This package will install all updates directly to your build environment.  A backup of all updated files will be maintained at the following location:  %_WINCEROOT%\BACKUP.  You can remove any files from this directory at your choosing.

If You Have Installed Previous Updates

If you have installed previous updates (for Windows CE 3.0), this will update your build environment to include the latest files for this component.

Special note for users of Japanese Platform Builder 3.0

QFE 48 had two versions - one for Platform Builder 3.0 English, the other for Platform Builder 3.0 Japanese.  If you are using Platform Builder 3.0 Japanese, please download one of the following files:

If You See "These files were NOT installed"

If this message is displayed, it means that you have installed an update package with a later version of the installed file.  You will already have the updates mentioned in this document, including something later (documented with that later update).  This message is displayed to prevent accidental overwrite of the latest Windows CE update to that particular component.

Fixes Made in this Update:

By Component:

• Component:  AFDLIB

   

  • QFE 12 - Resolver code did not allow resolution of host names containing '-' character.

  • 020507_Q316852 - Calling setsockopt with option IP_MULTICAST_IF (and a valid local sockaddr) returns with an error of WSAEADDRNOTAVAIL.

  • 020612_Q324057 - When sending a DNS query to a host name it fails if the domain suffix contains a period "." at the end. If there is no trailing period "." it works fine.

   

  Component:  ARM-based compilers

   

  • 020429_Q320685 - On the ARM compilers, when calling a virtual function residing in a different module, the third function argument is corrupted.

   

  Component:  Asyncmac

   

  • QFE 3 - After send/download failure, connection stays open.

  • QFE 23 - Race condition with TAPI and asyncmac.

  • QFE 56 - Unable to access internet through SLIP connection due to framing issue in ASYCNMAC

   

  Component:  CRYPT32

   

  • 021217_Q328463 - Security issue resolved: IE SSL vulnerability with man-in-the-middle certificate chain

   

  Component:  DEVICE

   

  • QFE 61 - Failure to check for null after LocalAlloc in device.exe.

   

  Component:  DHCP

   

  • QFE 51 - DHCP client fails when 2 DHCP servers are present.

  • QFE 55 - Windows CE 3.0 DHCP client fails when receiving a DHCPACK message with a subnet mask, but the previous DHCPOFFER didn’t send such information.
     

    The way DHCP works (RFC2131) is that a client requesting for an IP configuration broadcasts a message of type DHCPDISCOVER. If a DHCP server is on that network, it may reply to the client with a message of type DHCPOFFER containing a proposed IP configuration (IP address, subnet mask, Gateway address, etc.).The client may send back a DHCPREQUEST message where it formally requests for the IP configuration previously proposed. At this point, the server may commit the address and send a DHCPACK message to the client with the committed IP configuration.
     

    What we have in our case is that Windows ME ICS doesn’t send a subnet mask in the DHCPOFFER (which eventually is interpreted by the Windows CE 3.0 client as 0.0.0.0) but it does in the following DHCPACK. The Windows CE 3.0 client checks this discrepancy and, since there’s a mismatch, it doesn’t adopt the IP configuration.

   

  Component:  DirectX

   

  • QFE 40 - DirectSound - If there is more than one sound device in the system, DirectSound may hit an infinite loop.

  • QFE 42 - DirectSound - In CE 3.0, MPG4DS32.DLL contains a function, Yuv2Rgb555MB, written in assembly language, to convert from YUV color values to RGB color values. The function spans two memory pages. The function also uses memory below ESP (i.e. mov dword ptr [ESP-68h], eax) as scratch/temporary storage space for some variables. If a page fault occurs while executing the function, then the scratch space will be overwritten by the OS while handling the page fault since the OS uses the app’s stack. After the page fault, the function will end up using the data from the overwritten scratch space which can cause an access violation.

  • QFE 42 - DirectSound - Improve MMX detection for Natsemi Geode Processor.

  • QFE 45 - DirectDraw - DirectDraw is incorrectly detecting the overflow return code from GetRegionData and not returning an error to the user.

  • QFE 46 - DirectDraw - PropertyBag interface for selecting DirectSound audio device was unnecessarily #ifdef’d to return E_NOTIMPL under Windows CE.  This prevented selecting a secondary audio device under DirectShow.

  • QFE 73 - DDCORE - A crash may occur in DDCORE when shutting down an application from a script.

  • 020418_Q319093 - WMV codec in Cedar produces bad quality and poor performance on Hitachi SH4.

