0

Today, I was checking source code of the CRT library of Visual Studio 2008 and 2010 and I found a bug into the file mtdll.h. The problem is with the macro FLS_GETVALUE. On x86 systems, this macro call directly TlsGetValue instead of making a call to the function assigned to the variable gpFlsGetValue.

First of all, it's a problem because FlsAlloc, FlsGetValue, FlsFree and FlsSetValue are not available on all system( Windows Vista+ and Windows Server 2003+). These functions behave like TlsAlloc, TlsGetValue, TlsFree and TlsSetValue but support Fibers(kind of user thread). Because we should prefer using Fls* functions instead of Tls functions, the C runtime library of VS check if the Fls functions are availables when the process or the dll is loaded and initialise the gpFls* variables. If the Fls* are not available, the CRT initialise these variables with the equivalent Tls* functions.

You cannot use the macro FLS_GETVALUE directly into your code because it's used internally by the runtime library. The runtime use this macro to initialise per thread data of the runtime library.

My question is about the impact of this bug. I know that fiber are not widely used, but if you develop a DLL that is used inside an application that use fiber, what can be the impact? Does this bug can cause a crash of the application or only produce false results? Does this problem can cause problem with widely used application like SQL Server? What do you think? Does this bug can be a security risk? Does IIS or ASP.Net use fiber that can cause a crash?

For curious people, here the current source of the problematic line in mtdll.h:

#define FLS_GETVALUE ((PFLS_GETVALUE_FUNCTION)TlsGetValue(__getvalueindex))

Here a fixed version of the macro FLS_GETVALUE :

#define FLS_GETVALUE (((PFLS_GETVALUE_FUNCTION)DecodePointer(gpFlsGetValue))(__getvalueindex))

For now, I should find how to submit a bug to Microsoft.

1

1 Answer 1

0

I'm not sure about that. The CRT seems to handle FlsGetValue differently from the other FLS functions. It looks like the CRT is storing a pointer to the FlsGetValue function in TLS (pseudo-code):

void init_fls()
{
    FLS_GET_VALUE_PROC proc = GetProcAddress(kernel32, "FlsGetValue");
    if(!proc)
    {
        // FlsGetValue not implemented on this platform
        // use alternative implementation provided by CRT
        proc = __crtFlsGetValue;
    }
    // store pointer to FlsGetValue proc in TLS
    TlsSetValue(fls_get_value_index, proc);
}

void* get_fls_value(int index)
{
    // retrieve pointer to FlsGetValue proc from TLS
    FLS_GET_VALUE_PROC proc = TlsGetValue(fls_get_value_index);
    return proc(index);
}

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.