.NET Framework 4 Beta 2: Global Assembly Cache viewer causes memory corruption. - by alanfeld

Status : 

  Fixed<br /><br />
		This item has been fixed in the current or upcoming version of this product.<br /><br />
		A more detailed explanation for the resolution of this particular item may have been provided in the comments section.


1
0
Sign in
to vote
ID 525646 Comments
Status Closed Workarounds
Type Bug Repros 0
Opened 1/18/2010 10:35:54 PM
Access Restriction Public

Description

The .NET Framework contains a Global Assembly Cache or GAC viewer. For the user's convenience this is a shell extension so that the user can view the GAC right from within Windows Explorer.

This .NET Framework dll contains a bug which causes its hosting process, Explorer.exe, to crash.

Follow the steps in the Steps to Reproduce section which shows that shfusion.dll (the GAC viewer) is causing memory corruption which leads to the crash of its hosting process, Explorer.exe.

The crash in Explorer.exe is caused by the way in which shfusion.dll (a part of the .NET Framework) is placing text on the clipboard. The problem is that shfusion.dll is calling "GlobalFree()" after calling "SetClipboardData()". Once SetClipboardData() is called the calling application no longer owns that memory and must not free the memory.

See Raymond Chen's article on this topic:

"You can't give away something that isn't yours"
http://blogs.msdn.com/oldnewthing/archive/2008/05/27/8553638.aspx
Sign in to post a comment.
Posted by Microsoft on 2/3/2010 at 3:31 PM
The issue is fixed in the new version of the CLR because we no longer ship shfusion.dll starting with .NET Framework 4.0 Beta 2. What you are observing is the bug in shfusion.dll in .NET Framework 3.5 SP1, which is included in Windows 7 RTM. The Global Assembly Cache for assemblies targeting the .NET Framework 4.0 is located in %windir%\Microsoft.NET\assembly. Notice that if you open that directory in Windows Explorer, shfusion does not get launched.

We considered fixing this in the .NET Framework 3.5 SP1 and decided not to.

Thank you very much for reporting this issue to us on more than one occasion and for tracking down the exact line in our code that caused the issue.
Posted by Microsoft on 1/19/2010 at 1:39 AM
Thank you for your feedback, we are currently reviewing the issue you have submitted. If this issue is urgent, please contact support directly(http://support.microsoft.com)