{"id":108766,"date":"2023-09-14T07:00:00","date_gmt":"2023-09-14T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=108766"},"modified":"2023-09-14T07:29:03","modified_gmt":"2023-09-14T14:29:03","slug":"20230914-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20230914-00\/?p=108766","title":{"rendered":"I accidentally performed an operation on INVALID_HANDLE_VALUE<\/CODE>, and it worked: What just happened?"},"content":{"rendered":"

Suppose you have some code that wants to open a file and share it with another process.<\/p>\n

HANDLE file = CreateFile(...);\r\n\r\nHANDLE dup;\r\nif (DuplicateHandle(\r\n        GetCurrentProcess(), \/* source process *\/\r\n        file, \/* source handle *\/\r\n        targetProcess,\r\n        &dup,\r\n        0,\r\n        FALSE, \/* no inherit *\/\r\n        DUPLICATE_SAME_ACCESS)) {\r\n    ... tell the other process to use \"dup\" ...\r\n}\r\n\r\nCloseHandle(file);\r\n<\/pre>\n
This code is missing some critical error handling: What if the CreateFile<\/code> fails?<\/p>\n
If CreateFile<\/code> fails, it returns INVALID_HANDLE_VALUE<\/code>. This code then passes INVALID_HANDLE_VALUE<\/code> as the source handle to duplicate into the other process. But instead of failing, the Duplicate\u00adHandle<\/code> succeeds and produces a handle. What handle just got duplicated?<\/p>\n
Some time ago, we studied  why HANDLE<\/code> return values are so inconsistent<\/a>, and I mentioned that<\/p>\n
\n
By coincidence, the value INVALID_HANDLE_VALUE<\/code> happens to be numerically equal to the pseudohandle returned by GetCurrentProcess()<\/code>.<\/p>\n<\/blockquote>\n
Therefore, what happened is that we gave a copy of our own process handle to the other process.<\/p>\n
Oops.<\/p>\n
But wait, there’s more. The handle returned by GetCurrentProcess()<\/code> has PROCESS_ALL_ACCESS<\/code> permission. Not only did you give the other process the wrong thing, you gave it possibly the worst possible thing: You gave it full control over your own process<\/i>.<\/p>\n
Double oops.<\/p>\n
Why does GetCurrentProcess()<\/code> return a pseudo-handle value that matches a common error case that people could overlook? I don’t know, but I have an idea.<\/p>\n
Developer 1: “Hey, what fake handle value should GetCurrentProcess()<\/code> return?”<\/p>\n
Developer 2: “I dunno. We need to pick something that is guaranteed never to accidentally match a real handle value.”<\/p>\n
Developer 1: “Look, there’s this special value INVALID_HANDLE_VALUE<\/code> that is returned to indicate that an error occurred. This is provably a handle value that can never match a real handle, since it is used to indicate a problem.”<\/p>\n
Developer 2: “Great, let’s use that!”<\/p>\n
It seemed like a good idea at the time. For a special value, use something that couldn’t possibly conflict with a normal value.<\/p>\n
Unfortunately, people are fallible, and bugs can occur like<\/p>\n
HANDLE file = INVALID_HANDLE_VALUE;\r\n\r\nif (want_file) {\r\n    file = CreateFile(...);\r\n    if (file == INVALID_HANDLE_VALUE) {\r\n        error();\r\n        return;\r\n    }\r\n\r\n\/* other intervening code *\/\r\n\r\n\/\/ Okay, give the file to the other process.\r\nHANDLE dup;\r\nif (DuplicateHandle(\r\n        GetCurrentProcess(), \/* source process *\/\r\n        file, \/* source handle *\/\r\n        targetProcess,\r\n        &dup,\r\n        0,\r\n        FALSE, \/* no inherit *\/\r\n        DUPLICATE_SAME_ACCESS)) {\r\n    ... tell the other process to use \"dup\" ...\r\n}\r\n\r\nCloseHandle(file);\r\n<\/pre>\n
The code that calls Duplicate\u00adHandle<\/code> forgot to check whether want_file<\/code> is set and inadvertently passed INVALID_HANDLE_VALUE<\/code>. Oops, duplicated a full-access process handle.<\/p>\n
This pattern of “using an invalid value to carry a special alternate meaning” is actually quite common. For example, Set\u00adWindows\u00adHook\u00adEx<\/code> uses a thread ID of zero to mean “global hook”, since zero is not a valid thread ID. And many functions imbue the special value nullptr<\/code> with all sorts of special meaning.<\/p>\n
In retrospect, the choice to use INVALID_HANDLE_VALUE<\/code> as a pseudohandle was unfortunate. But what happened happened. You can’t change the past, and in computer software, you have to live with your mistakes.<\/p>\n
Coincidentally valid, but not what you think.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-108766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
Coincidentally valid, but not what you think.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/108766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=108766"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/108766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=108766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=108766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=108766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Bonus chatter<\/b>: RPC has the  system_handle<\/code> attribute<\/a> which lets you pass kernel handles via RPC, and you also have to say what kind of kernel handle you intend to pass. For files, you say system_handle(sh_file)<\/code>. If you pass the wrong kind of handle, the operation fails. There’s  a sample in the Windows Classic Samples repo<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"