binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

Crash when closing tab

Open romanholidaypancakes opened this issue 8 months ago • 3 comments

Version and Platform (required):

  • Binary Ninja Version: free 5.0.7486
  • Edition: free
  • OS: windows
  • OS Version: 11
  • CPU Architecture: x64

Bug Description: I opened three tabs and it crashed when I closed the second one.

Steps To Reproduce: I can't reproduce it, but I have the crash stack (I can't provide the dmp file), if you need other windbg command information please let me know

0:000> K
 # Child-SP          RetAddr               Call Site
00 00000057`0b0f9f98 00007ffb`2a5591f8     ntdll!NtWaitForMultipleObjects+0x14
01 00000057`0b0f9fa0 00007ffb`2a5587ce     ntdll!WerpWaitForCrashReporting+0xa8
02 00000057`0b0fa020 00007ffb`2a557f6b     ntdll!RtlReportExceptionHelper+0x33e
03 00000057`0b0fa0f0 00007ffb`2a57d574     ntdll!RtlReportException+0x9b
04 00000057`0b0fa170 00007ffb`2a4ff827     ntdll!RtlReportFatalFailure$filt$0+0x33
05 00000057`0b0fa1a0 00007ffb`2a515e1f     ntdll!_C_specific_handler+0x97
06 00000057`0b0fa210 00007ffb`2a48e8a6     ntdll!RtlpExecuteHandlerForException+0xf
07 00000057`0b0fa240 00007ffb`2a4c4975     ntdll!RtlDispatchException+0x286
08 00000057`0b0fa990 00007ffb`2a57d539     ntdll!RtlRaiseException+0x195
09 00000057`0b0fb170 00007ffb`2a57d503     ntdll!RtlReportFatalFailure+0x9
0a 00000057`0b0fb1c0 00007ffb`2a58659a     ntdll!RtlReportCriticalFailure+0x97
0b 00000057`0b0fb2b0 00007ffb`2a58687a     ntdll!RtlpHeapHandleError+0x12
0c 00000057`0b0fb2e0 00007ffb`2a592875     ntdll!RtlpHpHeapHandleError+0x7a
0d 00000057`0b0fb310 00007ffb`2a4ac3dc     ntdll!RtlpLogHeapFailure+0x45
0e 00000057`0b0fb340 00007ffb`2a4ab021     ntdll!RtlpFreeHeapInternal+0x84c
0f 00000057`0b0fb400 00007ffb`27f7364b     ntdll!RtlFreeHeap+0x51
10 00000057`0b0fb440 00007ff9`fd9fae84     ucrtbase!_free_base+0x1b
11 00000057`0b0fb470 00007ff9`fd9fa897     Qt6Widgets!QLabel::clear+0x184
12 00000057`0b0fb4a0 00007ff6`7546ea15     Qt6Widgets!QLabel::~QLabel+0x27
13 00000057`0b0fb4d0 00007ff9`fe804ee0     binaryninja+0x77ea15
14 00000057`0b0fb500 00007ff9`fd8dbcc2     Qt6Core!QObjectPrivate::deleteChildren+0x80
15 00000057`0b0fb550 00007ff6`762ebc4f     Qt6Widgets!QWidget::~QWidget+0x5e2
16 00000057`0b0fb5f0 00007ff9`fe808785     binaryninja+0x15fbc4f
17 00000057`0b0fb620 00007ff9`fd8e3ad8     Qt6Core!QObject::event+0xa5
18 00000057`0b0fb730 00007ff9`fd97bf33     Qt6Widgets!QWidget::event+0xe68
19 00000057`0b0fb810 00007ff9`fd8a2082     Qt6Widgets!QFrame::event+0x33
1a 00000057`0b0fb840 00007ff9`fd8a1231     Qt6Widgets!QApplicationPrivate::notify_helper+0x152
1b 00000057`0b0fb870 00007ff9`fe7c18ef     Qt6Widgets!QApplication::notify+0x16d1
1c 00000057`0b0fbd40 00007ff9`fe7c40c2     Qt6Core!QCoreApplication::notifyInternal2+0x10f
1d 00000057`0b0fbdb0 00007ff9`fe23c27f     Qt6Core!QCoreApplicationPrivate::sendPostedEvents+0x202
1e 00000057`0b0fbea0 00007ff9`fe947360     Qt6Gui!QWindowsGuiEventDispatcher::sendPostedEvents+0xf
1f 00000057`0b0fbed0 00007ff9`fe23c1f9     Qt6Core!QEventDispatcherWin32::processEvents+0x90
20 00000057`0b0ff060 00007ff9`fe7c7ff4     Qt6Gui!QWindowsGuiEventDispatcher::processEvents+0x19
21 00000057`0b0ff090 00007ff9`fe7bfce1     Qt6Core!QEventLoop::exec+0x1c4
22 00000057`0b0ff130 00007ff6`7556d727     Qt6Core!QCoreApplication::exec+0x161
23 00000057`0b0ff1b0 00007ff6`7c4f85c4     binaryninja+0x87d727
24 00000057`0b0ffcd0 00007ffb`2923259d     binaryninja+0x78085c4
25 00000057`0b0ffd10 00007ffb`2a4caf58     kernel32!BaseThreadInitThunk+0x1d
26 00000057`0b0ffd40 00000000`00000000     ntdll!RtlUserThreadStart+0x28

Expected Behavior:

Screenshots/Video Recording: na

Binary: na

Additional Information: na

romanholidaypancakes avatar Jun 07 '25 12:06 romanholidaypancakes

Did you happen to save the module base addresses?

psifertex avatar Jun 07 '25 13:06 psifertex

all module base addresses

show / hide
0:000> lm
start             end                 module name
00007ff6`74cf0000 00007ff6`81ea8000   binaryninja   (no symbols)           
00007ff9`fa790000 00007ff9`fb0b8000   dbgeng     (deferred)             
00007ff9`fd890000 00007ff9`fde9d000   Qt6Widgets   (export symbols)       Qt6Widgets.dll
00007ff9`fdea0000 00007ff9`fe718000   Qt6Gui     (export symbols)       Qt6Gui.dll
00007ff9`fe720000 00007ff9`fece8000   Qt6Core    (export symbols)       Qt6Core.dll
00007ffa`4f860000 00007ffa`4f869000   wsock32    (deferred)             
00007ffa`56a50000 00007ffa`56b48000   Microsoft_VisualStudio_Setup_Configuration_Native   (deferred)             
00007ffa`83d70000 00007ffa`83fa8000   dbghelp    (deferred)             
00007ffa`8f680000 00007ffa`8f6c4000   MSVCP140_2   (deferred)             
00007ffa`ace80000 00007ffa`acf9b000   dbgmodel   (deferred)             
00007ffa`acfa0000 00007ffa`ad022000   Qt6Svg     (deferred)             
00007ffa`ad030000 00007ffa`ad0bf000   qjpeg      (deferred)             
00007ffa`ad0c0000 00007ffa`ad1a0000   qwindows   (deferred)             
00007ffa`b1e50000 00007ffa`b1e59000   MSVCP140_1   (deferred)             
00007ffa`ce940000 00007ffa`ce966000   D3D12      (deferred)             
00007ffa`d0980000 00007ffa`d09b8000   dbgcore    (deferred)             
00007ffa`d36d0000 00007ffa`d36dc000   qsvg       (deferred)             
00007ffa`d36e0000 00007ffa`d36ee000   qgif       (deferred)             
00007ffa`ec350000 00007ffa`ec79c000   UIAutomationCore   (deferred)             
00007ffa`effc0000 00007ffa`f001e000   dataexchange   (deferred)             
00007ffa`f2630000 00007ffa`f27a5000   Windows_UI_Immersive   (deferred)             
00007ffa`f5700000 00007ffa`f58a8000   d3d9       (deferred)             
00007ffa`fa9c0000 00007ffa`fa9e8000   edputil    (deferred)             
00007ffb`012a0000 00007ffb`012a9000   IconCodecService   (deferred)             
00007ffb`02830000 00007ffb`02847000   wtdccm     (deferred)             
00007ffb`02e70000 00007ffb`02e89000   netapi32   (deferred)             
00007ffb`03a70000 00007ffb`03a8e000   mpr        (deferred)             
00007ffb`049a0000 00007ffb`049c8000   srvcli     (deferred)             
00007ffb`053b0000 00007ffb`053bc000   VCRUNTIME140_1   (deferred)             
00007ffb`053c0000 00007ffb`05448000   msvcp140   (deferred)             
00007ffb`05450000 00007ffb`0546f000   VCRUNTIME140   (deferred)             
00007ffb`059c0000 00007ffb`05b3e000   Windows_UI   (deferred)             
00007ffb`0d770000 00007ffb`0d8b3000   textinputframework   (deferred)             
00007ffb`0e260000 00007ffb`0e313000   comctl32   (deferred)             
00007ffb`0e8a0000 00007ffb`0eb3b000   comctl32_7ffb0e8a0000   (deferred)             
00007ffb`1bd00000 00007ffb`1c06c000   CoreUIComponents   (deferred)             
00007ffb`1ce50000 00007ffb`1ce99000   directxdatabasehelper   (deferred)             
00007ffb`1d460000 00007ffb`1d497000   xmllite    (deferred)             
00007ffb`1d610000 00007ffb`1d642000   cryptnet   (deferred)             
00007ffb`1e600000 00007ffb`1e857000   d3d11      (deferred)             
00007ffb`1e860000 00007ffb`1ead3000   DWrite     (deferred)             
00007ffb`1f1a0000 00007ffb`1f2d5000   CoreMessaging   (deferred)             
00007ffb`1f7f0000 00007ffb`1f7fa000   version    (deferred)             
00007ffb`1f980000 00007ffb`1f9b4000   winmm      (deferred)             
00007ffb`1f9c0000 00007ffb`1fc66000   twinapi_appcore   (deferred)             
00007ffb`217a0000 00007ffb`21950000   WindowsCodecs   (deferred)             
00007ffb`21990000 00007ffb`21a43000   uxtheme    (deferred)             
00007ffb`21b10000 00007ffb`21c07000   dxgi       (deferred)             
