Skip to content

Commit 3c612cf

Browse files
vseanreesermsftdotnet-botdipeshmsft
authored
Merging internal commits for release/8.0 (#9004)
* [internal/release/8.0] Update dependencies from dnceng/internal/dotnet-winforms * Fixes PenIMC UAF MSRC .NET 8 * Update dependencies from https://dev.azure.com/dnceng/internal/_git/dotnet-winforms build 20240311.12 Microsoft.Dotnet.WinForms.ProjectTemplates , Microsoft.Private.Winforms , System.Drawing.Common From Version 8.0.4-servicing.24157.9 -> To Version 8.0.4-servicing.24161.12 * Local dependencies updated based on build with BAR id 217426 (20240314.3 from https://dev.azure.com/dnceng/internal/_git/dotnet-winforms@refs/heads/internal/release/8.0) * Merged PR 38220: [internal/release/8.0] Update dependencies from dnceng/internal/dotnet-winforms This pull request updates the following dependencies [marker]: <> (Begin:Coherency Updates) ## Coherency Updates The following updates ensure that dependencies with a *CoherentParentDependency* attribute were produced in a build used as input to the parent dependency's build. See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview) [DependencyUpdate]: <> (Begin) - **Coherency Updates**: - **Microsoft.NETCore.Platforms**: from 8.0.4-servicing.24163.26 to 8.0.4-servicing.24168.10 (parent: Microsoft.Private.Winforms) - **Microsoft.NETCore.App.Ref**: from 8.0.4 to 8.0.4 (parent: Microsoft.Private.Winforms) - **Microsoft.NETCore.App.Runtime.win-x64**: from 8.0.4 to 8.0.4 (parent: Microsoft.Private.Winforms) - **VS.Redist.Common.NetCore.SharedFramework.x64.8.0**: from 8.0.4-servicing.24163.26 to 8.0.4-servicing.24168.10 (parent: Microsoft.Private.Winforms) [DependencyUpdate]: <> (End) [marker]: <> (End:Coherency Updates) [marker]: <> (Begin:0ce99e90-7dcb-4849-5aa3-08dbd5a5c716) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-winforms - **Subscription**: 0ce99e90-7dcb-4849-5aa3-08dbd5a5c716 - **Build**: - **Date Produced**: March 19, 2024 12:25:21 AM UTC - **Commit**: fbf1a1e892c2c37066093d856d8c23f7adff536f - **Branch**: refs/heads/internal/release/8.0 [DependencyUpdate]: <> (Begin) - **Updates**: - **Microsoft.Dotnet.WinForms.ProjectTemplates**: [from 8.0.4-servicing.24164.3 to 8.0.4-servicing.24168.13][1] - **Microsoft.Private.Winforms**: [from 8.0.4-servicing.24164.3 to 8.0.4-servicing.24168.13][1] - **System.Drawing.Common**: [from 8.0.4 to 8.0.4][1] - **Microsoft.NETCore.Platforms**: [from 8.0.4-servicing.24163.26 to 8.0.4-servicing.24168.10][2] - **Microsoft.NETCore.App.Ref**: [from 8.0.4 to 8.0.4][2] - **Microsoft.NETCore.App.Runtime.win-x64**: [from 8.0.4 to 8.0.4][2] - **VS.Redist.Common.NetCore.SharedFramework.x64.8.0**: [from 8.0.4-servicing.24163.26 to 8.0.4-servicing.24168.10][2] [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-winforms/branches?baseVersion=GCf37bd9d71f3baa2b2f47389aa2d2fa17324d714b&targetVersion=GCfbf1a1e892c2c37066093d856d8c23f7adff536f&_a=files [2]: https://dev.azure.com/dnceng/internal/_git/dotnet-runtime/branches?baseVersion=GC38f2042434044be9a09065b23b7ef342a313a498&targetVersion=GCa1a9440b48374c6d400287abbb56a4ac54d9b02f&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:0ce99e90-7dcb-4849-5aa3-08dbd5a5c716) * Update dependencies from https://dev.azure.com/dnceng/internal/_git/dotnet-winforms build Microsoft.Dotnet.WinForms.ProjectTemplates , Microsoft.Private.Winforms , System.Drawing.Common From Version 8.0.4-servicing.24168.13 -> To Version 8.0.4-servicing.24169.7 * Update dependencies from https://dev.azure.com/dnceng/internal/_git/dotnet-winforms build Microsoft.Dotnet.WinForms.ProjectTemplates , Microsoft.Private.Winforms , System.Drawing.Common From Version 8.0.4-servicing.24169.7 -> To Version 8.0.4-servicing.24169.11 Dependency coherency updates Microsoft.NETCore.Platforms,Microsoft.NETCore.App.Ref,Microsoft.NETCore.App.Runtime.win-x64,VS.Redist.Common.NetCore.SharedFramework.x64.8.0 From Version 8.0.4-servicing.24168.10 -> To Version 8.0.4-servicing.24169.9 (parent: Microsoft.Private.Winforms --------- Co-authored-by: dotnet-bot <[email protected]> Co-authored-by: DotNet Bot <[email protected]> Co-authored-by: dipeshmsft <[email protected]>
1 parent 9854b4a commit 3c612cf

File tree

5 files changed

+117
-20
lines changed

5 files changed

+117
-20
lines changed

‎NuGet.config‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,10 @@
55
<clear />
66
<!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
77
<!-- Begin: Package sources from dotnet-runtime -->
8+
<add key="darc-int-dotnet-runtime-2d7eea2" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/darc-int-dotnet-runtime-2d7eea25/nuget/v3/index.json" />
89
<!-- End: Package sources from dotnet-runtime -->
910
<!-- Begin: Package sources from dotnet-winforms -->
11+
<add key="darc-int-dotnet-winforms-41a4bd6" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/darc-int-dotnet-winforms-41a4bd69/nuget/v3/index.json" />
1012
<!-- End: Package sources from dotnet-winforms -->
1113
<!--End: Package sources managed by Dependency Flow automation. Do not edit the sources above.-->
1214
<add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
@@ -20,8 +22,10 @@
2022
<disabledPackageSources>
2123
<!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
2224
<!-- Begin: Package sources from dotnet-runtime -->
25+
<add key="darc-int-dotnet-runtime-2d7eea2" value="true" />
2326
<!-- End: Package sources from dotnet-runtime -->
2427
<!-- Begin: Package sources from dotnet-winforms -->
28+
<add key="darc-int-dotnet-winforms-41a4bd6" value="true" />
2529
<!-- End: Package sources from dotnet-winforms -->
2630
<!--End: Package sources managed by Dependency Flow automation. Do not edit the sources above.-->
2731
</disabledPackageSources>

