[Bug 46818] New: PS4 Remote Play 2.x (.NET 4.x app) crashes on Sign-In PlayStation network (mshtml: HTMLDocument_get_cookie should not fail for 'about:blank')

wine-bugs at winehq.org wine-bugs at winehq.org
Sun Mar 10 17:22:24 CDT 2019


https://bugs.winehq.org/show_bug.cgi?id=46818

            Bug ID: 46818
           Summary: PS4 Remote Play 2.x (.NET 4.x app) crashes on Sign-In
                    PlayStation network (mshtml:HTMLDocument_get_cookie
                    should not fail for 'about:blank')
           Product: Wine
           Version: 4.3
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mshtml
          Assignee: wine-bugs at winehq.org
          Reporter: focht at gmx.net
      Distribution: ---

Hello folks,

continuation of bug 46815

The app crashes when trying to sign-in via 'Settings' or 'Start'.

Prerequisite:

* 64-bit WINEPREFIX
* .NET Framework 4.6 ('winetricks -q dotnet46)
* Windows version set to 8.1 or higher

Install with Wine-Staging 4.3 or use patch from bug 46812

Work around bug 46809 (https://bugs.winehq.org/show_bug.cgi?id=46809#c2)
Work around bug 46815

--- snip ---
$ pwd
/home/focht/.wine/drive_c/Program Files (x86)/Sony/PS4 Remote Play

$ WINEDEBUG=+seh,+relay,+mshtml,+ieframe,+wininet,+ole,+variant wine
./RemotePlay.exe >>log.txt 2>&1
...
...
0036:trace:ieframe:WebBrowser_Navigate2 (0x8d0e020)->(0x33e620 {VT_BSTR:
L"about:blank"} 0x33e610 {VT_I4: 0} 0x33e600 {VT_EMPTY} 0x33e5f0 {VT_EMPTY}
0x33e5e0 {VT_EMPTY})
0036:trace:ieframe:navigate_url navigating to L"about:blank"
0036:fixme:ieframe:navigate_url Unsupported args (Flags 0x33e610 {VT_I4: 0};
TargetFrameName 0x33e600 {VT_EMPTY})
0036:warn:ieframe:navigate_url Invalid post data 0x33e5f0 {VT_EMPTY} 
...
0036:Call user32.CreateWindowExW(00000000,77a92020 L"Shell DocObject
View",77a92020 L"Shell DocObject
View",56010000,00000000,00000000,0000017c,00000258,000101ba,00000000,77a60000,08d0e0ec)
ret=77a6c63c 
...
0036:trace:mshtml:HTMLLocation_get_href (0x8f2d640)->(0x33e144)
...
0036:Call wininet.InternetCrackUrlW(08f5f46c
L"about:blank",00000000,00000000,0033e040) ret=6a59e098 
...
0036:Ret  KERNEL32.FlushInstructionCache() retval=00000001 ret=00b87968
0036:trace:mshtml:HTMLDocument_get_cookie (0x84940b0)->(0x33e170)
0036:Call KERNEL32.GetProcAddress(77920000,6a6ef3d2 "InternetGetCookieExW")
ret=6a642453
0036:Ret  KERNEL32.GetProcAddress() retval=77924954 ret=6a642453
0036:Call wininet.InternetGetCookieExW(08f5f46c
L"about:blank",00000000,00000000,0033e0ec,00000000,00000000) ret=6a558904
0036:trace:wininet:InternetGetCookieExW (L"about:blank", (null), (nil),
0x33e0ec, 0, (nil))
0036:trace:wininet:InternetCrackUrlW (L"about:blank" 0 0 0x33df94)
0036:trace:wininet:set_url_component (null) (0)
0036:trace:wininet:GetInternetSchemeW L"about" 5
0036:trace:wininet:set_url_component L"about" (5)
0036:trace:wininet:set_url_component (null) (0)
0036:trace:wininet:set_url_component (null) (0)
0036:trace:wininet:set_url_component (null) (0)
0036:trace:wininet:set_url_component L"blank" (5)
0036:trace:wininet:InternetCrackUrlW L"about:blank": scheme((null))
host((null)) path(L"blank") extra((null))
0036:Ret  wininet.InternetGetCookieExW() retval=00000000 ret=6a558904
0036:fixme:mshtml:HTMLDocument_get_cookie InternetGetCookieExW failed: 87
0036:Call KERNEL32.GetLastError() ret=00c0bc37
0036:Ret  KERNEL32.GetLastError() retval=00000057 ret=00c0bc37
...
0036:Call KERNEL32.RaiseException(e0434352,00000001,00000005,0033e038)
ret=00c9d135
0036:trace:seh:raise_exception code=e0434352 flags=1 addr=0x7b44c03b
ip=7b44c03b tid=0036
0036:trace:seh:raise_exception  info[0]=80070057
0036:trace:seh:raise_exception  info[1]=00000000
0036:trace:seh:raise_exception  info[2]=00000000
0036:trace:seh:raise_exception  info[3]=00000000
0036:trace:seh:raise_exception  info[4]=00b70000
0036:trace:seh:raise_exception  eax=7b43a48d ebx=00000005 ecx=00000000
edx=0033dfe8 esi=0033dfe8 edi=0033dfb0
0036:trace:seh:raise_exception  ebp=0033df88 esp=0033df24 cs=330023 ds=33002b
es=f7bd002b fs=f7bd0063 gs=f7bd006b flags=00200216
0036:trace:seh:call_vectored_handlers calling handler at 0xc95ce3 code=e0434352
flags=1
...
0036:trace:ieframe:DocObjectService_FireNavigateComplete2 got URL
L"about:blank" 
--- snip --- 