00007ffb`21c10000 00007ffb`21c3e000   dwmapi     (deferred)             
00007ffb`24a10000 00007ffb`24a47000   DXCore     (deferred)             
00007ffb`254b0000 00007ffb`25dcd000   windows_storage   (deferred)             
00007ffb`25ff0000 00007ffb`25ffc000   netutils   (deferred)             
00007ffb`260e0000 00007ffb`2610d000   IPHLPAPI   (deferred)             
00007ffb`26110000 00007ffb`26160000   authz      (deferred)             
00007ffb`263d0000 00007ffb`263e3000   umpdc      (deferred)             
00007ffb`263f0000 00007ffb`2643d000   powrprof   (deferred)             
00007ffb`26440000 00007ffb`26454000   wtsapi32   (deferred)             
00007ffb`26460000 00007ffb`2646c000   secur32    (deferred)             
00007ffb`265f0000 00007ffb`26627000   rsaenh     (deferred)             
00007ffb`26690000 00007ffb`266a8000   kernel_appcore   (deferred)             
00007ffb`268f0000 00007ffb`26933000   sspicli    (deferred)             
00007ffb`26c00000 00007ffb`26c28000   userenv    (deferred)             
00007ffb`26d60000 00007ffb`26d6c000   CRYPTBASE   (deferred)             
00007ffb`26d70000 00007ffb`26d8b000   cryptsp    (deferred)             
00007ffb`26dc0000 00007ffb`26dd2000   msasn1     (deferred)             
00007ffb`26ee0000 00007ffb`26f17000   ntasn1     (deferred)             
00007ffb`26f20000 00007ffb`26f4d000   ncrypt     (deferred)             
00007ffb`27220000 00007ffb`2724c000   devobj     (deferred)             
00007ffb`27250000 00007ffb`2729e000   cfgmgr32   (deferred)             
00007ffb`27490000 00007ffb`274bb000   profapi    (deferred)             
00007ffb`27560000 00007ffb`276c7000   crypt32    (deferred)             
00007ffb`276d0000 00007ffb`276f6000   win32u     (deferred)             
00007ffb`27700000 00007ffb`2783f000   WinTypes   (deferred)             
00007ffb`27840000 00007ffb`27962000   gdi32full   (deferred)             
00007ffb`27970000 00007ffb`27998000   bcrypt     (deferred)             
00007ffb`279a0000 00007ffb`27a3a000   msvcp_win   (deferred)             
00007ffb`27a40000 00007ffb`27abb000   bcryptprimitives   (deferred)             
00007ffb`27b80000 00007ffb`27f53000   KERNELBASE   (deferred)             
00007ffb`27f60000 00007ffb`28071000   ucrtbase # (pdb symbols)          d:\\symbols\ucrtbase.pdb\B3FB7E9697D3F52D70C3BEB2AF2B94821\ucrtbase.pdb
00007ffb`28080000 00007ffb`280fc000   wintrust   (deferred)             
00007ffb`28190000 00007ffb`28341000   user32     (deferred)             
00007ffb`28350000 00007ffb`28400000   clbcatq    (deferred)             
00007ffb`28410000 00007ffb`284c1000   advapi32   (deferred)             
00007ffb`284d0000 00007ffb`285d5000   comdlg32   (deferred)             
00007ffb`285e0000 00007ffb`28e7d000   shell32    (deferred)             
00007ffb`28e80000 00007ffb`29213000   combase    (deferred)             
00007ffb`29220000 00007ffb`292e4000   kernel32 # (pdb symbols)          d:\\symbols\kernel32.pdb\8A5554B5F43F20F493564AA802625FBD1\kernel32.pdb
00007ffb`294c0000 00007ffb`29661000   ole32      (deferred)             
00007ffb`29670000 00007ffb`29ae4000   setupapi   (deferred)             
00007ffb`29af0000 00007ffb`29bc7000   oleaut32   (deferred)             
00007ffb`29bf0000 00007ffb`29c19000   gdi32      (deferred)             
00007ffb`29c80000 00007ffb`29cb1000   imm32      (deferred)             
00007ffb`29d60000 00007ffb`29e74000   rpcrt4     (deferred)             
00007ffb`29f50000 00007ffb`29ff7000   msvcrt     (deferred)             
00007ffb`2a000000 00007ffb`2a15e000   msctf      (deferred)             
00007ffb`2a160000 00007ffb`2a1d1000   ws2_32     (deferred)             
00007ffb`2a1e0000 00007ffb`2a246000   shlwapi    (deferred)             
00007ffb`2a250000 00007ffb`2a2f7000   sechost    (deferred)             
00007ffb`2a300000 00007ffb`2a40b000   SHCore     (deferred)             
00007ffb`2a410000 00007ffb`2a42f000   imagehlp   (deferred)             
00007ffb`2a470000 00007ffb`2a687000   ntdll    # (pdb symbols)          d:\\symbols\ntdll.pdb\1D4D267D40C0A40F66FA6648222A6C821\ntdll.pdb

Unloaded modules:
00007ffb`250a0000 00007ffb`250b5000   resourcepolicyclient.dll
00007ffa`ace40000 00007ffa`ace7a000   nvdlistx.dll
00007ffa`ace40000 00007ffa`ace7a000   nvdlistx.dll
00007ffa`ace40000 00007ffa`ace7a000   nvdlistx.dll
00007ffa`ace40000 00007ffa`ace7a000   nvdlistx.dll
00007ffb`129d0000 00007ffb`12a6f000   IntelControlLib.dll
00007ffa`ad630000 00007ffa`ad67d000   ControlLib.dll
00007ffb`250a0000 00007ffb`250b5000   resourcepolicyclient.dll
00007ffa`ad640000 00007ffa`ad67a000   nvdlistx.dll
00007ffa`ad640000 00007ffa`ad67a000   nvdlistx.dll
00007ffa`57f90000 00007ffa`594c6000   igd9dxva64.dll
00007ffa`aa560000 00007ffa`ac28e000   media_bin_64.dll
00007ffa`594d0000 00007ffa`5aa67000   igd9trinity64.dll
00007ffb`14190000 00007ffb`141b6000   igc64.dll
00007ffb`10f20000 00007ffb`11362000   igdgmm64.dll
00007ffa`5aa70000 00007ffa`5ace5000   igdumdim64.dll
00007ffa`a4620000 00007ffa`a68a7000   nvd3dumx.dll
00007ffa`e41e0000 00007ffa`e7c91000   nvgpucomp64.dll
00007ffa`e3cc0000 00007ffa`e3d99000   NvMemMapStoragex.dll
00007ffa`e88f0000 00007ffa`e89b2000   nvldumdx.dll
00007ffb`1d4a0000 00007ffb`1d602000   drvstore.dll
00007ffb`26e30000 00007ffb`26e80000   wldp.dll

romanholidaypancakes avatar Jun 07 '25 14:06 romanholidaypancakes

This looks like memory corruption/UAF

plafosse avatar Jun 17 '25 13:06 plafosse

new crash, still caused by closing the tab page

0:000> k
 # Child-SP          RetAddr               Call Site
00 000000d3`cb9ba0a8 00007ffb`2a5591f8     ntdll!NtWaitForMultipleObjects+0x14
01 000000d3`cb9ba0b0 00007ffb`2a5587ce     ntdll!WerpWaitForCrashReporting+0xa8
02 000000d3`cb9ba130 00007ffb`2a557f6b     ntdll!RtlReportExceptionHelper+0x33e
03 000000d3`cb9ba200 00007ffb`2a57d574     ntdll!RtlReportException+0x9b
04 000000d3`cb9ba280 00007ffb`2a4ff827     ntdll!RtlReportFatalFailure$filt$0+0x33
05 000000d3`cb9ba2b0 00007ffb`2a515e1f     ntdll!_C_specific_handler+0x97
06 000000d3`cb9ba320 00007ffb`2a48e8a6     ntdll!RtlpExecuteHandlerForException+0xf
07 000000d3`cb9ba350 00007ffb`2a4c4975     ntdll!RtlDispatchException+0x286
08 000000d3`cb9baaa0 00007ffb`2a57d539     ntdll!RtlRaiseException+0x195
09 000000d3`cb9bb280 00007ffb`2a57d503     ntdll!RtlReportFatalFailure+0x9
0a 000000d3`cb9bb2d0 00007ffb`2a58659a     ntdll!RtlReportCriticalFailure+0x97
0b 000000d3`cb9bb3c0 00007ffb`2a58687a     ntdll!RtlpHeapHandleError+0x12
0c 000000d3`cb9bb3f0 00007ffb`2a592875     ntdll!RtlpHpHeapHandleError+0x7a
0d 000000d3`cb9bb420 00007ffb`2a4ac3dc     ntdll!RtlpLogHeapFailure+0x45
0e 000000d3`cb9bb450 00007ffb`2a4ab021     ntdll!RtlpFreeHeapInternal+0x84c
0f 000000d3`cb9bb510 00007ffb`27f7364b     ntdll!RtlFreeHeap+0x51
10 000000d3`cb9bb550 00007ffa`0617ae84     ucrtbase!_free_base+0x1b
11 000000d3`cb9bb580 00007ffa`0617a897     Qt6Widgets!QLabel::clear+0x184
12 000000d3`cb9bb5b0 00007ff7`3db7ea15     Qt6Widgets!QLabel::~QLabel+0x27
13 000000d3`cb9bb5e0 00007ffa`05524ee0     binaryninja+0x77ea15
14 000000d3`cb9bb610 00007ffa`0605bcc2     Qt6Core!QObjectPrivate::deleteChildren+0x80
15 000000d3`cb9bb660 00007ff7`3e9fbc4f     Qt6Widgets!QWidget::~QWidget+0x5e2
16 000000d3`cb9bb700 00007ffa`05528785     binaryninja+0x15fbc4f
17 000000d3`cb9bb730 00007ffa`06063ad8     Qt6Core!QObject::event+0xa5
18 000000d3`cb9bb840 00007ffa`060fbf33     Qt6Widgets!QWidget::event+0xe68
19 000000d3`cb9bb920 00007ffa`06022082     Qt6Widgets!QFrame::event+0x33
1a 000000d3`cb9bb950 00007ffa`06021231     Qt6Widgets!QApplicationPrivate::notify_helper+0x152
1b 000000d3`cb9bb980 00007ffa`054e18ef     Qt6Widgets!QApplication::notify+0x16d1
1c 000000d3`cb9bbe50 00007ffa`054e40c2     Qt6Core!QCoreApplication::notifyInternal2+0x10f
1d 000000d3`cb9bbec0 00007ff9`fe88c27f     Qt6Core!QCoreApplicationPrivate::sendPostedEvents+0x202
1e 000000d3`cb9bbfb0 00007ffa`05667360     Qt6Gui!QWindowsGuiEventDispatcher::sendPostedEvents+0xf
1f 000000d3`cb9bbfe0 00007ff9`fe88c1f9     Qt6Core!QEventDispatcherWin32::processEvents+0x90
20 000000d3`cb9bf170 00007ffa`054e7ff4     Qt6Gui!QWindowsGuiEventDispatcher::processEvents+0x19
21 000000d3`cb9bf1a0 00007ffa`054dfce1     Qt6Core!QEventLoop::exec+0x1c4
22 000000d3`cb9bf240 00007ff7`3dc7d727     Qt6Core!QCoreApplication::exec+0x161
23 000000d3`cb9bf2c0 00007ff7`44c085c4     binaryninja+0x87d727
24 000000d3`cb9bfde0 00007ffb`2923259d     binaryninja+0x78085c4
25 000000d3`cb9bfe20 00007ffb`2a4caf58     kernel32!BaseThreadInitThunk+0x1d
26 000000d3`cb9bfe50 00000000`00000000     ntdll!RtlUserThreadStart+0x28

romanholidaypancakes avatar Jun 23 '25 18:06 romanholidaypancakes