‎eng/Version.Details.xml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Dependencies>
33
<ProductDependencies>
4-
<Dependency Name="Microsoft.Private.Winforms" Version="8.0.3-servicing.24116.3">
4+
<Dependency Name="Microsoft.Private.Winforms" Version="8.0.4-servicing.24169.11">
55
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-winforms</Uri>
6-
<Sha>bd280bbb5c9699bb93097206f076ad2f330ea8e1</Sha>
6+
<Sha>41a4bd690229661e3ec74276ce3f93863b22435b</Sha>
77
</Dependency>
8-
<Dependency Name="Microsoft.Dotnet.WinForms.ProjectTemplates" Version="8.0.3-servicing.24116.3">
8+
<Dependency Name="Microsoft.Dotnet.WinForms.ProjectTemplates" Version="8.0.4-servicing.24169.11">
99
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-winforms</Uri>
10-
<Sha>bd280bbb5c9699bb93097206f076ad2f330ea8e1</Sha>
10+
<Sha>41a4bd690229661e3ec74276ce3f93863b22435b</Sha>
1111
</Dependency>
1212
<Dependency Name="System.Reflection.MetadataLoadContext" Version="8.0.0" CoherentParentDependency="Microsoft.Private.Winforms">
1313
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
@@ -17,9 +17,9 @@
1717
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
1818
<Sha>5535e31a712343a63f5d7d796cd874e563e5ac14</Sha>
1919
</Dependency>
20-
<Dependency Name="Microsoft.NETCore.Platforms" Version="8.0.3-servicing.24114.23" CoherentParentDependency="Microsoft.Private.Winforms">
20+
<Dependency Name="Microsoft.NETCore.Platforms" Version="8.0.4-servicing.24169.9" CoherentParentDependency="Microsoft.Private.Winforms">
2121
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
22-
<Sha>9f4b1f5d664afdfc80e1508ab7ed099dff210fbd</Sha>
22+
<Sha>2d7eea252964e69be94cb9c847b371b23e4dd470</Sha>
2323
</Dependency>
2424
<Dependency Name="Microsoft.DotNet.Wpf.DncEng" Version="8.0.0-rtm.24178.1">
2525
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-wpf-int</Uri>
@@ -29,17 +29,17 @@
2929
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
3030
<Sha>5535e31a712343a63f5d7d796cd874e563e5ac14</Sha>
3131
</Dependency>
32-
<Dependency Name="Microsoft.NETCore.App.Ref" Version="8.0.3" CoherentParentDependency="Microsoft.Private.Winforms">
32+
<Dependency Name="Microsoft.NETCore.App.Ref" Version="8.0.4" CoherentParentDependency="Microsoft.Private.Winforms">
3333
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
34-
<Sha>9f4b1f5d664afdfc80e1508ab7ed099dff210fbd</Sha>
34+
<Sha>2d7eea252964e69be94cb9c847b371b23e4dd470</Sha>
3535
</Dependency>
36-
<Dependency Name="Microsoft.NETCore.App.Runtime.win-x64" Version="8.0.3" CoherentParentDependency="Microsoft.Private.Winforms">
36+
<Dependency Name="Microsoft.NETCore.App.Runtime.win-x64" Version="8.0.4" CoherentParentDependency="Microsoft.Private.Winforms">
3737
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
38-
<Sha>9f4b1f5d664afdfc80e1508ab7ed099dff210fbd</Sha>
38+
<Sha>2d7eea252964e69be94cb9c847b371b23e4dd470</Sha>
3939
</Dependency>
40-
<Dependency Name="VS.Redist.Common.NetCore.SharedFramework.x64.8.0" Version="8.0.3-servicing.24114.23" CoherentParentDependency="Microsoft.Private.Winforms">
40+
<Dependency Name="VS.Redist.Common.NetCore.SharedFramework.x64.8.0" Version="8.0.4-servicing.24169.9" CoherentParentDependency="Microsoft.Private.Winforms">
4141
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
42-
<Sha>9f4b1f5d664afdfc80e1508ab7ed099dff210fbd</Sha>
42+
<Sha>2d7eea252964e69be94cb9c847b371b23e4dd470</Sha>
4343
</Dependency>
4444
<!-- These dependencies are required by windowsdesktop for coherency. -->
4545
<Dependency Name="Microsoft.Win32.Registry.AccessControl" Version="8.0.0" CoherentParentDependency="Microsoft.Private.Winforms">
@@ -150,9 +150,9 @@
150150
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
151151
<Sha>5535e31a712343a63f5d7d796cd874e563e5ac14</Sha>
152152
</Dependency>
153-
<Dependency Name="System.Drawing.Common" Version="8.0.3">
153+
<Dependency Name="System.Drawing.Common" Version="8.0.4">
154154
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-winforms</Uri>
155-
<Sha>bd280bbb5c9699bb93097206f076ad2f330ea8e1</Sha>
155+
<Sha>41a4bd690229661e3ec74276ce3f93863b22435b</Sha>
156156
</Dependency>
157157
</ProductDependencies>
158158
<ToolsetDependencies>

