dotnet / dotnet/wpf

Potential TOCTTOU race in Window.ShowDialog

Open
#1,983 1 comment 1 reaction 0 assignees View on GitHub
.NET Framework
Dominant language
C#
Stars
7.7k
Forks
1.3k
Avg merge
1d 11h
Merged PRs (30d)
61

Description

* .NET Core Version: (The code in question is in master)
* Windows version: It is seen on some version of Windows 10, but haven't reproduced it locally.
* Does the bug reproduce also in WPF for .NET Framework 4.8?: It was probably net48

**Problem description:**

We got this on netfx, but the same code seems to be present in core WPF.
`SafeNativeMethods.ReleaseCapture` throws an exception (`System.ComponentModel.Win32Exception (0x80004005): The operation completed successfully`).

Ignoring the ERROR_SUCCESS result which is outside of the scope of WPF, it looks like this could be caused by a TOCTTOU race in https://github.com/dotnet/wpf/blob/185e2e8c62ede5c188bf3655f862f87eba4a3cb5/src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Window.cs#L375-L399

Note that ReleaseCapture is only able to release capture from a window owned by the current thread. It looks like a window on another thread might be able to "steal" the mouse capture in the time between the two calls - the error from ReleaseCapture should probably just be ignored.

**Actual behavior:**
```
Catching Unhandled exception:System.ComponentModel.Win32Exception (0x80004005): The operation completed successfully
ved MS.Win32.SafeNativeMethods.ReleaseCapture()
ved System.Windows.Window.ShowDialog()
...
```

**Expected behavior:**
ShowDialog succeeds.

**Minimal repro:**
Unfortunately I haven't been able to reproduce the issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.