[Tools] Manual Validation - Fix Credential Manager native memory handling#401901
Merged
stephengillie merged 2 commits intoJul 14, 2026
Merged
Conversation
…tching allocators ## Problem - The CredRead buffer was released with `Marshal.FreeHGlobal` instead of the `CredFree` API it requires, and `credentialBlob` -- an interior pointer into that same buffer -- was then freed a second time. - The write path freed a `StringToCoTaskMemUni` allocation with `Marshal.FreeHGlobal` instead of `Marshal.FreeCoTaskMem`. ## Solution - Add a `CredFree` P/Invoke (`CredRelease`) and release the CredRead buffer once with it in `GetUserCredential`; drop the duplicate `credentialBlob` free. - Free the write blob with `Marshal.FreeCoTaskMem` to match its allocator. - Apply the same fix to both the PowerShell embedded C# and the .cs mirror, and declare `CredRelease` as `void` to match the native signature. ## Impact - Credential read/write no longer performs mismatched or duplicate frees; observable behavior is otherwise unchanged. ## How Validated - Embedded C# compiles and loads on Windows PowerShell 5.1 and pwsh 7; standalone PoC round-trips a credential across repeated read/write with no crash.
## Problem - `GetUserCredential` freed the CredRead buffer only after the marshaling steps succeeded, so an exception during `PtrToStructure`/`Copy`/construction would leak the native buffer. - `SetUserCredential` freed the write blob only after a successful `CredWrite`; a write failure threw before the free, leaking the allocation on every failed write. ## Solution - Wrap the credential body in `try/finally` in both methods so the buffer is always released once it has been allocated, on both success and exception paths. - Guard the raw `CredFree` P/Invoke with a non-null check (`credPtr != IntPtr.Zero`) as defense-in-depth. - Apply identically to the PowerShell embedded C# and the .cs mirror. ## How Validated - Embedded C# compiles and loads on Windows PowerShell 5.1 and pwsh 7.
microsoft-github-policy-service
Bot
added
the
Needs-Attention
Madhusudhan-MSFT
marked this pull request as ready for review
July 14, 2026 00:31
stephengillie
approved these changes
Jul 14, 2026
microsoft-github-policy-service
Bot
added
Moderator-Approved
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two follow-up fixes to the
CredManager.Utilhelper added in #396900. ItsCredRead/CredWritebuffers were released with mismatched allocators and only on the success path. This corrects the frees and makes them exception-safe. The same changes are applied to both the PowerShell embedded C# and the.csmirror so the two stay in sync.Changes
CredReadbuffer with theCredFreeAPI (via a newCredReleaseP/Invoke) instead ofMarshal.FreeHGlobal; remove the duplicate free ofcredentialBlob, which is an interior pointer into that same buffer rather than a separate allocation; free the write blob withMarshal.FreeCoTaskMemto match itsStringToCoTaskMemUniallocation.CredReleaseasvoidto match the nativeCredFree.try/finallyso the buffer is freed on both success and exception paths, and guard the rawCredFreecall with a non-null check.How Validated
Context
Microsoft Reviewers: Open in CodeFlow