   

  Component:  FATFS

   

  • QFE 22 - FATFS renames folder incorrectly on resume.

  • QFE 22 - FATFS file access time grows proportionally with each file.

  • QFE 63 - H/PC 2000 device will hang when a program in FlushROM is loaded.  Some functions try to read a file which is in an ATAcard or FlushROM upon Resume. During this time, the system can not access these devices.  A thread will wait while holding LLcs Critical Section Object so that another thread can not get the Critical Section Object.

  • QFE 76 - This fix is ported from BirchSP2 QFE 32.  It is similar to BirchSP2 QFE 30, where the system deadlocks on suspend/resume while accessing the FAT file system device (PCMCIA in this case). The difference in this case is that the deadlock happens when a non-kernel process (IE) is making the access to the file system.

  • 020808_Q326493 - A deadlock may occur when multiple threads access the FAT file system.

  • 030925_KB829196 - FATFS may leak a registry key handle for each instance of LoadLibrary/FreeLibrary.

   

  Component: FATMAIN

   

  • QFE 11 - There is a problem with FATFS which is used by RegCopyFile() API to write to storage device. The problem is that it rewinds streams as it writes them in order to recalculate the correct data position to be written to a multiple sector cluster. This slows down the write process for large streams as it has to follow several links to get to the desired position. This was done to correct data corruption that occurred when wrong bytes were written to sectors.

  • QFE 83 - If an attempt to move a file is made, and that file is being held open by another process, the MoveFile() API fails with error 0x80070005 (Access Denied) if the file is stored on a FAT volume. This is different from what happens when using the RAM file system (the RAM file system allows this).

   

  Component:  FPEMUL

   

  • QFE 60 - This change only affects x86-based processors.  FSTP 64bit instruction emulation code was bugged.  FLD/FSTP instruction pair is being used to transfer 64bit values in memory by eVB/VB6.0, thus preventing eVB/VB6 to be used with i486 processors without a floating point coprocessor.

   

  Component:  FSDMGR

   

  • QFE 58 - The FSDMGR component was accessing kernel data structures during suspend/resume processing, however did not go into kernel mode before accessing the memory.  This would cause FS drivers to never be reloaded.  This is forward port of the fix for Windows CE 2.12 QFE 15.

  • 040109_KB833669 - Windows CE 3.0 may not show the correct amount of the free space available on the hard drive that was previously formatted as FAT32 on Windows XP.

   

  Component:  FSDBASE

   

  • QFE 31 - A freeze occurs when searching with more than approximately 16000 entries in the database, and that totally freezes the computer when loading more than approximately 38000 entries from the PC.

  • 020501_Q321524 - The problem is that there were some bugs in the kernel’s special transactioned flush for memory-mapped files that happen to be database volumes. The kernel treats database volumes in a different way from other memory-mapped files. If a flush is not properly transactioned, then what can happen is that some pages can be flushed to the volume and not others, effectively corrupting the volume because the data on the pages isn’t consistent. The change to the dbvolume code is small and done to initialize some flags that the fixed kernel expects to be valid at all times.

   

  Component:  FSMAIN

   

  • QFE 74 - When copying files to a full IPSM volume, the copy fails and the source files are removed from the device.  Upon failure, the host files are incorrectly deleted.

   

  Component:  GWE (GWES)

   

  • QFE 15 - ug in MsgWaitForMultipleObjectsEx. Basically, it looks like it returns whenever there's a timer set, even if the timer hasn't expired.

  • QFE 21 - User alarm is set by UI part of notification subsystem to wake the device at the next time it has to “beep”. When user alarm is set, the next wake-up time is recalculated. When it is cleared, however, it is not.

  • QFE 37 - Calling GetMenuItemInfo with MENUITEMINFO fMask set to MIIM_TYPE and dwTypeData set to NULL should return the size of buffer needed in the cch field for a menu item of type MFT_STRING.  This is necessary, because otherwise someone wanting to get the text out of the menu item is forced to guess at a good buffer size and hope its big enough.

  • QFE 43 - When a key is pressed, the value assigned to it is stored in a 4 bytes variable. Some other info (like whether the key is down or up, it is an extended key, a sound has to be played, etc.) is stored in form of bit flags into a separate variable; later on those flags are checked and this information is ORd into the same variable (4 bytes large) holding the key value.

