Today, RtlCreateActivationContext (CreateActCtxW) opens the source manifest file via NtOpenFile without the FILE_SHARE_DELETE sharing mode.
This causes CreateActCtxW to fail if the source manifest file was created with the FILE_DELETE_ON_CLOSE flag. FILE_DELETE_ON_CLOSE is often used for temporary files that should be automatically deleted after use, even if the creator process crashes.
Fix this by specifying FILE_SHARE_DELETE for sharing mode when opening the source manifest or module file. This allows the source manifest or module file to be marked as deleted while it is open.
Note that concurrent deletion is not an issue for the following reasons:
- The ability to read from an open file handle is unaffected by deletion of the corresponding file's name.
- RtlCreateActivationContext does not open the source manifest or module file by the given filename (lpSource) more than once.