FIX: You encounter an access violation when you serialize a Unicode CString in Visual C++ 6.0 (193100)

SYMPTOMS

When serializing in a Unicode CString in an MBCS MFC application or vice versa, the CString from file is read in, converted to a CString of the build type, and the original CString is deleted. When deleting the original CString you may see an access violation or invalid page fault. The problem code is on line 270 in Arccore.cpp. The symptoms described here are evident only in release builds.

CAUSE

CString in the release build uses its own memory manager (the CFixedAlloc class) for strings of size less the 512 bytes. So for all CString (of less than 512 bytes) allocations made by CFixedAlloc::Alloc() through CString::AllocBuffer() and the corresponding deallocations are made by CFixedAlloc::Free through CString::FreeData(). In the CString serialization function operator:

>> (CArchive& ar, CString& string)

instead of calling CString::FreeData() to free the data, the operator delete is called and this can cause the above mentioned problem.

RESOLUTION

Change line 270 in Arccore.cpp from the following:

delete[] (BYTE*)pOldData;

to the following:

CString::FreeData(pOldData);

Rebuild the MFC libraries and statically link to it. The following command builds the debug MFC library without CodeView information (Nafxcwd.lib):

NMAKE DEBUG=1 CODEVIEW=0

Further information on building a static link library variant can be obtained from the Readme.txt file that ships with Visual C++, or in xxxx\MFC\SRC\README.TXT (where xxxx is the directory name for the Visual C++ product; by default, C:\Program Files\Microsoft Visual Studio\VC98 for Visual C++ version 6.0). The make file exists in the same directory and is named MAKEFILE.

Note You may modify the source and rebuild a DLL version of the MFC library. However, you can redistribute a retail (/release) of your modified library only if you rename it to something other than MFCxx.dll. You may not redistribute the debug version of either the pre-built or custom built debug DLL. Please refer to "MFC Technical Note 33" for more information.

STATUS

Microsoft has confirmed that this is a bug in the Microsoft products that are listed in the "Applies to" section. This bug has been fixed in Visual Studio 6.0 Service Pack 1.

To obtain this service pack, visit the following Microsoft Developer Network (MSDN) Web site:

http://msdn.microsoft.com/vstudio/downloads/updates/sp/vs6/default.aspx

For more information about Visual Studio 6.0 Service Pack 1, click the following article numbers to view the articles in the Microsoft Knowledge Base:

193009 Visual Studio 6.0 Service Pack 1 Readme

194022 Visual Studio 6.0 service packs, what, where, why

194295 How to tell that a Visual Studio service pack is installed

MORE INFORMATION

The call stack when the access violation occurs should resemble the following:

   HeapFree(...)
   free(...)
   operator delete(...)
   operator>>(CArchive &, CString &)