[kmymoney4] [Bug 380119] Kbanking plugin crashes on opening aqbanking settings

[Ralf Habacker]

https://bugs.kde.org/show_bug.cgi?id=380119

Ralf Habacker <ralf.habacker at freenet.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #1 from Ralf Habacker <ralf.habacker at freenet.de> ---
For the record:

The crash happens on returning from  GWEN_Gui_ReadDialogPrefs. 

GWEN_Gui_ReadDialogPrefs:
   0x62d944d0 <+0>:     mov    0x62dbb1bc,%eax
   0x62d944d5 <+5>:     test   %eax,%eax
   0x62d944d7 <+7>:     je     0x62d94510 <GWEN_Gui_ReadDialogPrefs+64>
   0x62d944d9 <+9>:     mov    0x54(%eax),%edx
   0x62d944dc <+12>:    test   %edx,%edx
   0x62d944de <+14>:    je     0x62d94510 <GWEN_Gui_ReadDialogPrefs+64>
   0x62d944e0 <+16>:    sub    $0x1c,%esp
   0x62d944e3 <+19>:    mov    0x28(%esp),%ecx
   0x62d944e7 <+23>:    mov    %eax,(%esp)
   0x62d944ea <+26>:    mov    %ecx,0xc(%esp)
   0x62d944ee <+30>:    mov    0x24(%esp),%ecx
   0x62d944f2 <+34>:    mov    %ecx,0x8(%esp)
   0x62d944f6 <+38>:    mov    0x20(%esp),%ecx
   0x62d944fa <+42>:    mov    %ecx,0x4(%esp)
   0x62d944fe <+46>:    call   *%edx      --> calls AB_Gui_ReadDialogPrefs
   0x62d94500 <+48>:    sub    $0x10,%esp --> clean up stack of called function
indicates stdcall
   0x62d94503 <+51>:    add    $0x1c,%esp
   0x62d94506 <+54>:    ret               --> crash happens here
   0x62d94507 <+55>:    mov    %esi,%esi
   0x62d94509 <+57>:    lea    0x0(%edi,%eiz,1),%edi
   0x62d94510 <+64>:    mov    $0xffffffbd,%eax
   0x62d94515 <+69>:    ret

It turned out that the call back functions in gwenhywfar were declared with
stdcall (calling function cleans up the stack) while aqbanking is compiled with
cdecl (stack is cleaned up inside the called function). Therefore on  returning
from GWEN_Gui_ReadDialogPrefs the stack pointer points to a wrong address.

The fix is to remove stdcall from the call back function with the following
patch applied to the gwenhywfar package at
https://build.opensuse.org/package/show/home:rhabacker:branches:windows:mingw:win32:kmymoney/mingw32-gwenhywfar

--- a/src/gwenhywfarapi.h       2017-05-23 07:38:51.911107998 +0000
+++ b/src/gwenhywfarapi.h       2017-05-23 07:38:57.319127655 +0000
@@ -84,7 +84,7 @@
 #endif

 #if GWENHYWFAR_SYS_IS_WINDOWS
-# define GWENHYWFAR_CB __stdcall
+# define GWENHYWFAR_CB
 #else
 # define GWENHYWFAR_CB
 #endif

A recompile with the patch applied indeed shows that the call to "sub   
$0x10,%es" has been removed.

Dump of assembler code for function GWEN_Gui_ReadDialogPrefs:
   0x62d943a0 <+0>:     mov    0x62dbb1bc,%eax
   0x62d943a5 <+5>:     test   %eax,%eax
   0x62d943a7 <+7>:     je     0x62d943d4 <GWEN_Gui_ReadDialogPrefs+52>
   0x62d943a9 <+9>:     mov    0x54(%eax),%edx
   0x62d943ac <+12>:    test   %edx,%edx
   0x62d943ae <+14>:    je     0x62d943d4 <GWEN_Gui_ReadDialogPrefs+52>
   0x62d943b0 <+16>:    sub    $0x1c,%esp
   0x62d943b3 <+19>:    mov    0x28(%esp),%ecx
   0x62d943b7 <+23>:    mov    %eax,(%esp)
   0x62d943ba <+26>:    mov    %ecx,0xc(%esp)
   0x62d943be <+30>:    mov    0x24(%esp),%ecx
   0x62d943c2 <+34>:    mov    %ecx,0x8(%esp)
   0x62d943c6 <+38>:    mov    0x20(%esp),%ecx
   0x62d943ca <+42>:    mov    %ecx,0x4(%esp)
   0x62d943ce <+46>:    call   *%edx
   0x62d943d0 <+48>:    add    $0x1c,%esp
   0x62d943d3 <+51>:    ret
   0x62d943d4 <+52>:    mov    $0xffffffbd,%eax
   0x62d943d9 <+57>:    ret

-- 
You are receiving this mail because:
You are the assignee for the bug.