Managed backtrace via CLR debugger:

--- snip ---
(8b.8c): CLR exception - code e0434352 (first chance)
Exception object: 01961a58
Exception type:   System.ArgumentException
Message:          Value does not fall within the expected range.
InnerException:   <none>
StackTrace (generated):
<none>
StackTraceString: <none>
HResult: 80070057
OS Thread Id: 0x8c (0)
Child SP       IP Call Site
0032e12c 7b44c03b [HelperMethodFrame: 0032e12c] 
0032e1dc 05898b73 DomainBoundILStubClass.IL_STUB_CLRtoCOM()
0032e1e0 0be49f62 [InlinedCallFrame: 0032e1e0]
System.Windows.Forms.UnsafeNativeMethods+IHTMLDocument2.GetCookie()
0032e24c 0be49f62 RemoteplayUI.SignInOutWebView.?(System.Object,
System.EventArgs)
0032e268 05c15083 System.Windows.Forms.Form.OnShown(System.EventArgs)
0032e27c 0530ea41 System.Windows.Forms.Form.CallShownEvent()
0032e288 0530e9d6
System.Windows.Forms.Control.InvokeMarshaledCallbackDo(ThreadMethodEntry)
0032e2a4 0530e923
System.Windows.Forms.Control.InvokeMarshaledCallbackHelper(System.Object)
0032e2cc 79a963e4
System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext,
System.Threading.ContextCallback, System.Object, Boolean)
0032e338 79a96326
System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext,
System.Threading.ContextCallback, System.Object, Boolean)
0032e34c 79a962e1
System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext,
System.Threading.ContextCallback, System.Object)
0032e364 0530e8b9
System.Windows.Forms.Control.InvokeMarshaledCallback(ThreadMethodEntry)
0032e37c 0530e66f System.Windows.Forms.Control.InvokeMarshaledCallbacks()
0032e3b4 052fec75
System.Windows.Forms.Control.WndProc(System.Windows.Forms.Message ByRef)
...
--- snip --- 

Snippet of C# code to show the cookie string is being passed as part of
'additionalHeaders' args:

--- snip ---
    # .NET core Webbrowser
...
    public void Navigate(string urlString, string targetFrameName, byte[]
postData, string additionalHeaders)
    {
      this.PerformNavigateHelper(this.ReadyNavigateToUrl(urlString), false,
targetFrameName, postData, additionalHeaders);
    }
...
    # App code snippet
    private void \uE000(object _param1, EventArgs _param2)
    {
      this.\uE00C.Navigate(this.\uE008, (string) null, (byte[]) null,
\uE004.\uE000(5515) + this.\uE00C.Document.Cookie + \uE004.\uE000(5508));
    }
--- snip ---

The app uses 'WebBrowser.Document.Cookie' property in the 'Navigate' call.

Initially the webbrowser control sits at a blank document ("about:blank") by
design, not having navigated/initialized with external URI yet.

Wine source:

https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/mshtml/htmldoc.c#l855

--- snip ---
 855 static HRESULT WINAPI HTMLDocument_get_cookie(IHTMLDocument2 *iface, BSTR
*p)
 856 {
 857     HTMLDocument *This = impl_from_IHTMLDocument2(iface);
 858     DWORD size;
 859     BOOL bret;
 860 
 861     TRACE("(%p)->(%p)\n", This, p);
 862 
 863     size = 0;
 864     bret = InternetGetCookieExW(This->window->url, NULL, NULL, &size, 0,
NULL);
 865     if(!bret) {
 866         switch(GetLastError()) {
 867         case ERROR_INSUFFICIENT_BUFFER:
 868             break;
 869         case ERROR_NO_MORE_ITEMS:
 870             *p = NULL;
 871             return S_OK;
 872         default:
 873             FIXME("InternetGetCookieExW failed: %u\n", GetLastError());
 874             return HRESULT_FROM_WIN32(GetLastError());
 875         }
 876     }
 877 
 878     if(!size) {
 879         *p = NULL;
 880         return S_OK;
 881     }
 882 
 883     *p = SysAllocStringLen(NULL, size/sizeof(WCHAR)-1);
 884     if(!*p)
 885         return E_OUTOFMEMORY;
 886 
 887     bret = InternetGetCookieExW(This->window->url, NULL, *p, &size, 0,
NULL);
 888     if(!bret) {
 889         ERR("InternetGetCookieExW failed: %u\n", GetLastError());
 890         return E_FAIL;
 891     }
 892 
 893     return S_OK;
 894 }

--- snip ---

'wininet.InternetGetCookieExW("about:blank", ...)' failing with
ERROR_INVALID_PARAMETER is ok, there is even a test-case demonstrating that.

