An application that implements the IMallocSpy debugging interface may experience heap corruption after you install security update 873333 (894194)


The information in this article applies to:

  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Datacenter Edition
  • Microsoft Windows Server 2003, Datacenter Edition for Itanium-based Systems
  • Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
  • Microsoft Windows XP Professional 64-Bit Edition (Itanium) 2003
  • Microsoft Windows XP 64-Bit Edition Version 2002 SP1
  • Microsoft Windows XP Tablet PC Edition 2005
  • Microsoft Windows XP Media Center Edition 2005
  • Microsoft Windows XP Tablet PC Edition
  • Microsoft Windows XP Home Edition Service Pack 2 (SP2)
  • Microsoft Windows XP Professional Service Pack 2 (SP2)
  • Microsoft Windows XP Home Edition SP1
  • Microsoft Windows XP Professional SP1
  • Microsoft Windows 2000 Advanced Server SP4
  • Microsoft Windows 2000 Datacenter Server SP4
  • Microsoft Windows 2000 Professional SP4
  • Microsoft Windows 2000 Server SP4
  • Microsoft Windows 2000 Advanced Server SP3
  • Microsoft Windows 2000 Datacenter Server SP3
  • Microsoft Windows 2000 Professional SP3
  • Microsoft Windows 2000 Server SP3

SYMPTOMS

After you install security update 873333, a component's heap may be corrupted when you use Component Object Model (COM) application programming interfaces (APIs).

CAUSE

This problem occurs when a component uses CoRegisterMallocSpy to register the IMallocSpy debugging interface. When a pointer that does not point to the start of the heap block is returned to the heap, the heap is corrupted.

Some paths in COM APIs call the IMallocSpy::PreAlloc and IMallocSpy::PostAlloc methods without calling the corresponding free methods. If pointer adjustments are made in PostAlloc, the pointer that is returned to the heap will not be valid. Therefore, the heap is corrupted.

RESOLUTION

Hotfix information

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart your computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Microsoft Windows 2000
   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   06-Feb-2005  13:45  5.0.2195.7028     957,712  Ole32.dll        
   06-Feb-2005  13:45  5.0.2195.7009      69,392  Olecli32.dll     
   06-Feb-2005  13:45  5.0.2195.7028      36,624  Olecnv32.dll     
   06-Feb-2005  13:45  5.0.2195.7020     437,008  Rpcrt4.dll       
   06-Feb-2005  13:45  5.0.2195.7028     212,240  Rpcss.dll
NOTE: Because of file dependencies, this hotfix requires Microsoft Windows 2000 Service Pack 4.

Microsoft Windows 2003 (ia64)
   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   07-Feb-2005  12:02  5.2.3790.266    3,578,880  Ole32.dll        IA64
   07-Feb-2005  12:02  5.2.3790.266      223,744  Olecli32.dll     IA64
   07-Feb-2005  12:02  5.2.3790.266       89,088  Olecnv32.dll     IA64
   30-Mar-2004  11:25  5.2.3790.141       73,216  Rpcproxy.dll     IA64
   30-Mar-2004  11:25  5.2.3790.141    2,150,400  Rpcrt4.dll       IA64
   07-Feb-2005  12:02  5.2.3790.266      688,640  Rpcss.dll        IA64
   07-Feb-2005  12:04  5.2.3790.266    1,192,448  Wole32.dll       X86
   07-Feb-2005  12:04  5.2.3790.266       72,192  Wolecli32.dll    X86
   07-Feb-2005  12:04  5.2.3790.266       36,352  Wolecnv32.dll    X86
   30-Mar-2004  11:26  5.2.3790.141       26,112  Wrpcproxy.dll    X86
   30-Mar-2004  11:26  5.2.3790.141      544,256  Wrpcrt4.dll      X86
Microsoft Windows 2003 (x86)
   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   08-Feb-2005  04:04  5.2.3790.266    1,192,448  Ole32.dll        
   08-Feb-2005  04:04  5.2.3790.266       72,192  Olecli32.dll     
   08-Feb-2005  04:04  5.2.3790.266       36,352  Olecnv32.dll     
   16-Mar-2004  03:17  5.2.3790.141       26,112  Rpcproxy.dll     
   16-Mar-2004  03:17  5.2.3790.141      659,968  Rpcrt4.dll       
   08-Feb-2005  04:04  5.2.3790.266      294,912  Rpcss.dll
Microsoft Windows XP Service Pack 1 (ia64)
   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   04-Feb-2005  10:45  5.1.2600.1619   4,353,024  Ole32.dll        IA64
   04-Feb-2005  10:45  5.1.2600.1612     241,152  Olecli32.dll     IA64
   04-Feb-2005  10:45  5.1.2600.1619      97,280  Olecnv32.dll     IA64
   05-Mar-2004  10:07  5.1.2600.1361   2,317,824  Rpcrt4.dll       IA64
   04-Feb-2005  10:45  5.1.2600.1619     785,920  Rpcss.dll        IA64
   04-Feb-2005  10:48  5.1.2600.1619   1,258,496  Wole32.dll       X86
   04-Feb-2005  10:48  5.1.2600.1612      68,608  Wolecli32.dll    X86
   04-Feb-2005  10:48  5.1.2600.1619      35,328  Wolecnv32.dll    X86
   05-Mar-2004  10:16  5.1.2600.1361     509,440  Wrpcrt4.dll      X86
Microsoft Windows XP Service Pack 1 (x86)
   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   05-Feb-2005  02:47  5.1.2600.1619   1,258,496  Ole32.dll        
   05-Feb-2005  02:47  5.1.2600.1612      68,608  Olecli32.dll     
   05-Feb-2005  02:47  5.1.2600.1619      35,328  Olecnv32.dll     
   06-Mar-2004  02:16  5.1.2600.1361     535,552  Rpcrt4.dll       
   05-Feb-2005  02:47  5.1.2600.1619     284,672  Rpcss.dll
Microsoft Windows XP Service Pack 2 (x86)
   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   05-Feb-2005  02:51  5.1.2600.2606   1,284,608  Ole32.dll        
   05-Feb-2005  02:51  5.1.2600.2573      74,752  Olecli32.dll     
   05-Feb-2005  02:51  5.1.2600.2606      37,376  Olecnv32.dll     
   05-Feb-2005  02:51  5.1.2600.2606     395,776  Rpcss.dll
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MORE INFORMATION

IMallocSpy lets program developers monitor memory allocation, detect memory leaks, and simulate memory failure in calls to IMalloc methods. Because IMallocSpy is a debugging interface, its use outside a development environment is unlikely. Therefore, this issue primarily affects developers who use IMallocSpy to debug their program heap allocations.

For more information about IMallocSpy, visit the following Microsoft Web site:

http://msdn.microsoft.com/library/en-us/wcedcom/html/cerefIMallocSpy.asp

For more information about security update 873333, click the following article number to view the article in the Microsoft Knowledge Base:

873333 MS05-012: Vulnerability in OLE and COM could allow remote code execution

Modification Type:MinorLast Reviewed:6/5/2006
Keywords:kbHotfixServer kbQFE kbtshoot kbprb kbSecurity KB894194 kbAudDeveloper
©2004 Microsoft Corporation. All rights reserved.