Visual Studio 2005安全更新和CRT DLL版本在清单中 [英] Visual Studio 2005 security updates and CRT DLL versions in manifest

问题描述

最近的Visual Studio 2005安全更新可能会对我们造成困扰。

Recent Visual Studio 2005 security updates may be causing problems for us.

我们构建并内部分发以C ++编写的SDK。这些SDK只是头文件和静态库的集合。安装安全更新后，我们的SDK现在取决于较新版本的MSVC CRT DLL。这些SDK在下游用于产生EXE文件的项目中。

We build and internally distribute SDKs written in C++. These SDKs are a collection of header files and static libraries only. After installing the security updates our SDKs now depend on the newer versions of the MSVC CRT DLLs. These SDKs are used downstream in projects which produce EXE files.

如果这些EXE文件之一是使用SDK的混合（一些来自安全更新之前的，之后），则生成的EXE文件引用了两组MSVC运行时DLL。例如：

If one of these EXE files is built with a mix of SDKs (some from before the security updates, some from after), then the EXE file produced makes reference to two sets of MSVC runtime DLLs. E.g:

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
    <dependency>
        <dependentAssembly>
            <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.4053" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b">
            </assemblyIdentity>
        </dependentAssembly>
    </dependency>
    <dependency>
        <dependentAssembly>
            <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.762" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b">
            </assemblyIdentity>
        </dependentAssembly>
    </dependency>
</assembly>

这是否意味着在运行时这个EXE将使用这两个版本的DLL？这是否意味着我们必须使用这个EXE分发两个版本的MSVC运行时DLL？

Does this mean that at runtime this EXE will be using both versions of the DLL? Does this mean we must distribute both versions of the MSVC Runtime DLLs with this EXE?

有没有一种简单的方法来避免这个问题，而不会强制所有的SDK都用Visual Studio 2005安全补丁到位？ （这对于我们不想不必要地重建的一些较旧的和相当稳定的SDK来说是不希望的）

Is there a simple way to avoid this problem without forcing all SDKs to be built with the Visual Studio 2005 security patches in place? (This would be undesirable for some of the older and quite stable SDKs that we don't want to rebuild unnecessarily)

可以简单地将清单文件重写SDK或最终的EXE文件，以便仅提及一个版本的MSVC CRT DLL？

Is is possible to simply rewrite the manifest file on either the SDKs or the final EXE file so that only one version of the MSVC CRT DLLs are mentioned?

我的理解是相关更新如下：

My understanding is that the relevant updates are as follows:

Microsoft Visual Studio 2005 Service Pack 1的安全更新：KB971090

Security update for Microsoft Visual Studio 2005 Service Pack 1: KB971090

< a href =http://go.microsoft.com/fwlink/?LinkId=155934 =nofollow noreferrer> http://go.microsoft.com/fwlink/?LinkId=155934

Microsoft Visual Studio 2008 Service Pack 1的安全更新：KB971092

Security update for Microsoft Visual Studio 2008 Service Pack 1: KB971092

http://go.microsoft.com/fwlink/?LinkID=155933

我发现了另外两个类似的问题：

I have discovered two other questions which are similar:

VC++：KB971090并选择Visual C运行时DLL依赖项

最新的Visual Studio 2005安全更新在热修复客户站点时导致C运行时库问题

推荐答案

在运行时，您的可执行文件将尝试使用这两个版本的DLL。这可能是因为您尚未完全重新编译整个项目（或者您正在使用已编译为依赖于.762运行时的外部库）。

As Ted says, at runtime your executable will be trying to use both versions of the DLL. This is probably because you haven't fully recompiled the entire project (or you are using external libraries that have been compiled to depend upon the .762 runtime).

好消息是，如果这两个库都安装在您的客户端系统上，那么并行重定向策略将意味着只加载最新的。到目前为止，您会注意到，只有一个安装（可能是.762）应用程序将无法从旧的应用程序配置不正确，重新安装可能会修复此问题错误消息时，将会注意到更有害的副作用。

The good news is that if both these libraries are installed on your client systems then the side-by-side redirection policy will mean that only the latest is loaded. By far the more detrimental side-effect you will notice is when only one is installed (probably .762) that the application will fail to start with the old "application is not configured correctly, reinstalling may fix this problem" error message.

这是否意味着我们必须使用这个EXE分发两个版本的MSVC运行时DLL？

Does this mean we must distribute both versions of the MSVC Runtime DLLs with this EXE?

最简单的解决方案可能是发送最新版本的可视化c ++运行时可重新发行版，您可以从以下链接获取。

The easiest solution for you would probably be to just ship the latest version of the visual c++ runtime redistributable which you can get from the following link.

http://download.microsoft。 com / download / 6 / B / B / 6BB661D6-A8AE-4819-B79F-236472F6070C / vcredist_x86.exe

可能有点痛因为它要求用户在EULA页面上单击我同意，并且需要管理员资格，但是通过普遍的共识，如果可以让用户安装它是最好的选择。

It can be a bit of a pain because it asks the user to click "I agree" on a EULA page and requires admin priveledges but by general consensus it is the best option if you can get the user to install it.

这篇关于Visual Studio 2005安全更新和CRT DLL版本在清单中的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！