    
    When a virtual key (for example shift or backspace) is pressed, the current state of that key is stored in a 1x256 bytes array. The way its done is to use the value of the virtual key as the index to the array. This value alone is always between 0 and 255, so that would be fine. The problem is that since it has possibly been ORd with some flag constant it may eventually be inconsistent and exceed the size of the array as in this case, where its ORd with KEYBD_DEVICE_SILENT (0x01000000), causing an access violation and making GWES.EXE crash.

   

  Component:  HTTPD

   

  • QFE 6 - HTTP 1.0 + HTTP 1.1 specs both allow for an arbitrary HTTP request verb. Right now HTTP only accepts the methods GET, POST, and HEAD - all other requests end up generating a 400 bad request error.

  • QFE 64 - Security issue resolved – WinCE web server may expose root directory files list

  • QFE 64 - Security issue resolved – Basic authentication may not have properly functioned

  • QFE 64 - Security issue resolved – NTLM authentication may not have properly functioned

  • 020812_Q326941 - Using an Internet Explorer 6.0 client against a WinCE 3.0 HTTPD server, some content may not load from the server.

   

  Component:  IE

   

  • QFE 35 - GenIE always copies downloaded files instead of moving files from the IE cache.

  • 030915_KB328896 - After browsing intensely for a period of time using Internet Explorer (IESAMPLE) for Windows CE 3.0, the browser control may encounter one of the following conditions:

  1) Pages may fail to render

  2) OOM dialog may be displayed

  Component:  IPNAT

   

  • QFE 17 - Problem occurs since IPNAT dereferences a USHORT pointer directly from the ICMP header. For PPP, IP headers are not aligned (due to PPP framing), so this only occurs on PPP links.

  • QFE 77 - With the NAT component installed from the AddOn Pack, a memory leak occurs when inserting and removing a PCMCIA network card.

   

  Component:  IRCOMM

   

  • QFE 25 - IRCOMMs Tx and Rx threads do not set their thread priorities correctly.

  • 020326_Q318654 - REPLLOG times out early on an infrared connection over serial

   

  Component:  JSCRIPT

   

  • QFE 27 - General Protection Fault when a Stack Overflow is triggered. A message stating that there was a Stack Overflow is expected (that’s what IE does). The stack overflow is caused by a recursive JScript Function. This causes the whole system to crash.

  • QFE 27 - Potential crash in IE while executing a JSCRIPT routine.

  • QFE 47 - If a HTML page contains JScript code that dynamically adds elements that in turn do some actions in response to events, the sinking events for the newly created object, although correctly registered, are not connected to the JScript engine. Thus the associated code is not executed.
    
    During runtime, script engines implemented according to the Windows Script Interface, have to go through several states (see MSDN documentation for more info). If a new object (for example a pushbutton) is dynamically added after the engine transition from SCRIPTSTATE_STARTED to SCRIPTSTATE_CONNECTED, the engine doesn’t establish a connection to the object’s sinking event.

  • 041108_KB883487 - Error handling by JScript and VBScript may cause a memory leak.

   

  Component:  KEBYD

   

  • QFE 71 - Scan code and time members of KBDLLHOOKSTRUCT are not set when using SetWindowsHookEx.

   

  Component:  Media Player

   

  • QFE 53 - The problem is present in the Windows CE 3.0 Media Player.  It’s a manifestation of a known bug in ATL (search MSDN for "BUG: Reregistered ATL window class may cause access violation").  The CContainedWindow and CWindowImpl classes don’t unregister their window class when unloaded. This causes an access error when a COM DLL is loaded in a process space, then unloaded, then loaded again at a different address in the same process

   

  Component:  MFC

   

  • 030411_Q817256 - This is a fix for a problem in MFC libraries that may result in occasional heap corruption for dlls using the shared MFC DLL. This modifies a single MFC source file, dllmodul.cpp, and the MFC libraries that include it. The fixed MFC libraries are used to create dlls using the shared MFC DLL and these MFC libraries can be redistributed when exporting a platform SDK.
    
    
    Information for OEM
    
    After applying this QFE, the platform SDK should be exported to update it with the libraries and source file provided by this QFE. Also, any dlls included in the platform that use the shared MFC DLL should be rebuilt.
    
    
    Information for Developers
    
    The modification in the MFC source file, dllmodul.cpp, is to modify the function call, AfxTermThread(), to include a parameter in the call, AfxTermThread(hInstance). This prevents memory from being free that is still referenced in MFC. The source file, dllmodul.cpp, is included in the libraries mfcs42.lib and mfcs42d.lib which are also replaced by this QFE.

