DialogBoxIndirectParam Edit control LPDLGTEMPLATE with multi-line string crash.

[rallysjd70]

Wine 7.0, 7.1 running on Ubuntu 20.04 LTS, Acer laptop.
Default winecfg settings (Windows 10)

The Problem:
-------------------
I maintain a Win32 app set (an interpreted language with full Visual Studio [VS] source) that I've been porting to run with Wine as I move away from Windows. Most of the app set binaries work perfectly in Wine, which is both gratifying and impressive.

In one simple test app a call to DialogBoxIndirectParam is made to display an Edit Control with text of various lengths, read from an earlier function.

The second arg LPDLGTEMPLATE is dynamically assigned 64K and zero'd. Running on Windows 10 (32 and 64 bit), this creates the dialog box with no problems. Edit control multi-line text buffers of any size up to 64K can be created. Running the code in VS Debug mode shows no issues.

When running the app in Wine (7.0 and 7.1), the generated text buffer size has to be 362 chars or less, othewise Wine crashes, see below.

Putting some message boxes in the app and running Wine isolated the bug in the call to DialogBoxIndirectParam. The crash log (relevent portion, see below) also lists DialogBoxIndirectParam as a problem area.

My first theory was that the Wine DialogBoxIndirectParam code has some sort of buffer overrun issue. However, if this was the case, I would expect that any set of chars would crash at the same point, but they do not. Random chars or all spaces crash at different lengths.

Further tests over several days showed that increasing the Y-size and/or the X-size of the dialog Edit control allowed more text to be displayed before the crash occurs. None of this happens in Win 10. Why there is an interaction between the Edit control height / width and the length of the text buffer is unclear.

Adjusting the test app code to have the Edit control use a single string (i.e. not multi-line, but using multi-line cr-lf delimiters) does not have the crash issue. I can copy the string to the Wine clipboard, and paste it into a text editor and the multi-line data is correct.

Changing the line delimiter to <cr> from <cr-lf> still crashes.

If I reduce the multi-line text length to around 200, the dialog displays correctly, regardless of the Y and X size. This sort of bug is typical of a buffer overrun, but I have not spotted anywhere in the Wine code examined that might do this.

******* relevent extract from crash log ********
30 0x6ed2ce43 DIALOG_CreateControls32+0xcc3(unicode=<internal error>, hInst=<internal error>, dlgTemplate=<internal error>,template=<internal error>, hwnd=<internal error>) [Z:\usr\src\packages\BUILD\dlls\user32\dialog.c:274] in user32 (0x0032e778)

31 0x6ed2ce43 DIALOG_CreateIndirect+0xed3(hInst=<internal error>, dlgTemplate=<is not available>, owner=<is not available>, dlgProc=<is not available>, param=<is not available>, unicode=<is not available>, modal_owner=<is not available>) [Z:\usr\src\packages\BUILD\dlls\user32\dialog.c:616] in user32 (0x0032e778)

32 0x6ed2f8b9 DialogBoxIndirectParamAorW+0x39(hInstance=00400000, template=01437C30, owner=<is not available>, dlgProc=004100F0, param=0x1447c2e, flags=0x2) [Z:\usr\src\packages\BUILD\dlls\user32\dialog.c:881] in user32 (0x0032e798)

33 0x6ed2f921 DialogBoxIndirectParamA+0x41(hInstance=<internal error>, template=<internal error>, owner=<internal error>, dlgProc=<internal error>, param=<internal error>) [Z:\usr\src\packages\BUILD\dlls\user32\dialog.c:891] in user32 (0x0032e7d8)
***************

Looking at the Wine source dialog.c, the problem appears to be how the DLGTEMPLATE is decoded, when the text buffer type is BS_MULTILINE.
I don't see anything obvious that could be the cause.

I've looked at the MS Help on DialogBoxIndirectParam and triple checked the template for the required WORD and DWORD parameter boundaries. Changing these (in VS debug) results in dialog creation failure, as expected. Commenting out the DS_SETFONT handling code works in Win10, still crashes in Wine. Changing the DS_SETFONT size, with Edit control X and Y sizes unchanged, results in a different character count crash. This suggests an interaction between the font dot-matrix and the pixels available in the edit control.

Changing the dialog definition to LIST control from EDIT control does not have this crash issue. Text of any length can be displayed.

I'm not ruling out a very subtle bug in my app code, but surely I could also expect that VS Debug mode would pick anything up.

It sure looks like a bug in Wine. Any suggestions that might help locate the bug in more detail would be most appreciated.

I can make up a small file set and post on my website that demonstrates the bug if this is requested.
A blog post exists at https://pixcl.com/running-pixcl-under-ubuntu-wine/