On Sun Aug 31 11:46:59 2025 +0000, Vibhav Pant wrote:
> Yes, I think `IPropertyValueStatics::CreateString` should use
> `WindowsDuplicateString`. Could you replace the code
> [here](https://gitlab.winehq.org/wine/wine/-/blob/1d1e5fb3e51b2acb0143e86c16…
> with
> ```c
> {
> HSTRING value;
> HRESULT hr;
> TRACE("iface %p, value %s, property_value %p.\n", iface,
> debugstr_hstring(value_str), property_value);
> *property_value = NULL;
> if (FAILED(hr = WindowsDuplicateString(value_str, &value))) return hr;
> create_primitive_property_value_iref(PropertyType_String,
> irefs.hstring_iface.lpVtbl, iref_hstring_vtbl);
> }
> ```
> and see if it resolves the issue? I'll create an MR in that case.
Thanks for looking into it. By replacing the body of property_value_statics_CreateString with above version (and renaming the parameter value to value_str) ASan stays silent and the test succeeds here.
--
https://gitlab.winehq.org/wine/wine/-/merge_requests/8831#note_114358
This fixes an access violation when clicking the button to browse for an installation directory in some installers using the BURIKO (BGI/Ethornell) engine. The affected applications call `SHBrowseForFolderA(&bi)` with `bi.pidlRoot` being 0x11, which causes wine to dereference 0x11 inside InitializeTreeView. On native, this opens the treeview from My Computer.
0x11 is the CSIDL value for My Computer, and passing any pidlRoot from 0 to 2^16 will not crash on native like resource IDs. If an invalid folder value is used then native returns 0 without showing a window. If I delete the My Pictures folder then use `CSIDL_MYPICTURES`, the folder gets recreated. None of this works if `BIF_NEWDIALOGSTYLE` is used, native crashes with access violation.
--
https://gitlab.winehq.org/wine/wine/-/merge_requests/8861
On Sun Aug 31 09:30:40 2025 +0000, Bernhard Übelacker wrote:
> @vibhavp, in my latest ASan run the vccorlib140:vccorlib tests shows up
> with a heap-use-after-free in WindowsGetStringRawBuffer in line 951. Is
> `str` supposed to be a new allocation after line 948?
> ```
> ==vccorlib140_test.exe==1096==ERROR: AddressSanitizer:
> heap-use-after-free on address 0x7f6707c03ba0 at pc 0x6ffffccb8d13 bp
> 0x7ffffe1ffa20 sp 0x7ffffe1ffa68
> READ of size 8 at 0x7f6707c03ba0 thread T0
> #0 0x6ffffccb8d12 in WindowsGetStringRawBuffer /home/benutzer/wine-asan-pe/wine/dlls/combase/string.c:277:25
> #1 0x000140004458 in test_CreateValue /home/benutzer/wine-asan-pe/wine/dlls/vccorlib140/tests/vccorlib.c:951:15
> 0x7f6707c03ba0 is located 16 bytes inside of 36-byte region [0x7f6707c03b90,0x7f6707c03bb4)
> freed by thread T0 here:
> #0 0x6ffffe86bb31 in free C:/llvm-project-main/compiler-rt/lib/asan/asan_malloc_win.cpp:71:3
> #1 0x6ffffccb8762 in WindowsDeleteString /home/benutzer/wine-asan-pe/wine/dlls/combase/string.c:154:9
> #2 0x00014000431c in test_CreateValue /home/benutzer/wine-asan-pe/wine/dlls/vccorlib140/tests/vccorlib.c:939:5
> previously allocated by thread T0 here:
> #0 0x6ffffe86bc41 in malloc C:/llvm-project-main/compiler-rt/lib/asan/asan_malloc_win.cpp:80:3
> #1 0x6ffffccb844b in alloc_string /home/benutzer/wine-asan-pe/wine/dlls/combase/string.c:69:12
> #2 0x6ffffccb825b in WindowsCreateString /home/benutzer/wine-asan-pe/wine/dlls/combase/string.c:103:10
> #3 0x0001400042c9 in test_CreateValue /home/benutzer/wine-asan-pe/wine/dlls/vccorlib140/tests/vccorlib.c:936:10
> ```
> [full ASan output](https://gitlab.winehq.org/bernhardu/wine/-/blob/asan-pe_2025-08-17_…
Yes, I think `IPropertyValueStatics::CreateString` should use `WindowsDuplicateString`. Could you replace the code [here](https://gitlab.winehq.org/wine/wine/-/blob/1d1e5fb3e51b2acb0143e86c16… with
```c
{
HSTRING value;
HRESULT hr;
TRACE("iface %p, value %s, property_value %p.\n", iface, debugstr_hstring(value_str), property_value);
*property_value = NULL;
if (FAILED(hr = WindowsDuplicateString(value_str, &value))) return hr;
create_primitive_property_value_iref(PropertyType_String, irefs.hstring_iface.lpVtbl, iref_hstring_vtbl);
}
```
and see if it resolves the issue? I'll create an MR in that case.
--
https://gitlab.winehq.org/wine/wine/-/merge_requests/8831#note_114348