../dlls/gdiplus/tests/image.c:5649:12 #3 0x000140062be6 in func_image .../dlls/gdiplus/tests/image.c:6719:5 #4 0x0001400c9132 in run_test .../include/wine/test.h:765:5 #5 0x0001400c8b50 in main .../include/wine/test.h:884:12 #6 0x0001400cad3a in mainCRTStartup .../dlls/msvcrt/crt_main.c:60:11 #7 0x6fffffc45aa0 in BaseThreadInitThunk .../dlls/kernel32/thread.c:61:24 #8 0x6fffffdcc776 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17004c776) 0x7f21342c57f8 is located 144 bytes after 1256-byte region [0x7f21342c5280,0x7f21342c5768) freed by thread T0 here: #0 0x6ffffe88aab1 in free C:/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan\asan_malloc_win.cpp:71:3 #1 0x6ffffae5c21d in GdipDisposeImageAttributes .../dlls/gdiplus/imageattributes.c:109:5 #2 0x000140083598 in test_colorkey .../dlls/gdiplus/tests/image.c:3709:5 #3 0x000140062bd7 in func_image .../dlls/gdiplus/tests/image.c:6716:5 #4 0x0001400c9132 in run_test .../include/wine/test.h:765:5 #5 0x0001400c8b50 in main .../include/wine/test.h:884:12 #6 0x0001400cad3a in mainCRTStartup .../dlls/msvcrt/crt_main.c:60:11 #7 0x6fffffc45aa0 in BaseThreadInitThunk .../dlls/kernel32/thread.c:61:24 #8 0x6fffffdcc776 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17004c776) previously allocated by thread T0 here: #0 0x6ffffe88ace6 in calloc C:/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan\asan_malloc_win.cpp:91:3 #1 0x6ffffae5c0fc in GdipCreateImageAttributes .../dlls/gdiplus/imageattributes.c:87:18 #2 0x000140082bf9 in test_colorkey .../dlls/gdiplus/tests/image.c:3629:12 #3 0x000140062bd7 in func_image .../dlls/gdiplus/tests/image.c:6716:5 #4 0x0001400c9132 in run_test .../include/wine/test.h:765:5 #5 0x0001400c8b50 in main .../include/wine/test.h:884:12 #6 0x0001400cad3a in mainCRTStartup .../dlls/msvcrt/crt_main.c:60:11 #7 0x6fffffc45aa0 in BaseThreadInitThunk .../dlls/kernel32/thread.c:61:24 #8 0x6fffffdcc776 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x17004c776) SUMMARY: AddressSanitizer: heap-buffer-overflow .../dlls/gdiplus/graphics.c:929:41 in apply_image_attributes Shadow bytes around the buggy address: 0x7f21342c5500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7f21342c5580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7f21342c5600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7f21342c5680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7f21342c5700: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa =>0x7f21342c5780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa] 0x7f21342c5800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7f21342c5880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7f21342c5900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7f21342c5980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7f21342c5a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==gdiplus_test.exe==308==ABORTING ``` </details> -- v2: gdiplus: Add check of type parameter to be positive (ASan). https://gitlab.winehq.org/wine/wine/-/merge_requests/8141

3 4

[PATCH 0/2] MR8165: comctl32/listview: Fix lbutton item selection with Shift+Ctrl.
by Nikolay Sivov (＠nsivov) 29 May '25

29 May '25

Visual testing shows that using Shift+Ctrl adds to the selection, which is what existing code already does. The problem is that it updates selection mark when it shouldn't. And the bigger problem of course is that it's using static variable for state. Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com> -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8165

3 3

[PATCH v6 0/4] MR6783: winegstreamer: Fix memory/resource leaks in media sources.
by Conor McCarthy (＠cmccarthy) 29 May '25

29 May '25

Streams hold a reference to the source, but this reference should not be taken until `Start()` is called because freeing the media source depends on release in `Shutdown()` of the stream's reference to the source. We could create the streams in `media_source_create()` and take source refs for them in `Start()`, but that's potentially confusing and fragile. Streams can persist after the media source is destroyed. In that case, they cannot access the source object and it should be released and set to null. Windows behaviour is to release references to the source in `Shutdown()`. If we don't do this and a buggy app were to leak a stream object, the media source object would also leak and `wg_parser_destroy()` would not be called. -- v6: winegstreamer: Release stream references to the media source in Shutdown(). winegstreamer: Do not create MF stream objects until the media source is started. mfplat/tests: Test video stream release after media source release. mfplat/tests: Add more media source refcount checks. https://gitlab.winehq.org/wine/wine/-/merge_requests/6783

2 5

[PATCH 0/1] MR8173: xmllite/tests: Add more writer tests.
by Nikolay Sivov (＠nsivov) 29 May '25

29 May '25

Split up from !2928. Implementation to follow at a later time. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8173

2 2

[PATCH 0/1] MR8172: mfreadwrite: Fix stride in media type ouput.
by Brendan McGrath (＠redmcg) 29 May '25

29 May '25

This is required to fix video playback in Crashlands 2 on Proton 10. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8172

3 2

[PATCH v3 0/1] MR7360: mshtml: Try to guess the charset on streams with no BOM.
by Gabriel Ivăncescu (＠insn) 29 May '25

29 May '25

-- v3: mshtml: Try to guess the charset on streams with no BOM. https://gitlab.winehq.org/wine/wine/-/merge_requests/7360

3 4

[PATCH v6 0/2] MR4812: user32: Fix the number of characters processed by DrawTextExW.
by JiangYi Chen (＠meshine) 29 May '25

29 May '25

Description: When flags does not include DT_CALCRECT, since len is calculated in the middle, it will be reduced to zero. Resulting in the length of the processed string that is finally returned to zero and the non-processing string length is unchanged. But some application taking the non-processing string length to zero as the loop end condition. Log: Signed-off-by: chenjiangyi <chenjiangyi(a)uniontech.com> Change-Id: Icc0f250f5f4faba1bee8326fc911a4fc9cd7c012 -- v6: user32: Fix the number of characters processed by DrawTextExW. user32/tests: Add tests for DrawTextExW. https://gitlab.winehq.org/wine/wine/-/merge_requests/4812

3 5

[PATCH v5 0/4] MR8034: winegstreamer: Call wg_format_get_max_size() to get the video decoder output sample size.
by Conor McCarthy (＠cmccarthy) 29 May '25

29 May '25

Windows uses a smaller alignment than gstreamer for some formats, for example NV12. This means we cannot use MFCalculateImageSize() to get the output sample size. Commit 7b79e3a87b1e switched to calling it instead of GetOutputStreamInfo() to fix some game bugs. -- v5: winegstreamer: Call wg_format_get_max_size() to get the video decoder output sample size. winegstreamer: Do not pass a sample size to wg_transform_read_mf(). mf/tests: Add a video processor NV12 test with a width alignment of 2. mfplat/tests: Add NV12 650 x 850 to image_size_tests. https://gitlab.winehq.org/wine/wine/-/merge_requests/8034

2 4

[PATCH 0/1] MR8167: xmllite/tests: Fix out-of-bound read.
by Yuxuan Shui (＠yshui) 28 May '25

28 May '25

IXmlWriter doesn't write a NUL terminator into the stream, therefore formatting it with %s results in out-of-bound read. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8167

3 2

Re: [PATCH v2 0/3] MR8091: wined3d/spirv: Implement some extra shader parameters. - approved
by Alexandre Julliard (＠julliard) 28 May '25

28 May '25

This merge request was approved by Alexandre Julliard. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8091

1 0

2025

2024

2023

2022

wine-gitlab May 2025