  • 030725_KB821798 - Update to MFC components in Windows CE 3.0.

          

              Description of issues addressed in this QFE:

           

            - An update to implement proper handling of VT_I1, VT_UI2, VT_UI4, VT_R4 and VT_R8 dispatch parameters

            for SH4, MIPSFP CPUs.            

            - Improvement to CPU-specific thunk code according to the correct calling convention for SH3, SH4, MIPSFP.

            - Eliminates a memory leak in dispatch code marshaling.

     

            These are fixes in MFC OLECE400(d).DLL libraries that result in an assert for the described dispatch parameter types,

            incorrect function parameters and return values on SH3, SH4, MIPSFP platforms.

     

            This update modifies the following MFC source files: dispimpl.h, oledisp1.cpp, oledisp2.cpp, and afxdisp.h. This         

            package also updates the MFC libraries OLECE400(d).DLL. The updated MFC libraries can be redistributed when        

            exporting a platform SDK.

     

            Information for OEMs (Original Equipment Manufacturers):

              After applying this QFE, a platform SDK should be re-exported to update it with the libraries and source files provided

            by this QFE. It is not necessary to rebuild any DLLs included in the platform that use the shared MFC DLL.

   

  Component:  MLANG

   

  • QFE 49 - FindCharsetFromRegistry was not checking for a NULL Charset.  This is seen most often when running under low memory conditions.

   

  Component:  MSHTML

   

  • QFE 16 - Memory leak in browser control when page refreshes.

  • QFE 18 - <HR> tag does not display properly. A ruled line is supposed to be translucent; however the ruled line is painted grey.

   

  Component:  Multimedia

   

  • 020215_Q312882 - IMediaContent does not have a "get_Album" property, so there is no way to get this information from a MP3 file.

   

  Component:  NDIS

   

  • QFE 8 - Losing connection to network after several minutes of running network stress tests. This was found during the development of the Cedar Add-On Pack.

  • QFE 9 - If an NDIS miniport requests addressing information when the adapter is reset (via the AddressingReset flag in the miniport reset handler), an exception may occur when the system is suspended and resumed.

   

  Component:  NK (NKMAIN, NKPRMAIN)

   

  • QFE 1 - On MIPS processor, "branch likely" instructions can be interrupted in the delay slot.

  • QFE 10 - Although WinCE 3.0 has added the new function OEMArmCacheMode,supposedly allowing the developer to specify the C and B bits in a page table entry, this function is not used all the time. Specifically, the functions MakePagePerms() and DemandCommit() build page table entries with both the C and B bits set, with no reference to OEMArmCacheMode.

  • QFE 14 - LockPages was crashing if the requested virtual address range crossed a 32MB boundary which can occur for a file system larger than 32MB. The fix was simply to detect this boundary condition and break it into two calls to LockPages, one for either side of the 32MB boundary. Same applied to UnlockPages.

  • QFE 33 - In the x86 architecture, the Kernel allocates memory for the CPU to use as a cache.  The cache is used to reduce the penalty associated with a page fault.  If code is not in the cache when needed then a page fault occurs and the code will be paged into the cache.  If the cache is full then code has to be discarded before the new code is loaded.  In a real-time environment the amount of time necessary to free up some cache and load the new code is often the worst case latency.  The latency can be improved by allocating more memory for use by the CPU.  It is easy to think of memory being allocated on a per process basis.  In the 3.0 release enough memory was allocated to support 2 fully in use 32MB process spaces.  This does not mean that you can only run 2 processes but it does mean that only a total of 64MB of virtual memory can be mapped by the OS before a possible page fault and cache flush is required.  With only enough memory for 2 process space the chances of hit a page fault were high.

  • QFE 41 - The kernel incorrectly tracks the resource counter for a MUI resource.

  • QFE 57 - File decompress can corrupt multi-XIP files on read – the file index was overwritten with the file index for a specific ROM instead of the global file index.

  • QFE 57 - A MUI DLL’s refcount is decremented when its referenced DLL is decremented and this can cause the MUI DLL’s refcount to be decremented twice

  • QFE 63 - H/PC 2000 device will hang when a program in FlushROM is loaded.  Some functions try to read a file which is in an ATAcard or FlushROM upon Resume. During this time, the system can not access these devices.  A thread will wait while holding LLcs Critical Section Object so that another thread can not get the Critical Section Object.

  • QFE 70 - IST starts are delayed due to being postponed until the next scheduling of an event on SH3 and SH4 processors.  This impacts real-time capability

  • QFE 70 - DCR:  Request to modify fatal exception handling in Kernel code.  In some circumstances the OS can get into a state where the only course of action is to halt the system.  When the OS enters this state is posts a debug message “Halting system”.  At that point in time, the kernel has effectively locked up the system.  In Windows CE 3.0 this mechanism did not allow an OEM to capture the event nor perform any action.  With this QFE the OEM is now informed about the halting condition and able to perform some actions.

     

    The kernel now exports a function pointer that can be overridden by the OEM.  If the default function pointer value is replaced by the address of an OEM function in the OAL, the OEM function will be called when the kernel goes to halt the OS.  If the OEM does not override the function pointer, the default action is to halt the system.  The kernel declares the following function pointer:

     

    extern void (*lpNKHaltSystem)(void);

     

  In the OEM’s OAL, the OEM can reassign the function pointer as follows:

   

  Implement Function

  void OEMHaltSystem (void)

  {

  …. Do something like reset the device

  }

   

  OAL Globals:

   

  void (*lpNKHaltSystem)(void)=OEMHaltSystem;

  
   

  Or, in OEMInit:

   

  void OEMInit()

  {

      extern void (*lpNKHaltSystem)(void);

      ….

      lpNKHaltSystem = OEMHaltSystem;

  }

   

  The function does not have any return values or take any parameters.  The system will not continue to function after the OEM is called.

   

  • QFE 75 - Incorrect freeing of allocated memory when attempting to load a DLL at a preferred load address may cause the system to crash.

  • QFE 75 - At the end of the PrefetchAbortHandler, code start executing data rather than actual code.  This is caused by a commented out branch to CommonHandler.  On an ARMv4, this executes a NOP.  On the ARMv5, however, this is another instruction which can cause memory corruption

  • QFE 79 - Memory leak caused by the MSXML component if the if invalid XML is encountered.

  • QFE 79 - System crash in the profiling kernel when initially using PROFILE_OBJCALL | PROFILE_BUFFER.

  • 020215_Q316023 - In some situations, two threads may think they own the same critical section.  This could result in two processes accessing a device within the driver and corrupts the data on the device.

  • 020215_Q316023 - An exception occurs in the profile kernel when CreateEvent is called and the event name is greater than 140 characters.

  • 020305_Q318354 - SH4 only - Interrupts are not masked correctely while NMI executes on SH4

  • 020318_Q319432 - SH4 only - When executing a SLEEP instruction with a blocked interrupt pending, the SH4 processor will set the return address to the SLEEP instruction instead of the instruction following the sleep. This can cause an interrupt service thread to be scheduled but not run until a second interrupt wakes the processor back up. To work around this we need to check the return address before executing an interrupt service routine and correct.

  • 020501_Q321524 - The problem is that there were some bugs in the kernel’s special transactioned flush for memory-mapped files that happen to be database volumes. The kernel treats database volumes in a different way from other memory-mapped files. If a flush is not properly transactioned, then what can happen is that some pages can be flushed to the volume and not others, effectively corrupting the volume because the data on the pages isn’t consistent. The change to the dbvolume code is small and done to initialize some flags that the fixed kernel expects to be valid at all times.

  • 020701_Q324866 - The operating system stops signaling an interrupt service thread (IST) after some period of time. This failure occurs with a frequency that varies considerably depending on the particulars of the different interrupt sources within the system.

  • 030115_Q811736 - SHx only.

  If an OEM implements the SH3/SH4 OAL ISR "OEMNMI" to handle NMI interrupts and has that function return a "SYSINTR" ID (other than SYSINTR_NOP or SYSINTR_RESCHED), and has implemented an Interrupt Service Thread (IST) that is signaled by the NMI's SYSINTR ID, then the kernel may fail to signal the IST.

   

  The problem occurs when the NMI interrupt fires while the kernel is executing within a small block of code that processes interrupt events. This fix corrects the problem by redesigning this portion of the kernel code so that it is protected against the NMI interfering with its operation.

   

  The ability to return SYSINTR values from the NMI ISR is unique to the Windows CE kernel for SHx processors.

  Component:  NTLM

   

  • QFE 52 - DeleteSecurityContext API was incorrectly calling DereferenceSecurityContext twice, when only the first call was needed.