‎eng/Versions.props‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,18 +22,18 @@
2222
</PropertyGroup>
2323
<!-- Packages that come from https://github.com/dotnet/winforms -->
2424
<PropertyGroup>
25-
<MicrosoftPrivateWinformsVersion>8.0.3-servicing.24116.3</MicrosoftPrivateWinformsVersion>
25+
<MicrosoftPrivateWinformsVersion>8.0.4-servicing.24169.11</MicrosoftPrivateWinformsVersion>
2626
</PropertyGroup>
2727
<!-- Packages that come from https://github.com/dotnet/runtime -->
2828
<PropertyGroup>
29-
<VSRedistCommonNetCoreSharedFrameworkx6480PackageVersion>8.0.3-servicing.24114.23</VSRedistCommonNetCoreSharedFrameworkx6480PackageVersion>
30-
<MicrosoftNETCoreAppRefVersion>8.0.3</MicrosoftNETCoreAppRefVersion>
31-
<MicrosoftNETCoreAppRuntimewinx64Version>8.0.3</MicrosoftNETCoreAppRuntimewinx64Version>
32-
<MicrosoftNETCorePlatformsVersion>8.0.3-servicing.24114.23</MicrosoftNETCorePlatformsVersion>
29+
<VSRedistCommonNetCoreSharedFrameworkx6480PackageVersion>8.0.4-servicing.24169.9</VSRedistCommonNetCoreSharedFrameworkx6480PackageVersion>
30+
<MicrosoftNETCoreAppRefVersion>8.0.4</MicrosoftNETCoreAppRefVersion>
31+
<MicrosoftNETCoreAppRuntimewinx64Version>8.0.4</MicrosoftNETCoreAppRuntimewinx64Version>
32+
<MicrosoftNETCorePlatformsVersion>8.0.4-servicing.24169.9</MicrosoftNETCorePlatformsVersion>
3333
<SystemCodeDomPackageVersion>8.0.0</SystemCodeDomPackageVersion>
3434
<SystemConfigurationConfigurationManagerPackageVersion>8.0.0</SystemConfigurationConfigurationManagerPackageVersion>
3535
<SystemDiagnosticsEventLogPackageVersion>8.0.0</SystemDiagnosticsEventLogPackageVersion>
36-
<SystemDrawingCommonVersion>8.0.3</SystemDrawingCommonVersion>
36+
<SystemDrawingCommonVersion>8.0.4</SystemDrawingCommonVersion>
3737
<SystemDirectoryServicesVersion>8.0.0</SystemDirectoryServicesVersion>
3838
<SystemIOPackagingVersion>8.0.0</SystemIOPackagingVersion>
3939
<SystemReflectionMetadataLoadContextVersion>8.0.0</SystemReflectionMetadataLoadContextVersion>

‎src/Microsoft.DotNet.Wpf/src/PenImc/dll/ComLockableWrapper.hpp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,11 @@ namespace ComUtils
4040
// The apartment is verified during this call.
4141
HRESULT Unlock();
4242

43+
// Unlocking a wrapper permanently nulls out the server object pointer, so a
44+
// wrapper contains a non-null server object pointer if and only if it is
45+
// bound to a server object which has never been unlocked.
46+
bool HasNotBeenUnlocked() { return (m_serverObject != nullptr); }
47+
4348
private:
4449

