[ruby-core:70690] [Ruby trunk - Bug #11515] [Open] CreateProcessW() can cause "Invalid access to memory location"

[ruby-core:70690] [Ruby trunk - Bug #11515] [Open] CreateProcessW() can cause "Invalid access to memory location"

[docwhat]

Issue #11515 has been reported by Christian Höltje.

----------------------------------------
Bug #11515: CreateProcessW() can cause "Invalid access to memory location"
https://bugs.ruby-lang.org/issues/11515

* Author: Christian Höltje
* Status: Open
* Priority: Normal
* Assignee: 
* ruby -v: 
* Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN
----------------------------------------
The second argument for `CreateProcessW()` needs to *not* be a constant because it may be modified:

From https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx :

> The Unicode version of this function, CreateProcessW, can modify the contents of this string. Therefore, this parameter cannot be a pointer to read-only memory (such as a const variable or a literal string). If this parameter is a constant string, the function may cause an access violation.

This would explain sporadic "Invalid access to memory location" errors people see on Windows.

To resolve ths, `cmd` should be copied into a temporary variable before CreateProcessW() is called.

I've attached a patch that might work, but I'm not an expert C/Windows programmer.

---Files--------------------------------
ruby-CreateProcessW-memory-error.diff (919 Bytes)


-- 
https://bugs.ruby-lang.org/

[ruby-core:70694] [Ruby trunk - Bug #11515] [Feedback] CreateProcessW() can cause "Invalid access to memory location"

[nobu]

Issue #11515 has been updated by Nobuyoshi Nakada.

Status changed from Open to Feedback

`CreateChild` is never called with a constant `cmd`, as it is build at the runtime.
How can you reproduce it?

----------------------------------------
Bug #11515: CreateProcessW() can cause "Invalid access to memory location"
https://bugs.ruby-lang.org/issues/11515#change-54087

* Author: Christian Höltje
* Status: Feedback
* Priority: Normal
* Assignee: 
* ruby -v: 
* Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN
----------------------------------------
The second argument for `CreateProcessW()` needs to *not* be a constant because it may be modified:

From https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx :

> The Unicode version of this function, CreateProcessW, can modify the contents of this string. Therefore, this parameter cannot be a pointer to read-only memory (such as a const variable or a literal string). If this parameter is a constant string, the function may cause an access violation.

This would explain sporadic "Invalid access to memory location" errors people see on Windows.

To resolve ths, `cmd` should be copied into a temporary variable before CreateProcessW() is called.

I've attached a patch that might work, but I'm not an expert C/Windows programmer.

---Files--------------------------------
ruby-CreateProcessW-memory-error.diff (919 Bytes)


-- 
https://bugs.ruby-lang.org/

[ruby-core:70991] [Ruby trunk - Bug #11515] CreateProcessW() can cause "Invalid access to memory location"

[docwhat]

Issue #11515 has been updated by Christian Höltje.


Nobuyoshi Nakada wrote:
> `CreateChild` is never called with a constant `cmd`, as it is build at the runtime.

Am I reading the code wrong then?  The function declaration says `cmd` is a `const WCHAR *`.

~~~
CreateChild(const WCHAR *cmd, ...)
~~~

As I said, I'm no expert at this.  I googled a bunch and I found the MSDN page mentioned above.  The *only* place it mentions memory access errors is if you pass `cmd` as a "constant string".  I'm unsure if they mean the *pointer* to the string or, the memory the pointer points at, or both.

My patch assumes "both" and makes a copy.

> How can you reproduce it?

Well, that's tricky since the OS decides whether or not to move things around.  So there is no way to guarantee reproducing the error.

----------------------------------------
Bug #11515: CreateProcessW() can cause "Invalid access to memory location"
https://bugs.ruby-lang.org/issues/11515#change-54366

* Author: Christian Höltje
* Status: Feedback
* Priority: Normal
* Assignee: 
* ruby -v: 
* Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN
----------------------------------------
The second argument for `CreateProcessW()` needs to *not* be a constant because it may be modified:

From https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx :

> The Unicode version of this function, CreateProcessW, can modify the contents of this string. Therefore, this parameter cannot be a pointer to read-only memory (such as a const variable or a literal string). If this parameter is a constant string, the function may cause an access violation.