   

  Component:  Object Store

   

  • 020520_Q322292 - If more than one database volume is mounted, any attempt to write into the second volume may fail with a DISK FULL error once the \database tries to grow beyond the default size of 320KB.

   

  Component:  PEGHELP

   

  • 020109_Q314751 - Repeatedly running Peghelp results in a system halt.

  • 020121_Q316274 - The translation string for base64 was incorrect the last character was a "*" and needed to be a "/".

   

  Component:  PEGTERM

   

  • QFE 30 - When Pegterm initializes, it doesn’t update its TAPI device ID before calling lineSetDevConfig, so at startup it always does a lineSetDevConfig for TAPI device 0.

   

  Component:  Platform Builder

   

  • 020725_Q326161 - (English only) After building a platform in PB3.0, sometimes garbage environment variables in the environment settings may be set when the user performs the following actions: (from Menu) ''Build''->''Open Build Release Directory'' and type ''Set'' in the build window that opened.
  • 030128_Q326161 - (Japanese only) After building a platform in PB3.0, sometimes garbage environment variables in the environment settings may be set when the user performs the following actions: (from Menu) ''Build''->''Open Build Release Directory'' and type ''Set'' in the build window that opened.

   

  Component:  PPP / SLiP

   

  • QFE 20 - LCP renegotiation does not reset authentication. Also, updated support for a certain wireless card.

  • QFE 36 - Unable to access internet through SLIP connection.

  • QFE 39 - Protocol-Reject of CCP or IPCP does not make CE stop sending packets of those types.

  • QFE 56 - Unable to access internet through SLIP connection due to framing issue in ASYCNMAC.

  • QFE 68 - PPP fails to work when a PPP server does not provide a gateway IP address.

  • QFE 68 - IPCP requests DNS even when RASENTRY already contains static entries.

  • 020724_Q325382 - RASCS_Disconnected being sent by PPP.DLL after LCP link renegotiation requested by peer

  • 021120_Q329941 - Using the function gethostbyname() on the local device returns 127.0.0.1 rather than the network assigned ip address.

  • 030227_Q814213 - The UI does not report that SLIP is disconnected when remote connection is dropped due to a physical disconnect from SLIP server.

  • 030328_Q817023 - When transitioning between 1xRTT and EVDO networks, the PPP stack sends up an LCP renegotiation request to the WinCE network stack.  In the CedarPB version of WinCE, the network stack causes it to send up an extraneous RASCS_Disconnect message to the RAS client. When the RAS client sees this disconnect message, it shuts down the RAS connection (using RasHangup) and informs all of its client applications (such as pIE and mail) that the connection was interrupted. Each application then terminates its current transfers and may display an error message. In the case where the device maintains the same IP address after the renegotiation, this behavior is unnecessary and undesirable, since existing transfers likely could have continued successfully after the renegotiation completes.

  • 030613_KB822004 - During a PPP session, Windows CE sends an IPCP TERMINATE REQUEST packet instead of a LCP_TERMINATE_REQUEST when reaching the timeout limit for IPCP_CONFIGURE_REQUEST.

  • 030613_KB822344 - Windows CE may ignore duplicate CHAP challenge IDs during LCP renegotiation.

   

  Component:  PPTP

   

  • QFE 62 - Parsing of a VPN connection address list enters an infinite loop that requires the system to be rebooted.

   

  Component:  PWORD

   

  • QFE 82 - Font size combo box is too small on displays using a larger font size.

   

  Component:  RAPISRV

   

  • QFE 67 - When a partnership is established with the device via ActiveSync and is then disconnected, repllog.exe keeps the COM port open for about 40 seconds.  During this time, no other connections can be established with the desktop and the device cannot be shut off.

   

  Component:  RDP

   

  • QFE 48 - Client name is limited to 8 characters.

  • QFE 48 - Improved data handling for INK quality.

  • QFE 48 - Process remains if connection cancelled before disconnect.

   

  Component:  RDRNET

   

  • QFE 32 - Redir displays the "Duplicate Name" error message when it detects that the network is not up.

   

  Component:  REPLLOG

   

  • QFE 67 - When a partnership is established with the device via ActiveSync and is then disconnected, repllog.exe keeps the COM port open for about 40 seconds.  During this time, no other connections can be established with the desktop and the device cannot be shut off.

   

  Component:  RSA

  • QFE 65 - Integer overflow exception in RSA32.LIB on MIPS platforms when performing RSA operations under stress.

