[tbb-bugs] #13594 [Tor Browser]: Tor Browser Bundle 4.0: updater fails on Windows

[Tor Bug Tracker & Wiki]

#13594: Tor Browser Bundle 4.0: updater fails on Windows
-----------------------------+----------------------
     Reporter:  marc         |      Owner:  tbb-team
         Type:  defect       |     Status:  new
     Priority:  normal       |  Milestone:
    Component:  Tor Browser  |    Version:
   Resolution:               |   Keywords:
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+----------------------

Comment (by mcs):

 Replying to [comment:16 gk]:
 > That is tricky, yes, as we e.g. for XP users link against msvcr100 and
 our hardening plays a role here, too. If I understand comment:9 and
 comment:12 correctly then that might be a good solution we could try.

 I did some more digging to figure out why the updater succeeds on some
 Windows systems.
 On one of our Win7 systems, when starting updater.exe, it looks like a
 copy of libssp-0.dll from Browser\TorBrowser\Tor\ is used.  This happens
 because Tor Launcher has added that directory to the PATH:

 https://gitweb.torproject.org/tor-launcher.git/blob/HEAD:/src/components
 /tl-process.js#l389

 And because there is a copy of msvcr100.dll in C:\Windows\System32\,
 updater.exe can be loaded.

 My conclusion the msvcr100.dll is the real problem (I will need to test
 again on WinXP to be sure).

 Do you know if all Win7 systems have a copy of msvcr100.dll in their
 system directory?  If so, then probably only WinXP (and possibly Vista)
 users are affected by this bug.

 Although comment:12 has been "deleted" I think its contents are still
 relevant.  One potential solution would be to ensure that the PATH
 contains the Browser\ directory (since it contains both libssp-0.dll and
 msvcr100.dll).  This would only need to be done when starting the updater.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13594#comment:17>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online