4550
IUnknown *m_serverObject;

‎src/Microsoft.DotNet.Wpf/src/PenImc/dll/PimcManager.cpp‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -396,6 +396,94 @@ void CPimcManager::TerminateHookThread(__inout CHookThreadItem * pThread)
396396
void CPimcManager::FinalRelease()
397397
{
398398
m_wispManagerLock.RevokeIfValid();
399+
400+
//
401+
// The CComObject<CPimcManager> destructor is the only function which calls into this
402+
// FinalRelease code.
403+
//
404+
// In all successful usage of CPimcManager: 1) Managed WPF code uses CoCreateInstance
405+
// to acquire an IPimcManager2 interface to a brand-new CPimcManager instance (created by
406+
// the ATL CComCreator<T>::CreateInstance machinery), meaning FinalConstruct by-definition
407+
// completes successfully, meaning "m_managerLock" is therefore guaranteed to be locked;
408+
// 2) Managed WPF code then runs through its full end-to-end usage of the CPimcManager
409+
// object (generally managed by the code in PenThreadWorker.cs); 3) When/if the managed WPF
410+
// code determines that the CPimcManager object is no longer needed, it sends a
411+
// RELEASE_MANAGER_EXT message (see UnsafeNativeMethods.ReleaseManagerExternalLock()) which
412+
// unlocks "m_managerLock"; 4) Now that it is unlocked, the CComObject<CPimcManager> object
413+
// can be destroyed when/if its refcount drops to zero, and this FinalRelease function will
414+
// run at that time.
415+
//
416+
// So in all successful usage cases, it is guaranteed that "m_managerLock" is already
417+
// unlocked when this code runs (because if it was still locked, the lock itself would have
418+
// prevented the refcount from reaching zero, and would have prevented this function from
419+
// ever running).
420+
//
421+
// That said, in unsuccessful usage cases, the ATL CComCreator<T>::CreateInstance machinery
422+
// can fail, meaning it will destroy the brand-new CPimcManager instance before returning
423+
// an error back to the CreateInstance caller. Destroying the brand-new instance triggers
424+
// the CComObject<CPimcManager> destructor and therefore calls into this function during
425+
// the CComCreator<T>::CreateInstance operation itself.
426+
//
427+
// The final step in CComCreator<T>::CreateInstance is a QI which queries the newly-created
428+
// object for whatever interface has been requested by the caller. This operation is the
429+
// main way that CComCreator<T>::CreateInstance can fail. For example, this QI is
430+
// guaranteed to fail whenever the CoCreateInstance caller targets the CPimcManager CLSID
431+
// but passes in a "random" IID that has nothing to do with IPimcManager2 or anything else
432+
// that CPimcManager implements.
433+
//
434+
// (In CPimcManager construction, outside of pathological cases (e.g., where a small heap
435+
// allocation in OS code fails due to out-of-memory), there are no other known ways that
436+
// the CComCreator<T>::CreateInstance sequence can fail; so the QI failure is the only
437+
// failure mode that is known to be of general interest.)
438+
//
439+
// The QI failure can only occur after the preceding FinalConstruct call has completed
440+
// successfully (since any FinalConstruct failure would have caused
441+
// CComCreator<T>::CreateInstance to abort without ever trying the QI); since
442+
// CPimcManager::FinalConstruct always locks the "m_managerLock", this implies that the
443+
// "m_managerLock" is guaranteed to be locked when this code runs (which is exactly
444+
// opposite to what happens in all successful usage cases as discussed above).
445+
//
446+
// In this case, it is crucial to unlock "m_managerLock" before allowing this CPimcManager
447+
// object to be destroyed. Without the unlock, this CPimcManager object would be destroyed
448+
// while the associated CStdIdentity in the OS code still holds a reference to it; during
449+
// any future apartment unload, the OS code would release this reference, and the release
450+
// would be a use-after-free at that point.
451+
//
452+
// Note that the crucial unlock causes overactive ATL debug asserts to fire if a chk build
453+
// of this DLL is used; specifically:
454+
//
455+
// - The code in the CComObject<CPimcManager> destructor always stomps the refcount to
456+
// 0xc0000001 (i.e., "-(LONG_MAX/2)"), meaning this CPimcManager object's refcount is
457+
// always 0xc0000001 when this code runs; unlocking "m_managerLock" will cause the refcount
458+
// to drop by one (because, as discussed above, the crucial operation which prevents
459+
// use-after-free problems will release the associated CStdIdentity's reference to this
460+
// CPimcManager object, and in this way releases the reference that was added when
461+
// "managerLock" was locked during FinalConstruct); as a result, unlocking "m_managerLock"
462+
// will move this CPimcManager object's refcount through a "0xc0000001 -> 0xc0000000"
463+
// transition.
464+
//
465+
// - Both of the CComObjectRootEx<T>::InternalRelease specializations contain debug asserts
466+
// which will fire whenever the refcount drops below 0xc0000001, so this transition always
467+
// triggers a debug assert when using a chk build of this DLL.
468+
//
469+
// - That said, all evidence strongly suggests that this is just an overactive assert in
470+
// the ATL code (probably just indicating that it is rare for FinalConstruct to add
471+
// "self-references" like it does for CPimcManager (since these self-references generally
472+
// prevent the server object from being destroyed unless a manual action like the
473+
// RELEASE_MANAGER_EXT message is taken later on), meaning it is rare to have a situation
474+
// where FinalRelease needs to release self-references that were acquired in
475+
// FinalConstruct, meaning this is a rare enough case that the ATL authors either didn't
476+
// test it or didn't think it was common enough to warrant adjusting the assert).
477+
//
478+
// Since this change is being made in servicing, attempt to change behavior as little as
479+
// possible in the "successful usage" cases where "m_managerLock" is already unlocked,
480+
// while still ensuring that FinalRelease will always run the crucial unlock in all
481+
// "unsuccessful usage" cases.
482+
//
483+
if (m_managerLock.HasNotBeenUnlocked())
484+
{
485+
m_managerLock.Unlock();
486+
}
399487
}
400488

401489
/////////////////////////////////////////////////////////////////////////////

0 commit comments

Comments
 (0)