  • QFE 65 - Memory leak in RSABASE/RSAENH in function CrypteDestroyHash when using HMAC hash type.

   

  Component:  Security

   

  • 031119_KB820371 - When trying to connect to some secure sites, a user may get the following error:

  "An error occurred in the secure channel support."

  Component:  SERVERS (ASP)

   

  • QFE 29 - After building a MAXALL CE OS from PB 3.0 for CEPC and including the Webserver in the CESysgen platform settings, a potential VBScript error may occur upon execution of an .ASP file from a client machine.

   

  Component:  SHDOCVW

   

  • QFE 16 - Memory leak in browser control when page refreshes.

  • QFE 59 - When accessing an ASP script that returns data and set's the content-type header field to a specific MIME type, the content-type is ignored and GenIE attempts to save the file as .asp.  This is a forward port of the fix for Windows CE 2.12 QFE 27.

  • QFE 78 - IESAMPLE deadlocks under low memory conditions.

   

  Component:  SHELL

   

  • QFE 24 - Shell doesn’t currently check the return value when calling CreateToolhelp32Snapshot(). ToolHelp function Module32First() doesn’t validate input parameters.

  • QFE 74 - When copying files to a full IPSM volume, the copy fails and the source files are removed from the device.  Upon failure, the host files are incorrectly deleted.

  • 040407_KB837433 - If there is no browser in the platform configuration, the windows explorer shell may continually open new explorer windows if a UNC path is typed with the forward slash "//" rather than the backslash "\\".

   

  Component:  SHx Compiler

   

  • 020917_Q327588 - The SH4 compiler in Windows CE Platform Builder 3.0 may have trouble passing structures by value in function calls.

   

  Component:  SMTP

   

  • QFE 13 - Connections from inbox not properly shut down before call is disconnected. Inbox needs to set correct socket linger options to wait for FIN/ACK to be exchanged before terminating link

   

  Component:  TAPI

   

  • QFE 4 - LineEventProc's handling of LINE_GENERATE incorrectly checks the return value of CheckCallClient and ruins LPTCALLCLIENT's reference-counting.

  • QFE 4 - Certain tests crash in GetCallIDs().

  • QFE 4 - LineOpen LINEMAPPER search terminates prematurely.

  • QFE 7 - Modem may not disconnect successfully if a hang-up is attempted during dialing/initial connection setup.

  • QFE 23 - lineBlindTransfer should check for NULL lpszDestAddress before calling TSPI_lineBlindTransfer

  • QFE 23 - Race condition with TAPI and asyncmac

  • QFE 23 - Exception: misc.c: SendMsgToCallClients()

  • QFE 23 - TAPI does not recognize that the TSP has removed a call from a conference

  • QFE 23 - TAPI!TAPIlineGetConfRelatedCalls(), if (ptOpenLine = FindOpenLine/(ptLineApp, ptParent, 0xffffffff))

  • QFE 23 - TAPI call list becomes corrupted and causes a device.exe exception

  • QFE 23 - Corrupted call structure causes exception in FindCallClient.

  • QFE 23 - Remnet connect to unavailable device hangs

  • QFE 34 - TAPI would NULL a conference call without checking to see if it was the parent of the conference call.

   

  Component:  TCP/IP

   

  • QFE 2 - When CE is configured as a router, fragmented IP packets are not forwarded.

  • QFE 54 - IF is not dereferenced if the ref_usecnt is not 0. This can cause a 4-5 minute hang when the network is lost and a connection tries to close.

  • QFE 72 - Security issue resolved – Kiss of Death Denial of Service (DoS) attack.

   

  Component:  TOOLHELP

   

  • QFE 24 - Shell doesn’t currently check the return value when calling CreateToolhelp32Snapshot(). ToolHelp function Module32First() doesn’t validate input parameters.

   

  Component:  Unimodem

   

  • QFE 3 - Delay hanging up a successful connection.

  • QFE 25 - Must wait a few seconds for first connection to close before creating a new one when using PPP over IRCOMM because connection is closing improperly.

  • QFE 38 - Reduced the timeout for init commands.

  • QFE 38 - Reduced the number of retries for init commands.

  • QFE 38 - On failure, Unimodem now sets the hCallComplete event before calling devlineClose.

  • QFE 38 - Added new functionality such that the user can specify the number of retries by setting the registry key “HKLM\Drivers\Builtin\IrComm\Unimodem\Settings\DCCRetries” with a DWORD value that represents the number of retries wanted.

