the gdiplus.msm patch in ms04-028 adds versionnt

the gdiplus.msm patch in ms04-028 adds versionnt > 501

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

GT - 08 Oct 2004 12:13 GMT

This may be the wrong newsgroup for this subject (if so please redirect me to
the correct one).

This is the problem:

The Common Files\Merge Modules gdiplus.msm is patched by the
VS7.1-KB830348-X86.exe included in the MS04-028 hotfix.

The patch replaced the included gdiplus.dll with a newer version which was
expected. But it also added a condition in the component table: "versionnt <
501" which means that the dll will not be installed if the OS is XP or
later!!!
In the old version there was no such condition.

Why was this condition added?

As far as I can understand it is important that also installations done on
XP are able to sucessfully install the new gdiplus.dll

The corresponding update exists for VS 7.0 (VS7.0-KB830348-X86.exe) and it
also add this new condition.

Reply to this Message

Phil Wilson - 09 Oct 2004 19:06 GMT

At:
http://www.installsite.org/pages/en/topic/gdiplus.htm

Scenario 3 indicates that Windows Update (and Service packs too, I believe)
will update that DLL because it is part of the XP and Server 2003 OS. That
also means that it's a protected file that you wouldn't be able to replace
anyway.

Signature

Phil Wilson
[MVP Windows Installer]
Definitive Guide To Windows Installer
http://apress.com/book/bookDisplay.html?bID=280

> This may be the wrong newsgroup for this subject (if so please redirect me
> to
[quoted text clipped - 19 lines]
> The corresponding update exists for VS 7.0 (VS7.0-KB830348-X86.exe) and it
> also add this new condition.

Reply to this Message

GT - 11 Oct 2004 06:29 GMT

The gdiplus redistributable msm (placed on "Common Files\merge modules" by
the VS2003 installation and updated by the e.g. MS04-028 patch) is tailored
by Microsoft to be configurable. You are not supposed to configure it to
install in the Windows\system32 folder. Instead you are advised to install it
on your application folder (side-by-side installs, local version taken before
version in path and all that...).

To summarize:
I use the redist msm, on XP, and I cofigure it to install on my local app.
folder.
This worked OK before the MS04-28 patch.
After the patch, when I include the patched version of the gdiplus.msm it no
longer installs on XP due to the added install condition "ntversion < 501"!!
The result patches sent out to update my product with the new local version
of gdiplus will not install the new version, leaving the target hosts with
the old vulnerable version on my locall app folder.
This could not be what Microsoft intended by introducing configurable redist
msm's !?

> At:
> http://www.installsite.org/pages/en/topic/gdiplus.htm
[quoted text clipped - 26 lines]
> > The corresponding update exists for VS 7.0 (VS7.0-KB830348-X86.exe) and it
> > also add this new condition.

Reply to this Message

GT - 11 Oct 2004 06:53 GMT

But now I think I know how I ended up in this situation:

We started to ship the gdiplus.msm with our product at a time when the
install condition (versionnt < 501) was missing which lead to that the
gdiplus.dll got installed on our local app. directory also on XP.

Now, with the new version, the install condition will cause that the wrong
version will remain (installed on XP because of the missing install condition
in the initial version of gdiplus.msm).

Thanks,
Gunnar

Reply to this Message

the gdiplus.msm patch in ms04-028 adds versionnt > 501

Free Magazines