'mshtml.HTMLDocument_get_cookie' method should not fail for URI =
"about:blank".
Not failing gets the app further - only to run into next bug (jscript engine
crash).

--- snip ---
...
0035:trace:mshtml:HTMLDocument_get_cookie (0x7af03a8)->(0x33e170)
0035:Call KERNEL32.GetProcAddress(6a690000,6a4ef3d2 "InternetGetCookieExW")
ret=6a44246f
0035:Ret  KERNEL32.GetProcAddress() retval=6a698954 ret=6a44246f
0035:Call wininet.InternetGetCookieExW(092a0c2c
L"about:blank",00000000,00000000,0033e0ec,00000000,00000000) ret=6a358904
0035:trace:wininet:InternetGetCookieExW (L"about:blank", (null), (nil),
0x33e0ec, 0, (nil))
0035:trace:wininet:InternetCrackUrlW (L"about:blank" 0 0 0x33df94)
0035:trace:wininet:set_url_component (null) (0)
0035:trace:wininet:GetInternetSchemeW L"about" 5
0035:trace:wininet:set_url_component L"about" (5)
0035:trace:wininet:set_url_component (null) (0)
0035:trace:wininet:set_url_component (null) (0)
0035:trace:wininet:set_url_component (null) (0)
0035:trace:wininet:set_url_component L"blank" (5)
0035:trace:wininet:InternetCrackUrlW L"about:blank": scheme((null))
host((null)) path(L"blank") extra((null))
0035:Ret  wininet.InternetGetCookieExW() retval=00000000 ret=6a358904
...
0035:trace:ieframe:WebBrowser_Navigate2 (0x8f3fc08)->(0x33e0f4 {VT_BSTR:
L"https://auth.api.sonyentertainmentnetwork.com/2.0/oauth/authorize?service_entity=urn:service-entity:psn&response_type=code&client_id=ba495a24-818c-472b-b12d-ff231c1b5745&redirect
0x33e0e4 {VT_I4: 0} 0x33e0d4 {VT_EMPTY} 0x33e0c4 {VT_EMPTY} 0x33e0b4 {VT_BSTR:
L"Cookie: \r\n"})
0035:trace:ieframe:navigate_url navigating to
L"https://auth.api.sonyentertainmentnetwork.com/2.0/oauth/authorize?service_entity=urn:service-entity:psn&response_type=code&client_id=ba495a24-818c-472b-b12d-ff231c1b5745&redirect_uri=https://remoteplay.dl.playstation.net/remoteplay/redirect&scope=psn:clientapp&request_locale=en_US&ui=pr&service_logo="...
0035:fixme:ieframe:navigate_url Unsupported args (Flags 0x33e0e4 {VT_I4: 0};
TargetFrameName 0x33e0d4 {VT_EMPTY})
0035:warn:ieframe:navigate_url Invalid post data 0x33e0c4 {VT_EMPTY}
0035:trace:ieframe:navigate_url Headers: L"Cookie: \r\n"
...
0035:trace:ieframe:async_doc_navigate
L"https://auth.api.sonyentertainmentnetwork.com/2.0/oauth/authorize?service_entity=urn:service-entity:psn&response_type=code&...
...
0035:Call wininet.InternetConnectW(00000001,08ec3ee4
L"auth.api.sonyentertainmentnetwork.com",000001bb,08dafbd4 L"",08a7504c
L"",00000003,00800000,08a63be8) ret=776ec229 
...
0035:Call wininet.HttpOpenRequestW(00000002,777378ac L"GET",08a63ee4
L"/2.0/oauth/authorize?service_entity=urn:service-entity:psn&response_type=code&client_id=...&redirect_uri=https:/...,
(null), (null), 0x33daa4, 00c00000, 08a63be8)
0035:trace:wininet:HttpOpenRequestW     accept type: L"*/*"
0035:trace:wininet:WININET_AddRef 0x8a63ca0 -> refcount = 2
0035:trace:wininet:get_handle_object handle 2 -> 0x8a63ca0
0035:trace:wininet:HTTP_HttpOpenRequestW --> 
...
--- snip ---

$ sha1sum RemotePlayInstaller.exe 
d7e56a826e82689383687dfc63fe2a035b987604  RemotePlayInstaller.exe

$ du -sh RemotePlayInstaller.exe 
19M    RemotePlayInstaller.exe

$ wine --version
wine-4.3-229-g6d82b2f1ad

Regards

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.



More information about the wine-bugs mailing list