  • QFE 44 - Unimodem would toggle the DTR in AutoBaudRate and cause ActiveSync connections to fail.

  • QFE 66 - If a modem responds with a string beginning with the character “O”, it will be matched as “OK”. Some radio modems return “OUT OF SERVICE” if out of range, Unimodem sees this as “OK”.

  • QFE 69 - PEGTERM hangs shell after closing IrDA/GSM session.  Priority of PEGTERM thread was being raised by Unimodem and not lowered afterwards causing the mouse input driver to spin.

  • QFE 81 - Repllog connection times out early.  The timeout occurs because of a race condition between threads.

  • 020326_Q318654 - REPLLOG times out early on an infrared connection over serial

   

  Component:  VBSCRIPT

   

  • QFE 27 - General Protection Fault when a Stack Overflow is triggered. A message stating that there was a Stack Overflow is expected (that’s what IE does). The stack overflow is caused by a recursive JScript Function. This causes the whole system to crash.

  • 041108_KB883487 - Error handling by JScript and VBScript may cause a memory leak.

   

  Component:  WCELOAD

   

  • QFE 50 - DCR: Request for WCELOAD to both flush the registry and provide a hook for OEMs to let them either be called when a module is installed, or to be launched at the end and point them to the .UNLOAD file.

  • 020129_Q314289 - DCR request to allow WCELOAD to run without user intervention (for a headless device). If WCELOAD is run with the /NOASKDEST switch, a progress bar is still displayed, but the "OK" dialog box at the end of a successful installation is suppressed.

   

  Component:  WCELDCMD

   

  • 020424_Q317803 - DCR:  Request for WCELoad to have a headless version.  This will remove dependencies on shell components that are not needed for a headless configuration.

  Instructions for implementation:

   

  1. Install the QFE package. This package delivers the WCELDCMD.EXE component, which is a non-GUI version of the WCELOAD tool.

   

  2. Edit the \public\common\cesysgen\Makefile.

          - locate the one location where 'wceload' appears.

          - ADD 'wceldcmd' as another item in the dependency list

   

  3. Edit the \public\common\oak\misc\common.bib file.

          - locate the SYSGEN section for WCELOAD, marked by the @CESYSGEN IF CE_MODULES_WCELOAD marker

          - INSERT the following section after the corresponding ENDIF for the WCELOAD section:

   

                  ; @CESYSGEN IF CE_MODULES_WCELDCMD

                  wceload.exe $(_FLATRELEASEDIR)\wceldcmd.exe NK

                  ; @CESYSGEN ENDIF

   

  It is NOT an error that the name WCELOAD.EXE appears in this new section.

   

  4. Edit the CESYSGEN.BAT for your project. This file is in \PUBLIC\<projectname>\WINCE300\MISC.

          - locate the line that sets CE_MODULES to include "wceload" in the list.

          - CHANGE the 'wceload' to 'wceldcmd'

          - Close and reopen the workspace in Platform Builder.

   

  Repeat step #4 for any other projects that you wish to use the new headless WCELoad component. Projects needing the original wceload component will still build using the old setting. The feature will always be called "wceload.exe" once installed on the device.

   

  5. Perform a Clean build, and Build platform

   

  Troubleshooting

  - If both wceldcmd and wceload are selected in the component list (via cesysgen.bat), then a build error will occur at the MakeImage stage:

   

  ERROR: Duplicate entry for module wceload.exe

   

  Component:  WEBVIEW

   

  • QFE 28 - A script error may occur because an empty string is not valid. JScript is actually converting the string versions of "true" and "false" to 1 and 0 (respectively). It apparently doesn’t know how to convert and empty string, which causes the error.

  • 020517_Q315028 - pIE leaks memory when browsing away from a .HTM page containing FORM text tags (such as textbox, textarea). Also, any third party application using ATL's CContainedWindow class may also leak approximately 500 bytes per edit control.

   

  Component:  WININET

   

  • QFE 5 - Security issue resolved - Cookies can be stolen due to an IE security bug
  • QFE 80 - When IE/IESAMPLE issues a multiple GET request to retrieve an unknown MIME type, the second GET is issued over the first GET request’s socket before the first GET request has been closed or reset.  This causes incorrect data to be saved.
  • QFE 84 - High level data transfers such as http:// and SMB are significantly slower than raw data transfers.