What situations provoke a .net 2.0 String constructor to throw an exception? - c++-cli

Question

I have some code which sometimes (but not always) throws the exception described in a Microsoft kb article when using a particular form of the String costructor.
In essence, my code looks like this (except the input string array varies in length depending on the input):
int arraySize = 8;
char* charArray3 = new char[arraySize];
memset(charArray3, 0x61, arraySize);
char * pstr3 = &charArray3[0];
String^ szAsciiUpper = gcnew String(pstr3, 0, arraySize);
The kb article suggests this 'may' cause the exception to be thrown but my unit tests and most of the time in the wild, it never appears.
I'd like to know what would provoke the exception so that I can replicate it in my unit tests and verify it's fixed permanently in our codebase.

Answer 1

This bug appears in src/vm/comstring.cpp, COMString::StringInitCharHelper() function. This is the evil-doer:
if( IsBadReadPtr(pszSource, (UINT_PTR)length + 1)) {
COMPlusThrowArgumentOutOfRange(L"ptr", L"ArgumentOutOfRange_PartialWCHAR");
}
Or in other words, it will peek at length+1 and take a nose-dive when IsBadReadPtr() returns false. Yes, you have to be unlucky, your charArray3 would have to be allocated exactly at the end of a memory page and the next page must be inaccessible. That doesn't happen very often.
Not so sure there is any point in trying to repro the bug, it is just too random. Simply make your array 1 element bigger to avoid it. Or move to .NET 4, they did fix it simply by removing the check completely.

Answer 2

They fixed it in 4.0, still broken in 2.0:
using System;
using System.Runtime.InteropServices;
namespace ConsoleApplication13
{
class Program
{
[DllImport("kernel32.dll", SetLastError = true)]
static extern IntPtr VirtualAlloc(IntPtr lpAddress, IntPtr dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError = true)]
static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect);
// For .NET 4.0
//[System.Runtime.ExceptionServices.HandleProcessCorruptedStateExceptions]
static unsafe void Main(string[] args)
{
IntPtr ptr = VirtualAlloc(
IntPtr.Zero,
(IntPtr)(4096 * 2),
0x1000 /* MEM_COMMIT */ | 0x2000 /* MEM_RESERVE */,
0x04 /* PAGE_READWRITE */);
IntPtr page1 = ptr;
IntPtr page2 = (IntPtr)((long)ptr + 4096);
uint oldAccess;
bool res = VirtualProtect(page2, 4096, 0x01 /* PAGE_NOACCESS */, out oldAccess);
try
{
Marshal.WriteByte(page1, 1);
Console.WriteLine("OK");
}
catch (AccessViolationException)
{
Console.WriteLine("KO");
}
try
{
Marshal.WriteByte(page2, 1);
Console.WriteLine("KO");
}
catch (AccessViolationException)
{
Console.WriteLine("OK");
}
try
{
byte b1 = Marshal.ReadByte(page1);
Console.WriteLine("OK");
}
catch (AccessViolationException)
{
Console.WriteLine("KO");
}
try
{
byte b2 = Marshal.ReadByte(page2);
Console.WriteLine("KO");
}
catch (AccessViolationException)
{
Console.WriteLine("OK");
}
for (int i = 0; i < 4096; i++)
{
Marshal.WriteByte(page1, i, (byte)'A');
}
sbyte* ptr2 = (sbyte*)page1;
try
{
var st1 = new string(ptr2, 0, 4096);
Console.WriteLine("OK");
}
catch (ArgumentOutOfRangeException)
{
Console.WriteLine("KO");
}
}
}
}
You have to uncomment a line in .NET 4.0 . Note that this code doesn't free the memory it allocates, but it isn't a big problem, because when a process ends the memory is reclaimed by the OS.
What does this program do? It allocates 8192 bytes (2 pages) using VirtualAlloc. By using VirtualAlloc the two pages are page aligned. It disable access to the second page (with VirtualProtect). Then it fills the first page with 'A'. Then it tries to create a string from the first page. On .NET 2.0, the string constructor tries to read the first byte of the second page (even if you told it that the string was only long 4096 bytes).
In the middle there are some tests that check if the pages can be read/written.
Normally it is difficult to check this condition because it is difficult to have a block of memory that is exactly at the end of the allocated readable memory space.

Answer 3

In case anyone's interested, this is how to replicate it in C++/CLI (based entirely on xanatos' answer):
LPVOID ptr = VirtualAlloc(0, 4096 * 2, 0x1000, 0x04); // ReadWrite
LPVOID page1 = ptr;
LPVOID page2 = (LPVOID)((long)ptr + 4096);
DWORD oldAccess;
bool res = VirtualProtect(page2, 4096, 0x01, &oldAccess);
char* ptr2 = (char*)page1;
String^ st1 = gcnew String(ptr2, 0, 4096); // <-- This will cause the exception.
Console::WriteLine(st1);