This would explain sporadic "Invalid access to memory location" errors people see on Windows.

To resolve ths, `cmd` should be copied into a temporary variable before CreateProcessW() is called.

I've attached a patch that might work, but I'm not an expert C/Windows programmer.

---Files--------------------------------
ruby-CreateProcessW-memory-error.diff (919 Bytes)


-- 
https://bugs.ruby-lang.org/

[ruby-core:70993] [Ruby trunk - Bug #11515] CreateProcessW() can cause "Invalid access to memory location"

[docwhat]

Issue #11515 has been updated by Christian Höltje.


I found an alternative code version here: http://stackoverflow.com/questions/4514027/createprocessw-acess-violation-in-rtlinitunicodestring

~~~
//I'm copying the string here because CreateProcessW mutates its arguments
wchar_t *tmpCmd = _wcsdup(cmd);
...
free(tmpCmd);
~~~

As I said, I'm not huge C programmer and definitely not a windows programmer.  I don't know what the difference between `_wcsdup()` vs. `_tcscpy_s()` are and why you'd want one over another.  Though since `_wcsdup()` looks smarter since it'll allocate its own memory.

Someone asked what this meant here: https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/1e799be4-addf-40d8-b49a-cab2321accba/createprocessw-lpcommandline?forum=windowssdk -- I'm not sure if that helps, but I'm trying to do as suggested: create a `WCHAR` buffer to copy the strings into.

There is a blog post describing the history of `CreateProcessW()` which is informative: http://blogs.msdn.com/b/oldnewthing/archive/2009/06/01/9673254.aspx

As I said, I don't know enough.  If the passed in `cmd` is not constant really and is acceptable, then ignore me.

----------------------------------------
Bug #11515: CreateProcessW() can cause "Invalid access to memory location"
https://bugs.ruby-lang.org/issues/11515#change-54369

* Author: Christian Höltje
* Status: Feedback
* Priority: Normal
* Assignee: 
* ruby -v: 
* Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN
----------------------------------------
The second argument for `CreateProcessW()` needs to *not* be a constant because it may be modified:

From https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx :

> The Unicode version of this function, CreateProcessW, can modify the contents of this string. Therefore, this parameter cannot be a pointer to read-only memory (such as a const variable or a literal string). If this parameter is a constant string, the function may cause an access violation.

This would explain sporadic "Invalid access to memory location" errors people see on Windows.

To resolve ths, `cmd` should be copied into a temporary variable before CreateProcessW() is called.

I've attached a patch that might work, but I'm not an expert C/Windows programmer.

---Files--------------------------------
ruby-CreateProcessW-memory-error.diff (919 Bytes)


-- 
https://bugs.ruby-lang.org/

[ruby-core:71096] [Ruby trunk - Bug #11515] [Rejected] CreateProcessW() can cause "Invalid access to memory location"

[nobu]

Issue #11515 has been updated by Nobuyoshi Nakada.

Status changed from Feedback to Rejected

`cmd` in `CreateChild()` is always allocated in heap.
win32/win32.c does not provide wchar-version `spawn` functions.

----------------------------------------
Bug #11515: CreateProcessW() can cause "Invalid access to memory location"
https://bugs.ruby-lang.org/issues/11515#change-54462

* Author: Christian Höltje
* Status: Rejected
* Priority: Normal
* Assignee: 
* ruby -v: 
* Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN
----------------------------------------
The second argument for `CreateProcessW()` needs to *not* be a constant because it may be modified:

From https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx :

> The Unicode version of this function, CreateProcessW, can modify the contents of this string. Therefore, this parameter cannot be a pointer to read-only memory (such as a const variable or a literal string). If this parameter is a constant string, the function may cause an access violation.

This would explain sporadic "Invalid access to memory location" errors people see on Windows.

To resolve ths, `cmd` should be copied into a temporary variable before CreateProcessW() is called.

I've attached a patch that might work, but I'm not an expert C/Windows programmer.

---Files--------------------------------
ruby-CreateProcessW-memory-error.diff (919 Bytes)


-- 
https://bugs.ruby-lang.org/