experimental_11.0 (experimental-11.0-20260903b) and bleeding edge. dlls/xinput1_3/main.c:863 (xinput1_4 merges this code):
ret = get_current_state(index, state) ? ERROR_SUCCESS : ERROR_DEVICE_NOT_CONNECTED;
if (ret == ERROR_SUCCESS) goto done;
sgi = getenv("SteamGameId");
if (!strcmp(sgi, "298110")) goto done;The getenv result goes straight to strcmp without a NULL check. With SteamGameId unset, XInputGetState dereferences NULL and the process exits with EXCEPTION_ACCESS_VIOLATION reading address 0x0.
Seen with Subliminal (appid 2300840, UE 5.7.4) on experimental-11.0-20260903b. Crash log callstack:
Unhandled Exception: EXCEPTION_ACCESS_VIOLATION reading address 0x0000000000000000
ucrtbase.dll!strcmp()
XINPUT1_4.dll!0x180005f7d()
XINPUT1_4.dll!0x180020d0()
Subliminal-Win64-Shipping.exe
Disassembly at xinput1_4+0x5f60 confirms the sequence: load "SteamGameId", call getenv, load "298110" into rdx, pass the (NULL) getenv result in rcx, call strcmp:
lea 0x2f6d(%rip),%rcx # 180008ed4 -> "SteamGameId"
call *0x9623(%rip) # getenv
lea 0x2f6c(%rip),%rdx # 180008ee0 -> "298110"
mov %rax,%rcx
call *0x9643(%rip) # strcmp
Repro: any game that calls XInputGetState, run through proton run with STEAM_COMPAT_CLIENT_INSTALL_PATH / STEAM_COMPAT_DATA_PATH set and SteamGameId not exported. Also reproduced with steam steam://rungameid/2300840, which apparently doesn't export it either. Normal Steam library launches set the variable and don't hit this. The hack is absent from proton_11.0, so stable releases are unaffected.
Every other getenv("SteamGameId") call site I checked (d3d8, d2d1, ddraw, gdiplus, ieframe, metahost, mshtml, quartz, rsaenh, wgl) is guarded; this is the only one without the check. Same class as #228, the identical missing NULL check in opengl32.
Patch:
sgi = getenv("SteamGameId");
if (sgi && !strcmp(sgi, "298110")) goto done;Workaround until then: export SteamGameId= before launching.
experimental_11.0 (experimental-11.0-20260903b) and bleeding edge. dlls/xinput1_3/main.c:863 (xinput1_4 merges this code):
The getenv result goes straight to strcmp without a NULL check. With SteamGameId unset, XInputGetState dereferences NULL and the process exits with EXCEPTION_ACCESS_VIOLATION reading address 0x0.
Seen with Subliminal (appid 2300840, UE 5.7.4) on experimental-11.0-20260903b. Crash log callstack:
Disassembly at xinput1_4+0x5f60 confirms the sequence: load "SteamGameId", call getenv, load "298110" into rdx, pass the (NULL) getenv result in rcx, call strcmp:
Repro: any game that calls XInputGetState, run through
proton runwith STEAM_COMPAT_CLIENT_INSTALL_PATH / STEAM_COMPAT_DATA_PATH set and SteamGameId not exported. Also reproduced withsteam steam://rungameid/2300840, which apparently doesn't export it either. Normal Steam library launches set the variable and don't hit this. The hack is absent from proton_11.0, so stable releases are unaffected.Every other getenv("SteamGameId") call site I checked (d3d8, d2d1, ddraw, gdiplus, ieframe, metahost, mshtml, quartz, rsaenh, wgl) is guarded; this is the only one without the check. Same class as #228, the identical missing NULL check in opengl32.
Patch:
Workaround until then: export SteamGameId= before launching.