Potential TOCTTOU race in Window.ShowDialog
- Dominant language
- C#
- Stars
- 7.7k
- Forks
- 1.3k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 61
Description
* .NET Core Version: (The code in question is in master)
* Windows version: It is seen on some version of Windows 10, but haven't reproduced it locally.
* Does the bug reproduce also in WPF for .NET Framework 4.8?: It was probably net48
**Problem description:**
We got this on netfx, but the same code seems to be present in core WPF.
`SafeNativeMethods.ReleaseCapture` throws an exception (`System.ComponentModel.Win32Exception (0x80004005): The operation completed successfully`).
Ignoring the ERROR_SUCCESS result which is outside of the scope of WPF, it looks like this could be caused by a TOCTTOU race in https://github.com/dotnet/wpf/blob/185e2e8c62ede5c188bf3655f862f87eba4a3cb5/src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Window.cs#L375-L399
Note that ReleaseCapture is only able to release capture from a window owned by the current thread. It looks like a window on another thread might be able to "steal" the mouse capture in the time between the two calls - the error from ReleaseCapture should probably just be ignored.
**Actual behavior:**
```
Catching Unhandled exception:System.ComponentModel.Win32Exception (0x80004005): The operation completed successfully
ved MS.Win32.SafeNativeMethods.ReleaseCapture()
ved System.Windows.Window.ShowDialog()
...
```
**Expected behavior:**
ShowDialog succeeds.
**Minimal repro:**
Unfortunately I haven't been able to reproduce the issue.
Contributor guide
Assessment
This issue has not been assessed yet.