WinRTAct.dll from Microsoft.WindowsPackageManager.ComInterop NuGet Package crashes with Access Violation when RegFreeWinRT is used (original) (raw)

Brief description of your issue

Using the module winrtact.dll to create WindowsPackageManager instances from an elevated process crashes if the executable uses RegFreeWinRT.

This makes it impossible to use the WinGet COM api from any elevated desktop (non-packaged) process that does use Register-Free WinRT (such as unpackaged self-contained app sdk projects and c++ Desktop Projects using WinRT APIs).

Event Viewer crash:

1000 0 2 100 0 0x8000000000000000 287262 Application pc-name WingetUI.exe 3.0.1.0 65cd0000 winrtact.dll 1.22.2404.9003 6615a9aa c0000005 0000000000008aa3 0x8d9c 0x1da8dba54249668 C:\SomePrograms\WingetUI-Store\src\UniGetUI\bin\x64\Release\net8.0-windows10.0.19041.0\win-x64\WingetUI.exe C:\SomePrograms\WingetUI-Store\src\UniGetUI\bin\x64\Release\net8.0-windows10.0.19041.0\win-x64\winrtact.dll 2c2a5dca-bcbd-4153-b3ac-a9975722ce1b

Steps to reproduce

Two possible options to reproduce the bug:

  1. Create a C#/WinUI3/AppSdk project and set the project to run unpackaged and AppSdk to be self-contained. Run the process elevated and attempt to create a WindowsPackageManager instance through winrtact.dll (WinGetServerManualActivation_CreateInstance). App will immediately hang and crash.
    Event viewer will report a crash on winrtact.dll 0xc0000005
  2. Create a C++ console app and enable WinRT APIs from project properties. Import winrtact.dll thorugh and attempt to create a WindowsPackageManager instance with WinGetServerManualActivation_CreateInstance. App will immediately crash and exit with exit code 0xc0000005. Example code below: Details

typedef HRESULT(WINAPI* PFN_WinGetServerManualActivation_CreateInstance)( const GUID& clsid, const GUID& iid, DWORD flags, void** instance);

static T* WinRTActCreateInstance(const GUID& clsid, const GUID& iid) { void* pUnknown = nullptr; HRESULT hr = S_OK;

HMODULE hModule = LoadLibrary("winrtact.dll");
if (hModule)
{
    PFN_WinGetServerManualActivation_CreateInstance WinRTAct_DllCreateInstance = (PFN_WinGetServerManualActivation_CreateInstance)GetProcAddress(hModule, "WinGetServerManualActivation_CreateInstance");
    try
    {
        hr = WinRTAct_DllCreateInstance(clsid, iid, CLSCTX_ALL, &pUnknown);
        if (FAILED(hr))
            throw hr;

        T* pInterface;
        hr = ((IUnknown*)pUnknown)->QueryInterface(iid, (void**)&pInterface);
        if (FAILED(hr))
            throw hr;

        return pInterface;
    }
    catch (HRESULT hrException)
    {
        throw hrException;
    }
    catch (...)
    {
        throw;
    }
}
else
{
throw HRESULT_FROM_WIN32(GetLastError());
}

}

int main() { PackageManager* pointer = WinRTActCreateInstance(CLSID, IID); // Everything OK // Pointer is not nullptr

PackageManager winget = *pointer;
// Crash with 0xC0000005

}

Expected behavior

Instances get created and the api is usable

Actual behavior

Crashes with 0xC0000005

Environment

Windows 11 x64 10.0.22635.3430 Tested on Windows Sandbox and the issue still happens

WinGet versions tested: