> Holy mackerel! Instances of this bug date back to 1999!
Different bug. That appears to be a trivial exhaustion of CSRSS worker threads
through indiscriminate calls to MessageBox+MB_SERVICE_NOTIFICATION, which
causes a DoS as no threads are available to serve kernel-mode requests from
win32k, stalling GUI processes. I have done my fair share of CSRSS reversing in
my better days, and I'm pretty sure that in Windows 2000 and later, a dedicated
thread is used for such notifications, not just any thread, any time. Easily
verifiable with local net sends and Spy++. It wasn't a "bug" either, more like
a serious design flaw that ignored a very basic Win32 mantra ("don't do GUI in
a worker thread") - not at all like this double-free
|