BUG: __raise throws access violation if __unhook called from inside event handler (native events)

[Boris Fortes]

I need to unhook event receiver as result of native C++ event.
It unhooks successfully, but __raise does not return and throws access
violation.

Visual Studio 2003

How to reproduce:

Consol Win32 exe project

#include "stdafx.h"

[event_source(native)]
class Publisher
{
public:
__event void Signal(Publisher* sender);
void RaiseSignal()
{
// throws access violation
__raise Signal(this);
}

};

[event_receiver(native)]
class Subscriber
{
public:

void Handler(Publisher* sender)
{
// unhooks successfully
Unhook(sender);
return;
}

void Hook(Publisher* sender)
{
__hook(&Publisher::Signal, sender, &Subscriber::Handler, this);
return;
}

void Unhook(Publisher* sender)
{
__unhook(&Publisher::Signal, sender, &Subscriber::Handler, this);
return;
}


};

int _tmain(int argc, _TCHAR* argv[])
{
Publisher pub;
Subscriber sub;

sub.Hook(&pub);
pub.RaiseSignal();
return 0;
}

Debug output window

'Hook.exe': Loaded 'C:\Projects\Hook\Debug\Hook.exe', Symbols loaded.
'Hook.exe': Loaded 'C:\WINDOWS\SYSTEM32\ntdll.dll', Symbols loaded.
'Hook.exe': Loaded 'C:\WINDOWS\SYSTEM32\kernel32.dll', Symbols loaded.
First-chance exception at 0x00411e51 in Hook.exe: 0xC0000005: Access
violation reading location 0xfeeefeee.
Unhandled exception at 0x00411e51 in Hook.exe: 0xC0000005: Access
violation reading location 0xfeeefeee.

 

[Igor Tandetnik]

I need to unhook event receiver as result of native C++ event.
It unhooks successfully, but __raise does not return and throws access
violation.

See if this helps: KB Article KB811193 "BUG: Access Violation Exception
When a Native Event is Fired or Unhooked"
--
With best wishes,
Igor Tandetnik

"For every complex problem, there is a solution that is simple, neat,
and wrong." H.L. Mencken

 

[Guest]

Hi,

Calling __unhook in a handler should cause a race condition, but because the
injected critical section code does nothing (???), so your code get pass but
a GPF happened because the call was between walking functor node.

You can check this with /Fx switch.