Uploaded image for project: 'Core ReactOS'
  1. Core ReactOS
  2. CORE-19953

SpotifyXP 2.0.3 Beta causes heap corruption at login

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 0.4.16
    • Shell
    • None
    • ReactOS 0.4.16-dev-372-g57637a9, Oracle VM VirtualBox 7.0.15.

    Description

      To reproduce the bug:

      1. Download unofficial Java 8 Update 152 here: https://archive.org/download/jre1.8.0_251_XP/jre1.8.0_251.zip.
      2. Open jre1.8.0_251.zip via an archiver and extract jre1.8.0_152 directory from it to C:\Program Files.
      3. Go to C:\Program Files\jre1.8.0_152\bin.
      4. Copy its path from the Explorer's address bar. It will be needed for the next step.
      5. Right click on My Computer -> Properties -> Additional -> Environment variables -> select Path environment variable -> Edit ->  Create -> paste previously copied path to Java executables.
      6. OK -> OK -> OK. The settings will be saved.
      7. Download the latest SpotifyXP 2.0.3 Beta nightly build from here: https://github.com/SpotifyXP/SpotifyXP/actions/runs/12428153848/artifacts/2347417976.
      8. Extract SpotifyXP.jar from Build.zip into C:\ for example.
      9. Open My Computer by double clicking -> right click on Local Disk C:\ -> Command Prompt. Now the Command Prompt will be opened in C:\.
      10. Enter "java -jar SpotifyXP.jar --setup-complete".
      11. Press Enter to execute the command. Now the Login dialog will open.
      12. Choose OAuth Login mentod by clicking on the 2nd button.

      After doing the last step, the following assert will appear:

      *** Assertion failed: RtlTestBit(&Heap->FreeHintBitmap, HintIndex)
      ***   Source File: /srv/buildbot/worker_data/Build_GCCLin_x86/build/sdk/lib/rtl/heap.c, line 448 

      After entering 'b' or 'o', it will hit this assert again one more time and then SpotifyXP process will terminate. But if to add /FIRSTCHANCE boot option for FreeLdr, it will also except with providing the following stacktrace:

      [?7hEip:
      <ntdll.dll:4897a>
      Frames:
      <ntdll.dll:28382>
      <ntdll.dll:2bb7a>
      <ntdll.dll:37c1e>
      <ntdll.dll:3825c>
      <ntdll.dll:382c1>
      <ntdll.dll:383f4>
      <ntdll.dll:396ae>
      <kernel32.dll:e3e5>
      <SHELL32.dll:889bc>
      <SHELL32.dll:8d989>
      <SHELL32.dll:8e3e3>
      <awt.dll:7d736>
      <00b6daa1>
      <00b647c4>
      <00b64864>
      <00b64899>
      <00b64864>
      <00b64864>
      <00b64899>
      <00b64864>
      --- Press q to abort, any other key to continue ---
      <00b64899>
      <00b647c4>
      <00b647c4>
      <00b647c4>
      <00b64864>
      <00b64899>
      <00b60697>
      <jvm.dll:15c720>
      <jvm.dll:228b69>
      <jvm.dll:15c7b9>
      <jvm.dll:15c941>
      <jvm.dll:15c9b2>
      <jvm.dll:1003da>
      <jvm.dll:17f93b>
      <jvm.dll:1801b5>
      <jvm.dll:1c6ea1>
      <msvcr100.dll:5c551>
      <msvcr100.dll:5c5fb>
      <kernel32.dll:1ca6f> 

      After this, some other backtraces can also be viewed. See SpotifyXP.log for the further details.

      According to raddr2line resulting output, <SHELL32.dll:889bc> points to the 2nd SearchPathW() call in SHELL_FindExecutable(): https://git.reactos.org/?p=reactos.git;a=blob;f=dll/win32/shell32/shlexec.cpp;h=68befd3292515b619dc892128cede17cb02fed05;hb=0bb830022c7a2bef814dc96a0311fcc66343389f#l791, which calls it from kernel32, to some part of which <kernel32.dll:e3e5> points.

      As it appears, this code seems to be outdated and is a replacement for the correct path handling code which uses PathResolveW() (which was hackish for a while, but now it's implemented properly starting from some 0.4.15-dev-xxxx commit). After importing the new path handling code from Wine 10.0-rc3: https://github.com/wine-mirror/wine/blob/872f5c59d4b24557241dd9e567b42da031860f2c/dlls/shell32/shlexec.c#L631, the mentioned heap corruption is completely gone and the Login works correctly: when clicking OAuth Login button, the browser opens and after authentification and closing the browser, it logins successfully and works perfectly.

      I already made a changes locally and will send a new PR soon.

      Attachments

        1. SpotifyXP.log
          1.19 MB
        2. shlexec-fix.patch
          3 kB
        3. shlexec-fix-02.patch
          3 kB

        Issue Links

          Activity

            People

              Oleg Dubinskij Oleg Dubinskiy
              Oleg Dubinskij Oleg Dubinskiy
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: