Release v5.12.1

.github/FUNDING.yml

@@ -1,13 +0,0 @@
-# These are supported funding model platforms
-
-#github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-#patreon: # Replace with a single Patreon username
-#open_collective: # Replace with a single Open Collective username
-#ko_fi: # Replace with a single Ko-fi username
-#tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-#community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-#liberapay: # Replace with a single Liberapay username
-#issuehunt: # Replace with a single IssueHunt username
-#otechie: # Replace with a single Otechie username
-
-patreon: winestaging

.github/workflows/macOS.yml

@@ -1,129 +0,0 @@
-name: MacOS
-
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-
-jobs:
-  wine-staging:
-    runs-on:  macos-latest
-
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Install dependencies
-        run: |
-          brew update
-          brew install --cask xquartz
-          brew install  bison \
-                        faudio \
-                        gphoto2 \
-                        gst-plugins-base \
-                        jxrlib \
-                        little-cms2 \
-                        mingw-w64 \
-                        molten-vk \
-                        mpg123
-
-      - name: Add bison & krb5 to $PATH
-        run: |
-          set -eu
-          echo "$(brew --prefix bison)/bin" >> $GITHUB_PATH
-          echo "$(brew --prefix krb5)/bin" >> $GITHUB_PATH
-
-      - name: Get upstream-commit
-        run: |
-          mkdir $GITHUB_WORKSPACE/wine
-          cd wine
-          git init
-          git fetch git://source.winehq.org/git/wine.git $($GITHUB_WORKSPACE/patches/patchinstall.sh --upstream-commit) --depth=1
-          git checkout $($GITHUB_WORKSPACE/patches/patchinstall.sh --upstream-commit)
-
-      - name: Run patchinstall.sh --all
-        run: |
-          $GITHUB_WORKSPACE/patches/patchinstall.sh DESTDIR=$GITHUB_WORKSPACE/wine --all
-
-      - name: Configure wine64
-        env:
-          LDFLAGS: "-Wl,-rpath,/opt/X11/lib"
-          # Avoid weird linker errors with Xcode 10 and later
-          MACOSX_DEPLOYMENT_TARGET: "10.14"
-        run: |
-          cd $GITHUB_WORKSPACE/wine
-          ./configure   --enable-win64 \
-                        --without-alsa \
-                        --without-capi \
-                        --without-dbus \
-                        --without-inotify \
-                        --without-oss \
-                        --without-pulse \
-                        --without-udev \
-                        --without-v4l2 \
-                        --x-include=/opt/X11/include \
-                        --x-lib=/opt/X11/lib
-
-      - name: Build wine64
-        run: |
-          cd $GITHUB_WORKSPACE/wine
-          make -j$(sysctl -n hw.ncpu 2>/dev/null)
-
-  wine-devel:
-    runs-on:  macos-latest
-
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Install dependencies
-        run: |
-          brew update
-          brew install --cask xquartz
-          brew install  bison \
-                        faudio \
-                        gphoto2 \
-                        gst-plugins-base \
-                        jxrlib \
-                        little-cms2 \
-                        mingw-w64 \
-                        molten-vk \
-                        mpg123
-
-      - name: Add bison & krb5 to $PATH
-        run: |
-          set -eu
-          echo "$(brew --prefix bison)/bin" >> $GITHUB_PATH
-          echo "$(brew --prefix krb5)/bin" >> $GITHUB_PATH
-
-      - name: Get upstream-commit
-        run: |
-          mkdir $GITHUB_WORKSPACE/wine
-          cd wine
-          git init
-          git fetch git://source.winehq.org/git/wine.git $($GITHUB_WORKSPACE/patches/patchinstall.sh --upstream-commit) --depth=1
-          git checkout $($GITHUB_WORKSPACE/patches/patchinstall.sh --upstream-commit)
-
-      - name: Configure wine64
-        env:
-          LDFLAGS: "-Wl,-rpath,/opt/X11/lib"
-          # Avoid weird linker errors with Xcode 10 and later
-          MACOSX_DEPLOYMENT_TARGET: "10.14"
-        run: |
-          cd $GITHUB_WORKSPACE/wine
-
-          cd $GITHUB_WORKSPACE/wine
-          ./configure   --enable-win64 \
-                        --without-alsa \
-                        --without-capi \
-                        --without-dbus \
-                        --without-inotify \
-                        --without-oss \
-                        --without-pulse \
-                        --without-udev \
-                        --without-v4l2 \
-                        --x-include=/opt/X11/include \
-                        --x-lib=/opt/X11/lib
-
-      - name: Build wine64
-        run: |
-          cd $GITHUB_WORKSPACE/wine
-          make -j$(sysctl -n hw.ncpu 2>/dev/null)

README.md

@@ -79,32 +79,4 @@ Contributing
 
 For information on contributing to Wine-Staging, please see
 <https://wiki.winehq.org/Wine-Staging_Contributing>. Note that GitHub pull
-requests are strongly dispreferred, especially for patches.
-
-Donations
----------
-
-wine-staging is a large set of experimental patches which provide various
-improvements to WINE, but are not quite suitable for upstreaming. This set of
-patches has been continuously managed for many years by a small group of
-volunteers. The way this works is that we often review patches attached to
-various bug reports found at https://bugs.winehq.org/ which may fix bugs, but
-may not be quite suitable to be upstreamed due to needing some cleanup or more
-proper implementation. In the event that this happens, we add the patches to
-wine-staging instead, and keep them updated and maintained as well as attempt to
-clean them up to be upstreamed. We also both write and verify patches which fix
-various bugs that may not have patches, and in turn allow them run better using
-WINE. This includes testing on various hardware, games, and applications.
-
-Any expenses for applications, games, or hardware which we do not own comes out
-of pocket. In order to alleviate these expenses, we are now accepting donations.
-This in turn allows us to continue to perform testing, provide fixes, and get
-them upstreamed, ultimately aiming to provide a better experience for all WINE
-users. All of our work is provided publicly for free and can be found at
-<https://github.com/wine-staging/wine-staging>. We do not expect to be paid for
-any of the work provided, nor will donators receive any special benefits or
-compensation.
-
-Donations are recieved through Patreon. Anyone interested may donate here:
-
-https://www.patreon.com/winestaging
+requests are strongly dispreferred, especially for patches.

patches/Compiler_Warnings/0026-dwrite-Avoid-implicit-cast-of-interface-pointer.patch

@@ -1,17 +1,18 @@
-From 7e3c4d732bacaeaf37ab8f32a7548715825eff4d Mon Sep 17 00:00:00 2001
+From 7529755fcc41fda650aac6b27f34438354435d34 Mon Sep 17 00:00:00 2001
 From: Sebastian Lackner <sebastian@fds-team.de>
 Date: Tue, 22 Mar 2016 21:58:40 +0100
 Subject: [PATCH] dwrite: Avoid implicit cast of interface pointer.
 
 ---
- dlls/dwrite/font.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
+ dlls/dwrite/font.c   | 4 ++--
+ dlls/dwrite/layout.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/dlls/dwrite/font.c b/dlls/dwrite/font.c
-index 2296c74c1e3..2b5e18aab19 100644
+index 9280b5d32..2f0974a4c 100644
 --- a/dlls/dwrite/font.c
 +++ b/dlls/dwrite/font.c
-@@ -2514,7 +2514,7 @@ static struct dwrite_font *unsafe_impl_from_IDWriteFont(IDWriteFont *iface)
+@@ -1887,7 +1887,7 @@ static struct dwrite_font *unsafe_impl_from_IDWriteFont(IDWriteFont *iface)
      if (!iface)
          return NULL;
      assert(iface->lpVtbl == (IDWriteFontVtbl*)&dwritefontvtbl);
@@ -20,7 +21,7 @@ index 2296c74c1e3..2b5e18aab19 100644
  }
  
  struct dwrite_fontface *unsafe_impl_from_IDWriteFontFace(IDWriteFontFace *iface)
-@@ -2522,7 +2522,7 @@ struct dwrite_fontface *unsafe_impl_from_IDWriteFontFace(IDWriteFontFace *iface)
+@@ -1895,7 +1895,7 @@ struct dwrite_fontface *unsafe_impl_from_IDWriteFontFace(IDWriteFontFace *iface)
      if (!iface)
          return NULL;
      assert(iface->lpVtbl == (IDWriteFontFaceVtbl*)&dwritefontfacevtbl);
@@ -29,6 +30,19 @@ index 2296c74c1e3..2b5e18aab19 100644
  }
  
  static struct dwrite_fontfacereference *unsafe_impl_from_IDWriteFontFaceReference(IDWriteFontFaceReference *iface)
+diff --git a/dlls/dwrite/layout.c b/dlls/dwrite/layout.c
+index b9321157a..76ea23ba6 100644
+--- a/dlls/dwrite/layout.c
++++ b/dlls/dwrite/layout.c
+@@ -5895,7 +5895,7 @@ static const IDWriteTextFormat3Vtbl dwritetextformatvtbl =
+ static struct dwrite_textformat *unsafe_impl_from_IDWriteTextFormat(IDWriteTextFormat *iface)
+ {
+     return (iface->lpVtbl == (IDWriteTextFormatVtbl*)&dwritetextformatvtbl) ?
+-        CONTAINING_RECORD(iface, struct dwrite_textformat, IDWriteTextFormat3_iface) : NULL;
++        CONTAINING_RECORD((IDWriteTextFormat3 *)iface, struct dwrite_textformat, IDWriteTextFormat3_iface) : NULL;
+ }
+ 
+ HRESULT create_textformat(const WCHAR *family_name, IDWriteFontCollection *collection, DWRITE_FONT_WEIGHT weight, DWRITE_FONT_STYLE style,
 -- 
-2.34.1
+2.24.0
 

patches/Compiler_Warnings/0031-include-Check-element-type-in-CONTAINING_RECORD-and-.patch

@@ -1,4 +1,4 @@
-From bd6e11aee0fbe2f880f87bec8b3d145b3de15dab Mon Sep 17 00:00:00 2001
+From a349cc8bdcc3a083ea507dbbdeba9053e3a338e4 Mon Sep 17 00:00:00 2001
 From: Sebastian Lackner <sebastian@fds-team.de>
 Date: Tue, 22 Mar 2016 23:08:30 +0100
 Subject: [PATCH] include: Check element type in CONTAINING_RECORD and similar
@@ -31,31 +31,31 @@ index b4d681fe0f3..287ad394fae 100644
  
  #endif  /* __WINE_SERVER_LIST_H */
 diff --git a/include/wine/rbtree.h b/include/wine/rbtree.h
-index 4e86f3cfb84..694dc039cb1 100644
+index 8aae29c8c10..330b3e8fbc9 100644
 --- a/include/wine/rbtree.h
 +++ b/include/wine/rbtree.h
 @@ -23,8 +23,14 @@
  #ifndef __WINE_WINE_RBTREE_H
  #define __WINE_WINE_RBTREE_H
  
--#define RB_ENTRY_VALUE(element, type, field) \
+-#define WINE_RB_ENTRY_VALUE(element, type, field) \
 -    ((type *)((char *)(element) - offsetof(type, field)))
 +#ifdef __GNUC__
-+# define RB_ENTRY_VALUE(element, type, field) ({       \
++# define WINE_RB_ENTRY_VALUE(element, type, field) ({       \
 +     const typeof(((type *)0)->field) *__ptr = (element);   \
 +     (type *)((char *)__ptr - offsetof(type, field)); })
 +#else
-+# define RB_ENTRY_VALUE(element, type, field) \
++# define WINE_RB_ENTRY_VALUE(element, type, field) \
 +     ((type *)((char *)(element) - offsetof(type, field)))
 +#endif
  
- struct rb_entry
+ struct wine_rb_entry
  {
 diff --git a/include/winnt.h b/include/winnt.h
-index 9296a3dc555..c7406b8db39 100644
+index 46e17c546a7..d5c65d2017b 100644
 --- a/include/winnt.h
 +++ b/include/winnt.h
-@@ -840,8 +840,14 @@ typedef struct _WIN32_MEMORY_RANGE_ENTRY
+@@ -793,8 +793,14 @@ typedef struct _MEMORY_BASIC_INFORMATION
  #define RTL_FIELD_SIZE(type, field) (sizeof(((type *)0)->field))
  #define RTL_SIZEOF_THROUGH_FIELD(type, field) (FIELD_OFFSET(type, field) + RTL_FIELD_SIZE(type, field))
  
@@ -73,5 +73,5 @@ index 9296a3dc555..c7406b8db39 100644
  #define ARRAYSIZE(x) (sizeof(x) / sizeof((x)[0]))
  #ifdef __WINESRC__
 -- 
-2.34.1
+2.26.2
 

patches/Compiler_Warnings/0033-ntdll-Avoid-implicit-cast-of-interface-pointer.patch

@@ -1,34 +0,0 @@
-From 5be4173b6c3e89b1d9267679cd392a7343088a52 Mon Sep 17 00:00:00 2001
-From: Alistair Leslie-Hughes <leslie_alistair@hotmail.com>
-Date: Tue, 8 Jun 2021 09:10:37 +1000
-Subject: [PATCH] ntdll: Avoid implicit cast of interface pointer.
-
----
- dlls/ntdll/unix/virtual.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/dlls/ntdll/unix/virtual.c b/dlls/ntdll/unix/virtual.c
-index 34b332a613c..111c851b43b 100644
---- a/dlls/ntdll/unix/virtual.c
-+++ b/dlls/ntdll/unix/virtual.c
-@@ -3016,7 +3016,7 @@ NTSTATUS virtual_clear_tls_index( ULONG index )
-         server_enter_uninterrupted_section( &virtual_mutex, &sigset );
-         LIST_FOR_EACH_ENTRY( thread_data, &teb_list, struct ntdll_thread_data, entry )
-         {
--            TEB *teb = CONTAINING_RECORD( thread_data, TEB, GdiTebBatch );
-+            TEB *teb = CONTAINING_RECORD( (GDI_TEB_BATCH *)thread_data, TEB, GdiTebBatch );
- #ifdef _WIN64
-             WOW_TEB *wow_teb = get_wow_teb( teb );
-             if (wow_teb) wow_teb->TlsSlots[index] = 0;
-@@ -3034,7 +3034,7 @@ NTSTATUS virtual_clear_tls_index( ULONG index )
-         server_enter_uninterrupted_section( &virtual_mutex, &sigset );
-         LIST_FOR_EACH_ENTRY( thread_data, &teb_list, struct ntdll_thread_data, entry )
-         {
--            TEB *teb = CONTAINING_RECORD( thread_data, TEB, GdiTebBatch );
-+            TEB *teb = CONTAINING_RECORD( (GDI_TEB_BATCH *)thread_data, TEB, GdiTebBatch );
- #ifdef _WIN64
-             WOW_TEB *wow_teb = get_wow_teb( teb );
-             if (wow_teb)
--- 
-2.30.2
-

patches/Compiler_Warnings/0034-bcrypt-Stop-compile-error-when-HAVE_GNUTLS_CIPHER_IN.patch

@@ -1,40 +0,0 @@
-From eb21fcc668da85977bc86b6105f3830cb26c93e6 Mon Sep 17 00:00:00 2001
-From: Alistair Leslie-Hughes <leslie_alistair@hotmail.com>
-Date: Tue, 8 Jun 2021 08:56:40 +1000
-Subject: [PATCH] bcrypt: Stop compile error when HAVE_GNUTLS_CIPHER_INIT not
- defined
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-In file included from dlls/bcrypt/gnutls.c:1916:
-include/windef.h:112:24: error: unknown type name ‘va_list’
-  112 | #  define __ms_va_list va_list
-      |                        ^~~~~~~
-include/winbase.h:2076:84: note: in expansion of macro ‘__ms_va_list’
- 2076 | WINBASEAPI DWORD       WINAPI FormatMessageA(DWORD,LPCVOID,DWORD,DWORD,LPSTR,DWORD,__ms_va_list*);
-
-Signed-off-by: Alistair Leslie-Hughes <leslie_alistair@hotmail.com>
----
- dlls/bcrypt/gnutls.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/dlls/bcrypt/gnutls.c b/dlls/bcrypt/gnutls.c
-index d7b4499c692..11596d5f7ac 100644
---- a/dlls/bcrypt/gnutls.c
-+++ b/dlls/bcrypt/gnutls.c
-@@ -24,9 +24,10 @@
- 
- #include "config.h"
- 
-+#include <stdarg.h>
-+
- #ifdef HAVE_GNUTLS_CIPHER_INIT
- 
--#include <stdarg.h>
- #include <stdlib.h>
- #include <assert.h>
- #include <sys/types.h>
--- 
-2.33.0
-

patches/Compiler_Warnings/0035-d3d10-Avoid-implicit-cast-of-interface-pointer.patch

@@ -1,61 +0,0 @@
-From 34109c1adac6293a87db004d60d342faeb33fcfe Mon Sep 17 00:00:00 2001
-From: Alistair Leslie-Hughes <leslie_alistair@hotmail.com>
-Date: Tue, 8 Jun 2021 09:34:28 +1000
-Subject: [PATCH] d3d10: Avoid implicit cast of interface pointer.
-
----
- dlls/d3d10/effect.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/dlls/d3d10/effect.c b/dlls/d3d10/effect.c
-index 3b4050460a0..b03ed2d6c89 100644
---- a/dlls/d3d10/effect.c
-+++ b/dlls/d3d10/effect.c
-@@ -147,7 +147,7 @@ static inline struct d3d10_effect_variable *impl_from_ID3D10EffectVariable(ID3D1
- 
- static inline struct d3d10_effect_variable *impl_from_ID3D10EffectShaderVariable(ID3D10EffectShaderVariable *iface)
- {
--    return CONTAINING_RECORD(iface, struct d3d10_effect_variable, ID3D10EffectVariable_iface);
-+    return CONTAINING_RECORD((ID3D10EffectVariable*)iface, struct d3d10_effect_variable, ID3D10EffectVariable_iface);
- }
- 
- static struct d3d10_effect_variable * d3d10_array_get_element(struct d3d10_effect_variable *v,
-@@ -4876,7 +4876,7 @@ static void read_variable_array_from_buffer(struct d3d10_effect_variable *variab
- 
- static inline struct d3d10_effect_variable *impl_from_ID3D10EffectScalarVariable(ID3D10EffectScalarVariable *iface)
- {
--    return CONTAINING_RECORD(iface, struct d3d10_effect_variable, ID3D10EffectVariable_iface);
-+    return CONTAINING_RECORD((ID3D10EffectVariable*)iface, struct d3d10_effect_variable, ID3D10EffectVariable_iface);
- }
- 
- static BOOL STDMETHODCALLTYPE d3d10_effect_scalar_variable_IsValid(ID3D10EffectScalarVariable *iface)
-@@ -5212,7 +5212,7 @@ static const struct ID3D10EffectScalarVariableVtbl d3d10_effect_scalar_variable_
- 
- static inline struct d3d10_effect_variable *impl_from_ID3D10EffectVectorVariable(ID3D10EffectVectorVariable *iface)
- {
--    return CONTAINING_RECORD(iface, struct d3d10_effect_variable, ID3D10EffectVariable_iface);
-+    return CONTAINING_RECORD((ID3D10EffectVariable*)iface, struct d3d10_effect_variable, ID3D10EffectVariable_iface);
- }
- 
- static BOOL STDMETHODCALLTYPE d3d10_effect_vector_variable_IsValid(ID3D10EffectVectorVariable *iface)
-@@ -5699,7 +5699,7 @@ static void read_matrix_variable_array_from_buffer(struct d3d10_effect_variable
- 
- static inline struct d3d10_effect_variable *impl_from_ID3D10EffectMatrixVariable(ID3D10EffectMatrixVariable *iface)
- {
--    return CONTAINING_RECORD(iface, struct d3d10_effect_variable, ID3D10EffectVariable_iface);
-+    return CONTAINING_RECORD((ID3D10EffectVariable*)iface, struct d3d10_effect_variable, ID3D10EffectVariable_iface);
- }
- 
- static BOOL STDMETHODCALLTYPE d3d10_effect_matrix_variable_IsValid(ID3D10EffectMatrixVariable *iface)
-@@ -6222,7 +6222,7 @@ static void set_shader_resource_variable(ID3D10ShaderResourceView **src, ID3D10S
- static inline struct d3d10_effect_variable *impl_from_ID3D10EffectShaderResourceVariable(
-         ID3D10EffectShaderResourceVariable *iface)
- {
--    return CONTAINING_RECORD(iface, struct d3d10_effect_variable, ID3D10EffectVariable_iface);
-+    return CONTAINING_RECORD((ID3D10EffectVariable*)iface, struct d3d10_effect_variable, ID3D10EffectVariable_iface);
- }
- 
- static BOOL STDMETHODCALLTYPE d3d10_effect_shader_resource_variable_IsValid(ID3D10EffectShaderResourceVariable *iface)
--- 
-2.33.0
-

patches/Compiler_Warnings/0036-d2d1-Avoid-implicit-cast-of-interface-pointer.patch

@@ -1,34 +0,0 @@
-From dd8e8e98edf2f16a4fd4109cd283cf7949a3cb9b Mon Sep 17 00:00:00 2001
-From: Alistair Leslie-Hughes <leslie_alistair@hotmail.com>
-Date: Tue, 8 Jun 2021 09:39:56 +1000
-Subject: [PATCH] d2d1: Avoid implicit cast of interface pointer.
-
----
- dlls/d2d1/geometry.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/dlls/d2d1/geometry.c b/dlls/d2d1/geometry.c
-index eb353669030..3e00edfd1b3 100644
---- a/dlls/d2d1/geometry.c
-+++ b/dlls/d2d1/geometry.c
-@@ -3615,7 +3615,7 @@ void d2d_path_geometry_init(struct d2d_geometry *geometry, ID2D1Factory *factory
- 
- static inline struct d2d_geometry *impl_from_ID2D1EllipseGeometry(ID2D1EllipseGeometry *iface)
- {
--    return CONTAINING_RECORD(iface, struct d2d_geometry, ID2D1Geometry_iface);
-+    return CONTAINING_RECORD((ID2D1Geometry*)iface, struct d2d_geometry, ID2D1Geometry_iface);
- }
- 
- static HRESULT STDMETHODCALLTYPE d2d_ellipse_geometry_QueryInterface(ID2D1EllipseGeometry *iface,
-@@ -4237,7 +4237,7 @@ fail:
- 
- static inline struct d2d_geometry *impl_from_ID2D1RoundedRectangleGeometry(ID2D1RoundedRectangleGeometry *iface)
- {
--    return CONTAINING_RECORD(iface, struct d2d_geometry, ID2D1Geometry_iface);
-+    return CONTAINING_RECORD((ID2D1Geometry*)iface, struct d2d_geometry, ID2D1Geometry_iface);
- }
- 
- static HRESULT STDMETHODCALLTYPE d2d_rounded_rectangle_geometry_QueryInterface(ID2D1RoundedRectangleGeometry *iface,
--- 
-2.30.2
-

patches/Compiler_Warnings/0037-dxgi-Avoid-implicit-cast-of-interface-pointer.patch

@@ -1,25 +0,0 @@
-From f8ce184f72c416a1ce249afe313b698013e961b3 Mon Sep 17 00:00:00 2001
-From: Alistair Leslie-Hughes <leslie_alistair@hotmail.com>
-Date: Tue, 8 Jun 2021 09:46:25 +1000
-Subject: [PATCH] dxgi: Avoid implicit cast of interface pointer.
-
----
- dlls/dxgi/output.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/dlls/dxgi/output.c b/dlls/dxgi/output.c
-index f341388766c..64f87202741 100644
---- a/dlls/dxgi/output.c
-+++ b/dlls/dxgi/output.c
-@@ -711,7 +711,7 @@ struct dxgi_output *unsafe_impl_from_IDXGIOutput(IDXGIOutput *iface)
-     if (!iface)
-         return NULL;
-     assert(iface->lpVtbl == (IDXGIOutputVtbl *)&dxgi_output_vtbl);
--    return CONTAINING_RECORD(iface, struct dxgi_output, IDXGIOutput6_iface);
-+    return CONTAINING_RECORD((IDXGIOutput6*)iface, struct dxgi_output, IDXGIOutput6_iface);
- }
- 
- static void dxgi_output_init(struct dxgi_output *output, unsigned int output_idx,
--- 
-2.30.2
-

patches/Compiler_Warnings/0038-msctf-Avoid-implicit-cast-of-interface-pointer.patch

@@ -1,25 +0,0 @@
-From 272753daf4f20b7fe3c646eae4fd78f1b254c9a6 Mon Sep 17 00:00:00 2001
-From: Alistair Leslie-Hughes <leslie_alistair@hotmail.com>
-Date: Tue, 8 Jun 2021 09:57:01 +1000
-Subject: [PATCH] msctf: Avoid implicit cast of interface pointer.
-
----
- dlls/msctf/range.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/dlls/msctf/range.c b/dlls/msctf/range.c
-index 9690a0a15c4..e15123eeb89 100644
---- a/dlls/msctf/range.c
-+++ b/dlls/msctf/range.c
-@@ -54,7 +54,7 @@ static inline Range *impl_from_ITfRangeACP(ITfRangeACP *iface)
- 
- static Range *unsafe_impl_from_ITfRange(ITfRange *iface)
- {
--    return CONTAINING_RECORD(iface, Range, ITfRangeACP_iface);
-+    return CONTAINING_RECORD((ITfRangeACP*)iface, Range, ITfRangeACP_iface);
- }
- 
- static void Range_Destructor(Range *This)
--- 
-2.30.2
-

patches/Compiler_Warnings/0039-rpcrt4-Avoid-implicit-cast-of-interface-pointer.patch

@@ -1,39 +0,0 @@
-From f34ee38467781b2f7bae7e7f8a04a4210bf7d046 Mon Sep 17 00:00:00 2001
-From: Alistair Leslie-Hughes <leslie_alistair@hotmail.com>
-Date: Tue, 8 Jun 2021 11:22:48 +1000
-Subject: [PATCH] rpcrt4: Avoid implicit cast of interface pointer.
-
----
- dlls/rpcrt4/ndr_marshall.c | 2 +-
- dlls/rpcrt4/ndr_typelib.c  | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/dlls/rpcrt4/ndr_marshall.c b/dlls/rpcrt4/ndr_marshall.c
-index 764b304a047..58ea128e8a4 100644
---- a/dlls/rpcrt4/ndr_marshall.c
-+++ b/dlls/rpcrt4/ndr_marshall.c
-@@ -6999,7 +6999,7 @@ static unsigned char *WINAPI NdrContextHandleMarshall(
-     }
-     else
-     {
--        NDR_SCONTEXT ctxt = CONTAINING_RECORD(pMemory, struct _NDR_SCONTEXT, userContext);
-+        NDR_SCONTEXT ctxt = CONTAINING_RECORD((void * const*)pMemory, struct _NDR_SCONTEXT, userContext);
-         NDR_RUNDOWN rundown = pStubMsg->StubDesc->apfnNdrRundownRoutines[pFormat[2]];
-         NdrServerContextNewMarshall(pStubMsg, ctxt, rundown, pFormat);
-     }
-diff --git a/dlls/rpcrt4/ndr_typelib.c b/dlls/rpcrt4/ndr_typelib.c
-index f1f25885b75..126e8ec8766 100644
---- a/dlls/rpcrt4/ndr_typelib.c
-+++ b/dlls/rpcrt4/ndr_typelib.c
-@@ -1452,7 +1452,7 @@ struct typelib_stub
- 
- static ULONG WINAPI typelib_stub_Release(IRpcStubBuffer *iface)
- {
--    struct typelib_stub *stub = CONTAINING_RECORD(iface, struct typelib_stub, stub.stub_buffer);
-+    struct typelib_stub *stub = CONTAINING_RECORD((CStdStubBuffer *)iface, struct typelib_stub, stub.stub_buffer);
-     ULONG refcount = InterlockedDecrement(&stub->stub.stub_buffer.RefCount);
- 
-     TRACE("(%p) decreasing refs to %d\n", stub, refcount);
--- 
-2.30.2
-

patches/Compiler_Warnings/0040-wbemdisp-Avoid-implicit-cast-of-interface-pointer.patch

@@ -1,34 +0,0 @@
-From 4801b547b70654507cb8a25dcfd1efc862dcf467 Mon Sep 17 00:00:00 2001
-From: Alistair Leslie-Hughes <leslie_alistair@hotmail.com>
-Date: Tue, 8 Jun 2021 11:38:46 +1000
-Subject: [PATCH] wbemdisp: Avoid implicit cast of interface pointer.
-
----
- dlls/wbemdisp/locator.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/dlls/wbemdisp/locator.c b/dlls/wbemdisp/locator.c
-index e0a1872d38f..5bb2a187f2c 100644
---- a/dlls/wbemdisp/locator.c
-+++ b/dlls/wbemdisp/locator.c
-@@ -1751,7 +1751,7 @@ static struct object *unsafe_object_impl_from_IDispatch(IDispatch *iface)
-         FIXME( "External implementations are not supported.\n" );
-         return NULL;
-     }
--    return CONTAINING_RECORD(iface, struct object, ISWbemObject_iface);
-+    return CONTAINING_RECORD((ISWbemObject *)iface, struct object, ISWbemObject_iface);
- }
- 
- static HRESULT SWbemObject_create( struct services *services, IWbemClassObject *wbem_object,
-@@ -3587,7 +3587,7 @@ static struct namedvalueset *unsafe_valueset_impl_from_IDispatch(IDispatch *ifac
-         FIXME( "External implementations are not supported.\n" );
-         return NULL;
-     }
--    return CONTAINING_RECORD(iface, struct namedvalueset, ISWbemNamedValueSet_iface);
-+    return CONTAINING_RECORD((ISWbemNamedValueSet*)iface, struct namedvalueset, ISWbemNamedValueSet_iface);
- }
- 
- HRESULT SWbemNamedValueSet_create( void **obj )
--- 
-2.30.2
-

patches/Staging/0001-kernel32-Add-winediag-message-to-show-warning-that-t.patch

@@ -1,60 +1,49 @@
-From 36b4dbb687232d783cc3203da1dee4a797606ba7 Mon Sep 17 00:00:00 2001
+From aa9cb874b1fb89601d6a5a735b442b8a7aa7b3aa Mon Sep 17 00:00:00 2001
 From: Sebastian Lackner <sebastian@fds-team.de>
 Date: Thu, 2 Oct 2014 19:44:31 +0200
-Subject: [PATCH] ntdll: Print a warning message specifying the wine-staging
- branch name and version.
+Subject: [PATCH] kernel32: Add winediag message to show warning, that this
+ isn't vanilla wine.
 
 ---
- dlls/ntdll/loader.c | 15 +++++++++++++++
- 1 file changed, 15 insertions(+)
+ dlls/kernel32/process.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
 
-diff --git a/dlls/ntdll/loader.c b/dlls/ntdll/loader.c
-index 255d5afef79..00add6728cc 100644
---- a/dlls/ntdll/loader.c
-+++ b/dlls/ntdll/loader.c
-@@ -44,6 +44,7 @@ WINE_DECLARE_DEBUG_CHANNEL(relay);
- WINE_DECLARE_DEBUG_CHANNEL(snoop);
- WINE_DECLARE_DEBUG_CHANNEL(loaddll);
- WINE_DECLARE_DEBUG_CHANNEL(imports);
+diff --git a/dlls/kernel32/process.c b/dlls/kernel32/process.c
+index 8f506fcf1320..45bfe7fe7b5d 100644
+--- a/dlls/kernel32/process.c
++++ b/dlls/kernel32/process.c
+@@ -60,6 +60,7 @@
+ 
+ WINE_DEFAULT_DEBUG_CHANNEL(process);
+ WINE_DECLARE_DEBUG_CHANNEL(relay);
 +WINE_DECLARE_DEBUG_CHANNEL(winediag);
  
- #ifdef _WIN64
- #define DEFAULT_SECURITY_COOKIE_64  (((ULONGLONG)0x00002b99 << 32) | 0x2ddfa232)
-@@ -3536,6 +3537,7 @@ void WINAPI LdrShutdownProcess(void)
-     process_detach();
- }
- 
-+extern const char * CDECL wine_get_version(void);
- 
- /******************************************************************
-  *		RtlExitUserProcess (NTDLL.@)
-@@ -3955,6 +3957,9 @@ static void release_address_space(void)
-  */
- void WINAPI LdrInitializeThunk( CONTEXT *context, ULONG_PTR unknown2, ULONG_PTR unknown3, ULONG_PTR unknown4 )
+ typedef struct
  {
-+    OBJECT_ATTRIBUTES staging_event_attr;
-+    UNICODE_STRING staging_event_string;
-+    HANDLE staging_event;
-     static int attach_done;
-     NTSTATUS status;
-     ULONG_PTR cookie;
-@@ -4041,6 +4046,16 @@ void WINAPI LdrInitializeThunk( CONTEXT *context, ULONG_PTR unknown2, ULONG_PTR
-     if (NtCurrentTeb()->WowTebOffset) init_wow64( context );
+@@ -125,6 +126,7 @@ static inline DWORD call_process_entry( PEB *peb, LPTHREAD_START_ROUTINE entry )
+ }
  #endif
  
-+    RtlInitUnicodeString( &staging_event_string, L"\\__wine_staging_warn_event" );
-+    InitializeObjectAttributes( &staging_event_attr, &staging_event_string, OBJ_OPENIF, NULL, NULL );
-+    if (NtCreateEvent( &staging_event, EVENT_ALL_ACCESS, &staging_event_attr, NotificationEvent, FALSE ) == STATUS_SUCCESS)
-+    {
-+        FIXME_(winediag)("wine-staging %s is a testing version containing experimental patches.\n", wine_get_version());
-+        FIXME_(winediag)("Please mention your exact version when filing bug reports on winehq.org.\n");
-+    }
-+    else
-+        WARN_(winediag)("wine-staging %s is a testing version containing experimental patches.\n", wine_get_version());
++extern const char * CDECL wine_get_version(void);
+ /***********************************************************************
+  *           __wine_start_process
+  *
+@@ -150,6 +152,15 @@ void CDECL __wine_start_process( LPTHREAD_START_ROUTINE entry, PEB *peb )
+ 
+     __TRY
+     {
++        if (CreateEventA(0, 0, 0, "__winestaging_warn_event") && GetLastError() != ERROR_ALREADY_EXISTS)
++        {
++            FIXME_(winediag)("Wine Staging %s is a testing version containing experimental patches.\n", wine_get_version());
++            FIXME_(winediag)("Please mention your exact version when filing bug reports on winehq.org.\n");
++        }
++        else
++            WARN_(winediag)("Wine Staging %s is a testing version containing experimental patches.\n", wine_get_version());
 +
-     RtlAcquirePebLock();
-     InsertHeadList( &tls_links, &NtCurrentTeb()->TlsLinks );
-     RtlReleasePebLock();
++
+         if (!CheckRemoteDebuggerPresent( GetCurrentProcess(), &being_debugged ))
+             being_debugged = FALSE;
+ 
 -- 
-2.33.0
+2.26.2
 

patches/Staging/0002-winelib-Append-Staging-at-the-end-of-the-version-s.patch

@@ -1,25 +1,39 @@
-From 8aa6fb73e3142d86ba354c204313b8a74a5fa43d Mon Sep 17 00:00:00 2001
+From c097870c69720ece3874ad4ff987408a8c24ffb2 Mon Sep 17 00:00:00 2001
 From: Sebastian Lackner <sebastian@fds-team.de>
 Date: Thu, 2 Oct 2014 19:53:46 +0200
 Subject: [PATCH] winelib: Append '(Staging)' at the end of the version string.
 
 ---
- configure.ac | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
+ dlls/ntdll/Makefile.in | 2 +-
+ libs/wine/Makefile.in  | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
 
-diff --git a/configure.ac b/configure.ac
-index f86a5decb07..3d7f9cc96e6 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -3910,7 +3910,7 @@ dnl Rules for generated source files
+diff --git a/dlls/ntdll/Makefile.in b/dlls/ntdll/Makefile.in
+index ebf607e9d43..de93445d4e3 100644
+--- a/dlls/ntdll/Makefile.in
++++ b/dlls/ntdll/Makefile.in
+@@ -69,7 +69,7 @@ server_EXTRADEFS = \
+ 	-DBIN_TO_DATADIR=\"`$(MAKEDEP) -R ${bindir} ${datadir}/wine`\"
  
- WINE_APPEND_RULE(
- [dlls/ntdll/unix/version.c: dummy
--	@version=\`(GIT_DIR=${wine_srcdir}.git git describe HEAD 2>/dev/null || echo \"wine-\$(PACKAGE_VERSION)\") | sed -n -e '\$\$s/\(.*\)/const char wine_build[[]] = \"\\1\";/p'\` && (echo \$\$version | cmp -s - \$[@]) || echo \$\$version >\$[@] || (rm -f \$[@] && exit 1)
-+	@version=\`(GIT_DIR=${wine_srcdir}.git git describe HEAD 2>/dev/null || echo \"wine-\$(PACKAGE_VERSION)\") | sed -n -e '\$\$s/\(.*\)/const char wine_build[[]] = \"\\1 (Staging)\";/p'\` && (echo \$\$version | cmp -s - \$[@]) || echo \$\$version >\$[@] || (rm -f \$[@] && exit 1)
- programs/winetest/build.rc: dummy
- 	@build=\"STRINGTABLE { 1 \\\"\`GIT_DIR=${wine_srcdir}.git git rev-parse HEAD 2>/dev/null\`\\\" }\" && (echo \$\$build | cmp -s - \$[@]) || echo \$\$build >\$[@] || (rm -f \$[@] && exit 1)
- programs/winetest/build.nfo:
+ unix/version.c: dummy
+-	version=`(GIT_DIR=$(top_srcdir)/.git git describe HEAD 2>/dev/null || echo "wine-$(PACKAGE_VERSION)") | sed -n -e '$$s/\(.*\)/const char wine_build[] = "\1";/p'` && (echo $$version | cmp -s - $@) || echo $$version >$@ || (rm -f $@ && exit 1)
++	version=`(GIT_DIR=$(top_srcdir)/.git git describe HEAD 2>/dev/null || echo "wine-$(PACKAGE_VERSION)") | sed -n -e '$$s/\(.*\)/const char wine_build[] = "\1 (Staging)";/p'` && (echo $$version | cmp -s - $@) || echo $$version >$@ || (rm -f $@ && exit 1)
+ 
+ dummy:
+ .PHONY: dummy
+diff --git a/libs/wine/Makefile.in b/libs/wine/Makefile.in
+index fe2a2b45e58..1e55a6b1f46 100644
+--- a/libs/wine/Makefile.in
++++ b/libs/wine/Makefile.in
+@@ -100,7 +100,7 @@ libwine_LDFLAGS = $(LIBWINE_LDFLAGS)
+ libwine_DEPS = $(LIBWINE_DEPENDS)
+ 
+ version.c: dummy
+-	version=`(GIT_DIR=$(top_srcdir)/.git git describe HEAD 2>/dev/null || echo "wine-$(PACKAGE_VERSION)") | sed -n -e '$$s/\(.*\)/const char wine_build[] = "\1";/p'` && (echo $$version | cmp -s - $@) || echo $$version >$@ || (rm -f $@ && exit 1)
++	version=`(GIT_DIR=$(top_srcdir)/.git git describe HEAD 2>/dev/null || echo "wine-$(PACKAGE_VERSION)") | sed -n -e '$$s/\(.*\)/const char wine_build[] = "\1  (Staging)";/p'` && (echo $$version | cmp -s - $@) || echo $$version >$@ || (rm -f $@ && exit 1)
+ 
+ dummy:
+ .PHONY: dummy
 -- 
-2.33.0
+2.26.2
 

patches/Staging/0003-loader-Add-commandline-option-patches-to-show-the-pa.patch

@@ -0,0 +1,117 @@
+From 599c50c9e339fe04e96fdb665b3d7ccb1a7708b7 Mon Sep 17 00:00:00 2001
+From: Sebastian Lackner <sebastian@fds-team.de>
+Date: Thu, 29 May 2014 23:43:45 +0200
+Subject: [PATCH] loader: Add commandline option --patches to show the patch
+ list.
+
+---
+ include/wine/library.h |  1 +
+ libs/wine/config.c     |  6 ++++++
+ libs/wine/wine.map     |  1 +
+ loader/main.c          | 42 +++++++++++++++++++++++++++++++++++++++++-
+ 4 files changed, 49 insertions(+), 1 deletion(-)
+
+diff --git a/include/wine/library.h b/include/wine/library.h
+index 090b8349559..b8a4a2df576 100644
+--- a/include/wine/library.h
++++ b/include/wine/library.h
+@@ -42,6 +42,7 @@ extern "C" {
+ /* configuration */
+ 
+ extern const char *wine_get_version(void);
++extern const void *wine_get_patches(void);
+ extern const char *wine_get_build_id(void);
+ extern void wine_init_argv0_path( const char *argv0 );
+ extern void wine_exec_wine_binary( const char *name, char **argv, const char *env_var );
+diff --git a/libs/wine/config.c b/libs/wine/config.c
+index f5b4c0de9af..e52739d55ad 100644
+--- a/libs/wine/config.c
++++ b/libs/wine/config.c
+@@ -515,6 +515,12 @@ const char *wine_get_version(void)
+     return PACKAGE_VERSION;
+ }
+ 
++/* return the applied non-standard patches */
++const void *wine_get_patches(void)
++{
++    return NULL;
++}
++
+ /* return the build id string */
+ const char *wine_get_build_id(void)
+ {
+diff --git a/libs/wine/wine.map b/libs/wine/wine.map
+index 1143b129734..55f874d3e74 100644
+--- a/libs/wine/wine.map
++++ b/libs/wine/wine.map
+@@ -13,6 +13,7 @@ WINE_1.0
+     wine_exec_wine_binary;
+     wine_get_build_id;
+     wine_get_version;
++    wine_get_patches;
+     wine_init;
+     wine_init_argv0_path;
+     wine_mmap_add_reserved_area;
+diff --git a/loader/main.c b/loader/main.c
+index 0e6b6f66b50..24bcfff8c4c 100644
+--- a/loader/main.c
++++ b/loader/main.c
+@@ -55,7 +55,8 @@ static void check_command_line( int argc, char *argv[] )
+     static const char usage[] =
+         "Usage: wine PROGRAM [ARGUMENTS...]   Run the specified program\n"
+         "       wine --help                   Display this help and exit\n"
+-        "       wine --version                Output version information and exit";
++        "       wine --version                Output version information and exit\n"
++        "       wine --patches                Output patch information and exit";
+ 
+     if (argc <= 1)
+     {
+@@ -72,6 +73,45 @@ static void check_command_line( int argc, char *argv[] )
+         printf( "%s\n", wine_get_build_id() );
+         exit(0);
+     }
++    if (!strcmp( argv[1], "--patches" ))
++    {
++        const struct
++        {
++            const char *author;
++            const char *subject;
++            int revision;
++        }
++        *next, *cur = wine_get_patches();
++
++        if (!cur)
++        {
++            fprintf( stderr, "Patchlist not available.\n" );
++            exit(1);
++        }
++
++        while (cur->author)
++        {
++            next = cur + 1;
++            while (next->author)
++            {
++                if (strcmp( cur->author, next->author )) break;
++                next++;
++            }
++
++            printf( "%s (%d):\n", cur->author, (int)(next - cur) );
++            while (cur < next)
++            {
++                printf( "      %s", cur->subject );
++                if (cur->revision != 1)
++                    printf( " [rev %d]", cur->revision );
++                printf( "\n" );
++                cur++;
++            }
++            printf( "\n" );
++        }
++
++        exit(0);
++    }
+ }
+ 
+ 
+-- 
+2.26.2
+

patches/advapi32-CreateRestrictedToken/0001-ntdll-Implement-NtFilterToken.patch

@@ -0,0 +1,315 @@
+From 1eb8acd819f9eee8fdf154d0ef43881008265916 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Fri, 4 Aug 2017 02:33:14 +0200
+Subject: ntdll: Implement NtFilterToken.
+
+---
+ dlls/ntdll/nt.c       | 59 ++++++++++++++++++++++++++++++++++++
+ dlls/ntdll/ntdll.spec |  2 +-
+ include/winnt.h       |  5 +++
+ include/winternl.h    |  1 +
+ server/process.c      |  2 +-
+ server/protocol.def   | 10 ++++++
+ server/security.h     |  4 ++-
+ server/token.c        | 84 +++++++++++++++++++++++++++++++++++++++++++++++++--
+ 8 files changed, 162 insertions(+), 5 deletions(-)
+
+diff --git a/dlls/ntdll/nt.c b/dlls/ntdll/nt.c
+index c3f5df3..59a08de 100644
+--- a/dlls/ntdll/nt.c
++++ b/dlls/ntdll/nt.c
+@@ -119,6 +119,65 @@ NTSTATUS WINAPI NtDuplicateToken(
+ }
+ 
+ /******************************************************************************
++ *  NtFilterToken        [NTDLL.@]
++ *  ZwFilterToken        [NTDLL.@]
++ */
++NTSTATUS WINAPI NtFilterToken( HANDLE token, ULONG flags, TOKEN_GROUPS *disable_sids,
++                               TOKEN_PRIVILEGES *privileges, TOKEN_GROUPS *restrict_sids,
++                               HANDLE *new_token )
++{
++    data_size_t privileges_len = 0;
++    data_size_t sids_len = 0;
++    SID *sids = NULL;
++    NTSTATUS status;
++
++    TRACE( "(%p, 0x%08x, %p, %p, %p, %p)\n", token, flags, disable_sids, privileges,
++           restrict_sids, new_token );
++
++    if (flags)
++        FIXME( "flags %x unsupported\n", flags );
++
++    if (restrict_sids)
++        FIXME( "support for restricting sids not yet implemented\n" );
++
++    if (privileges)
++        privileges_len = privileges->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
++
++    if (disable_sids)
++    {
++        DWORD len, i;
++        BYTE *tmp;
++
++        for (i = 0; i < disable_sids->GroupCount; i++)
++            sids_len += RtlLengthSid( disable_sids->Groups[i].Sid );
++
++        sids = RtlAllocateHeap( GetProcessHeap(), 0, sids_len );
++        if (!sids) return STATUS_NO_MEMORY;
++
++        for (i = 0, tmp = (BYTE *)sids; i < disable_sids->GroupCount; i++, tmp += len)
++        {
++            len = RtlLengthSid( disable_sids->Groups[i].Sid );
++            memcpy( tmp, disable_sids->Groups[i].Sid, len );
++        }
++    }
++
++    SERVER_START_REQ( filter_token )
++    {
++        req->handle          = wine_server_obj_handle( token );
++        req->flags           = flags;
++        req->privileges_size = privileges_len;
++        wine_server_add_data( req, privileges->Privileges, privileges_len );
++        wine_server_add_data( req, sids, sids_len );
++        status = wine_server_call( req );
++        if (!status) *new_token = wine_server_ptr_handle( reply->new_handle );
++    }
++    SERVER_END_REQ;
++
++    RtlFreeHeap( GetProcessHeap(), 0, sids );
++    return status;
++}
++
++/******************************************************************************
+  *  NtOpenProcessToken		[NTDLL.@]
+  *  ZwOpenProcessToken		[NTDLL.@]
+  */
+diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
+index c260b0d..3c5e69c 100644
+--- a/dlls/ntdll/ntdll.spec
++++ b/dlls/ntdll/ntdll.spec
+@@ -176,7 +176,7 @@
+ # @ stub NtEnumerateSystemEnvironmentValuesEx
+ @ stdcall NtEnumerateValueKey(long long long ptr long ptr)
+ @ stub NtExtendSection
+-# @ stub NtFilterToken
++@ stdcall NtFilterToken(long long ptr ptr ptr ptr)
+ @ stdcall NtFindAtom(ptr long ptr)
+ @ stdcall NtFlushBuffersFile(long ptr)
+ @ stdcall NtFlushInstructionCache(long ptr long)
+diff --git a/include/winnt.h b/include/winnt.h
+index 16d96d8..4e238f9 100644
+--- a/include/winnt.h
++++ b/include/winnt.h
+@@ -3904,6 +3904,11 @@ typedef enum _TOKEN_INFORMATION_CLASS {
+ 					TOKEN_ADJUST_SESSIONID | \
+ 					TOKEN_ADJUST_DEFAULT )
+ 
++#define DISABLE_MAX_PRIVILEGE 0x1
++#define SANDBOX_INERT         0x2
++#define LUA_TOKEN             0x4
++#define WRITE_RESTRICTED      0x8
++
+ #ifndef _SECURITY_DEFINED
+ #define _SECURITY_DEFINED
+ 
+diff --git a/include/winternl.h b/include/winternl.h
+index c84e6d7..288f93e 100644
+--- a/include/winternl.h
++++ b/include/winternl.h
+@@ -2303,6 +2303,7 @@ NTSYSAPI NTSTATUS  WINAPI NtDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES
+ NTSYSAPI NTSTATUS  WINAPI NtEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
+ NTSYSAPI NTSTATUS  WINAPI NtEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
+ NTSYSAPI NTSTATUS  WINAPI NtExtendSection(HANDLE,PLARGE_INTEGER);
++NTSYSAPI NTSTATUS  WINAPI NtFilterToken(HANDLE,ULONG,TOKEN_GROUPS*,TOKEN_PRIVILEGES*,TOKEN_GROUPS*,HANDLE*);
+ NTSYSAPI NTSTATUS  WINAPI NtFindAtom(const WCHAR*,ULONG,RTL_ATOM*);
+ NTSYSAPI NTSTATUS  WINAPI NtFlushBuffersFile(HANDLE,IO_STATUS_BLOCK*);
+ NTSYSAPI NTSTATUS  WINAPI NtFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
+diff --git a/server/process.c b/server/process.c
+index f8739d0..71d9d6d 100644
+--- a/server/process.c
++++ b/server/process.c
+@@ -566,7 +566,7 @@ struct thread *create_process( int fd, struct thread *parent_thread, int inherit
+                                        : alloc_handle_table( process, 0 );
+         /* Note: for security reasons, starting a new process does not attempt
+          * to use the current impersonation token for the new process */
+-        process->token = token_duplicate( parent->token, TRUE, 0, NULL );
++        process->token = token_duplicate( parent->token, TRUE, 0, NULL, NULL, 0, NULL, 0 );
+         process->affinity = parent->affinity;
+     }
+     if (!process->handles || !process->token) goto error;
+diff --git a/server/protocol.def b/server/protocol.def
+index 35824ae..6ee6d28 100644
+--- a/server/protocol.def
++++ b/server/protocol.def
+@@ -3356,6 +3356,16 @@ enum caret_state
+     obj_handle_t  new_handle; /* duplicated handle */
+ @END
+ 
++@REQ(filter_token)
++    obj_handle_t  handle;          /* handle to the token to duplicate */
++    unsigned int  flags;           /* flags */
++    data_size_t   privileges_size; /* size of privileges */
++    VARARG(privileges,LUID_AND_ATTRIBUTES,privileges_size); /* privileges to remove from new token */
++    VARARG(disable_sids,SID);      /* array of groups to remove from new token */
++@REPLY
++    obj_handle_t  new_handle;      /* filtered handle */
++@END
++
+ @REQ(access_check)
+     obj_handle_t    handle; /* handle to the token */
+     unsigned int    desired_access; /* desired access to the object */
+diff --git a/server/security.h b/server/security.h
+index 873bbc6..bc4a8f6 100644
+--- a/server/security.h
++++ b/server/security.h
+@@ -55,7 +55,9 @@ extern const PSID security_high_label_sid;
+ extern struct token *token_create_admin(void);
+ extern int token_assign_label( struct token *token, PSID label );
+ extern struct token *token_duplicate( struct token *src_token, unsigned primary,
+-                                      int impersonation_level, const struct security_descriptor *sd );
++                                      int impersonation_level, const struct security_descriptor *sd,
++                                      const LUID_AND_ATTRIBUTES *filter_privileges, unsigned int priv_count,
++                                      const SID *filter_groups, unsigned int group_count );
+ extern int token_check_privileges( struct token *token, int all_required,
+                                    const LUID_AND_ATTRIBUTES *reqprivs,
+                                    unsigned int count, LUID_AND_ATTRIBUTES *usedprivs);
+diff --git a/server/token.c b/server/token.c
+index 0810a61..2f6a467 100644
+--- a/server/token.c
++++ b/server/token.c
+@@ -276,6 +276,19 @@ static int acl_is_valid( const ACL *acl, data_size_t size )
+     return TRUE;
+ }
+ 
++static unsigned int get_sid_count( const SID *sid, data_size_t size )
++{
++    unsigned int count;
++
++    for (count = 0; size >= sizeof(SID) && security_sid_len( sid ) <= size; count++)
++    {
++        size -= security_sid_len( sid );
++        sid = (const SID *)((char *)sid + security_sid_len( sid ));
++    }
++
++    return count;
++}
++
+ /* checks whether all members of a security descriptor fit inside the size
+  * of memory specified */
+ int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
+@@ -619,8 +632,36 @@ static struct token *create_token( unsigned primary, const SID *user,
+     return token;
+ }
+ 
++static int filter_group( struct group *group, const SID *filter, unsigned int count )
++{
++    unsigned int i;
++
++    for (i = 0; i < count; i++)
++    {
++        if (security_equal_sid( &group->sid, filter )) return 1;
++        filter = (const SID *)((char *)filter + security_sid_len( filter ));
++    }
++
++    return 0;
++}
++
++static int filter_privilege( struct privilege *privilege, const LUID_AND_ATTRIBUTES *filter, unsigned int count )
++{
++    unsigned int i;
++
++    for (i = 0; i < count; i++)
++    {
++        if (!memcmp( &privilege->luid, &filter[i].Luid, sizeof(LUID) ))
++            return 1;
++    }
++
++    return 0;
++}
++
+ struct token *token_duplicate( struct token *src_token, unsigned primary,
+-                               int impersonation_level, const struct security_descriptor *sd )
++                               int impersonation_level, const struct security_descriptor *sd,
++                               const LUID_AND_ATTRIBUTES *filter_privileges, unsigned int priv_count,
++                               const SID *filter_groups, unsigned int group_count)
+ {
+     const luid_t *modified_id =
+         primary || (impersonation_level == src_token->impersonation_level) ?
+@@ -656,6 +697,12 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
+             return NULL;
+         }
+         memcpy( newgroup, group, size );
++        if (filter_group( group, filter_groups, group_count ))
++        {
++            newgroup->enabled = 0;
++            newgroup->def = 0;
++            newgroup->deny_only = 1;
++        }
+         list_add_tail( &token->groups, &newgroup->entry );
+         if (src_token->primary_group == &group->sid)
+         {
+@@ -667,11 +714,14 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
+ 
+     /* copy privileges */
+     LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
++    {
++        if (filter_privilege( privilege, filter_privileges, priv_count )) continue;
+         if (!privilege_add( token, &privilege->luid, privilege->enabled ))
+         {
+             release_object( token );
+             return NULL;
+         }
++    }
+ 
+     if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
+                             DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
+@@ -1304,7 +1354,7 @@ DECL_HANDLER(duplicate_token)
+                                                      TOKEN_DUPLICATE,
+                                                      &token_ops )))
+     {
+-        struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd );
++        struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd, NULL, 0, NULL, 0 );
+         if (token)
+         {
+             reply->new_handle = alloc_handle_no_access_check( current->process, token, req->access, objattr->attributes );
+@@ -1314,6 +1364,36 @@ DECL_HANDLER(duplicate_token)
+     }
+ }
+ 
++/* creates a restricted version of a token */
++DECL_HANDLER(filter_token)
++{
++    struct token *src_token;
++
++    if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
++                                                     TOKEN_DUPLICATE,
++                                                     &token_ops )))
++    {
++        const LUID_AND_ATTRIBUTES *filter_privileges = get_req_data();
++        unsigned int priv_count, group_count;
++        const SID *filter_groups;
++        struct token *token;
++
++        priv_count = min( req->privileges_size, get_req_data_size() ) / sizeof(LUID_AND_ATTRIBUTES);
++        filter_groups = (const SID *)((char *)filter_privileges + priv_count * sizeof(LUID_AND_ATTRIBUTES));
++        group_count = get_sid_count( filter_groups, get_req_data_size() - priv_count * sizeof(LUID_AND_ATTRIBUTES) );
++
++        token = token_duplicate( src_token, src_token->primary, src_token->impersonation_level, NULL,
++                                 filter_privileges, priv_count, filter_groups, group_count );
++        if (token)
++        {
++            unsigned int access = get_handle_access( current->process, req->handle );
++            reply->new_handle = alloc_handle_no_access_check( current->process, token, access, 0 );
++            release_object( token );
++        }
++        release_object( src_token );
++    }
++}
++
+ /* checks the specified privileges are held by the token */
+ DECL_HANDLER(check_token_privileges)
+ {
+-- 
+2.7.4
+

patches/advapi32-CreateRestrictedToken/0002-advapi32-Implement-CreateRestrictedToken.patch

@@ -0,0 +1,132 @@
+From 3c1f5962482e7acf531f57f49d923d9c4e5278b1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Fri, 4 Aug 2017 02:51:57 +0200
+Subject: [PATCH] advapi32: Implement CreateRestrictedToken.
+
+---
+ dlls/kernelbase/security.c | 103 ++++++++++++++++++++++++++++++-------
+ 1 file changed, 84 insertions(+), 19 deletions(-)
+
+diff --git a/dlls/kernelbase/security.c b/dlls/kernelbase/security.c
+index 2e75e81ed77..97f6ee6a2fd 100644
+--- a/dlls/kernelbase/security.c
++++ b/dlls/kernelbase/security.c
+@@ -592,31 +592,96 @@ exit:
+     return ret;
+ }
+ 
++static BOOL allocate_groups(TOKEN_GROUPS **groups_ret, SID_AND_ATTRIBUTES *sids, DWORD count)
++{
++    TOKEN_GROUPS *groups;
++    DWORD i;
++
++    if (!count)
++    {
++        *groups_ret = NULL;
++        return TRUE;
++    }
++
++    groups = (TOKEN_GROUPS *)heap_alloc(FIELD_OFFSET(TOKEN_GROUPS, Groups) +
++                                        count * sizeof(SID_AND_ATTRIBUTES));
++    if (!groups)
++    {
++        SetLastError(ERROR_OUTOFMEMORY);
++        return FALSE;
++    }
++
++    groups->GroupCount = count;
++    for (i = 0; i < count; i++)
++        groups->Groups[i] = sids[i];
++
++    *groups_ret = groups;
++    return TRUE;
++}
++
++static BOOL allocate_privileges(TOKEN_PRIVILEGES **privileges_ret, LUID_AND_ATTRIBUTES *privs, DWORD count)
++{
++    TOKEN_PRIVILEGES *privileges;
++    DWORD i;
++
++    if (!count)
++    {
++        *privileges_ret = NULL;
++        return TRUE;
++    }
++
++    privileges = (TOKEN_PRIVILEGES *)heap_alloc(FIELD_OFFSET(TOKEN_PRIVILEGES, Privileges) +
++                                                count * sizeof(LUID_AND_ATTRIBUTES));
++    if (!privileges)
++    {
++        SetLastError(ERROR_OUTOFMEMORY);
++        return FALSE;
++    }
++
++    privileges->PrivilegeCount = count;
++    for (i = 0; i < count; i++)
++        privileges->Privileges[i] = privs[i];
++
++    *privileges_ret = privileges;
++    return TRUE;
++}
++
+ /*************************************************************************
+  * CreateRestrictedToken    (kernelbase.@)
+  */
+-BOOL WINAPI CreateRestrictedToken( HANDLE token, DWORD flags,
+-                                   DWORD disable_count, PSID_AND_ATTRIBUTES disable_sids,
+-                                   DWORD delete_count, PLUID_AND_ATTRIBUTES delete_privs,
+-                                   DWORD restrict_count, PSID_AND_ATTRIBUTES restrict_sids, PHANDLE ret )
++BOOL WINAPI CreateRestrictedToken( HANDLE baseToken, DWORD flags,
++                                   DWORD nDisableSids, PSID_AND_ATTRIBUTES disableSids,
++                                   DWORD nDeletePrivs, PLUID_AND_ATTRIBUTES deletePrivs,
++                                   DWORD nRestrictSids, PSID_AND_ATTRIBUTES restrictSids, PHANDLE newToken )
+ {
+-    TOKEN_TYPE type;
+-    SECURITY_IMPERSONATION_LEVEL level = SecurityAnonymous;
+-    DWORD size;
++    TOKEN_PRIVILEGES *delete_privs = NULL;
++    TOKEN_GROUPS *disable_groups = NULL;
++    TOKEN_GROUPS *restrict_sids = NULL;
++    BOOL ret = FALSE;
+ 
+-    FIXME("(%p, 0x%x, %u, %p, %u, %p, %u, %p, %p): stub\n",
+-          token, flags, disable_count, disable_sids, delete_count, delete_privs,
+-          restrict_count, restrict_sids, ret );
++    TRACE("(%p, 0x%x, %u, %p, %u, %p, %u, %p, %p)\n",
++          baseToken, flags, nDisableSids, disableSids,
++          nDeletePrivs, deletePrivs,
++          nRestrictSids, restrictSids,
++          newToken);
++
++    if (!allocate_groups(&disable_groups, disableSids, nDisableSids))
++        goto done;
++
++    if (!allocate_privileges(&delete_privs, deletePrivs, nDeletePrivs))
++        goto done;
++
++    if (!allocate_groups(&restrict_sids, restrictSids, nRestrictSids))
++        goto done;
++
++    ret = set_ntstatus(NtFilterToken(baseToken, flags, disable_groups, delete_privs, restrict_sids, newToken));
++
++done:
++    heap_free(disable_groups);
++    heap_free(delete_privs);
++    heap_free(restrict_sids);
++    return ret;
+ 
+-    size = sizeof(type);
+-    if (!GetTokenInformation( token, TokenType, &type, size, &size )) return FALSE;
+-    if (type == TokenImpersonation)
+-    {
+-        size = sizeof(level);
+-        if (!GetTokenInformation( token, TokenImpersonationLevel, &level, size, &size ))
+-            return FALSE;
+-    }
+-    return DuplicateTokenEx( token, MAXIMUM_ALLOWED, NULL, level, type, ret );
+ }
+ 
+ /******************************************************************************
+-- 
+2.20.1
+

patches/advapi32-CreateRestrictedToken/definition

@@ -0,0 +1 @@
+Fixes: [25834] Implement advapi32.CreateRestrictedToken

patches/advapi32-LsaLookupPrivilegeName/0002-advapi32-Use-TRACE-for-LsaOpenPolicy-LsaClose.patch

@@ -0,0 +1,34 @@
+From 1941137bff72a2297812bbd05fb6f6a1578426b0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Sun, 5 Mar 2017 23:05:54 +0100
+Subject: advapi32: Use TRACE for LsaOpenPolicy/LsaClose.
+
+---
+ dlls/advapi32/lsa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/dlls/advapi32/lsa.c b/dlls/advapi32/lsa.c
+index e5e3b1649c0..0f2167d19ab 100644
+--- a/dlls/advapi32/lsa.c
++++ b/dlls/advapi32/lsa.c
+@@ -136,7 +136,7 @@ NTSTATUS WINAPI LsaAddAccountRights(
+  */
+ NTSTATUS WINAPI LsaClose(IN LSA_HANDLE ObjectHandle)
+ {
+-    FIXME("(%p) stub\n", ObjectHandle);
++    TRACE("(%p) semi-stub\n", ObjectHandle);
+     return STATUS_SUCCESS;
+ }
+ 
+@@ -687,7 +687,7 @@ NTSTATUS WINAPI LsaOpenPolicy(
+     IN ACCESS_MASK DesiredAccess,
+     IN OUT PLSA_HANDLE PolicyHandle)
+ {
+-    FIXME("(%s,%p,0x%08x,%p) stub\n",
++    TRACE("(%s,%p,0x%08x,%p) semi-stub\n",
+           SystemName?debugstr_w(SystemName->Buffer):"(null)",
+           ObjectAttributes, DesiredAccess, PolicyHandle);
+ 
+-- 
+2.11.0
+