Security Patch: New redistributable for VC++

You’ve probably heard about the critical security fixes that Microsoft released recently. This means that whenever you distribute a new build of your product, you must remember to ship the latest version of the VC++ redistributable package with it (VC++ 2005 and 2008). If you don’t, your customers will get endless side-by-side misconfiguration errors.

If you’re like me, you still want to be able to run debug builds on your test machines. As always, you need the Debug CRT for that, which I’m sure you know isn’t part of the redistributable package. Microsoft has documented two ways of installing a debug CRT on test machines:

http://msdn.microsoft.com/en-us/library/aa985618%28VS.80%29.aspx

I personally use the second approach since I know exactly which files get copied to the target machine and it’s just less intrusive in general.

When you apply the security patch on your dev machine, the various libraries that you link against should’ve been updated as well. (You can always check the final manifest file in your build folder to see which version of the CRT you’re building against.) I usually just grab the latest debug DLLs from the Visual Studio folder at:

<Path to VS folder>\VC\redist\Debug_NonRedist\x86\Microsoft.VC90.DebugCRT
<Path to VS folder>\VC\redist\Debug_NonRedist\x64\Microsoft.VC90.DebugCRT

Just copy the DLLs and the accompanying .manifest file to the target folder.

You might have noticed that the security update has overwritten the existing DLLs in those folders. This means that if you want to debug an older build of your product, you’ll have to manually pull out the DLLs and the corresponding .manifest file from the WinSxs folder. That’s not terribly hard to do (albeit annoying), and I’ll describe that in a future blog post.