binaryninja-api
binaryninja-api copied to clipboard
Crash when closing tab
Version and Platform (required):
- Binary Ninja Version: free 5.0.7486
- Edition: free
- OS: windows
- OS Version: 11
- CPU Architecture: x64
Bug Description: I opened three tabs and it crashed when I closed the second one.
Steps To Reproduce: I can't reproduce it, but I have the crash stack (I can't provide the dmp file), if you need other windbg command information please let me know
0:000> K
# Child-SP RetAddr Call Site
00 00000057`0b0f9f98 00007ffb`2a5591f8 ntdll!NtWaitForMultipleObjects+0x14
01 00000057`0b0f9fa0 00007ffb`2a5587ce ntdll!WerpWaitForCrashReporting+0xa8
02 00000057`0b0fa020 00007ffb`2a557f6b ntdll!RtlReportExceptionHelper+0x33e
03 00000057`0b0fa0f0 00007ffb`2a57d574 ntdll!RtlReportException+0x9b
04 00000057`0b0fa170 00007ffb`2a4ff827 ntdll!RtlReportFatalFailure$filt$0+0x33
05 00000057`0b0fa1a0 00007ffb`2a515e1f ntdll!_C_specific_handler+0x97
06 00000057`0b0fa210 00007ffb`2a48e8a6 ntdll!RtlpExecuteHandlerForException+0xf
07 00000057`0b0fa240 00007ffb`2a4c4975 ntdll!RtlDispatchException+0x286
08 00000057`0b0fa990 00007ffb`2a57d539 ntdll!RtlRaiseException+0x195
09 00000057`0b0fb170 00007ffb`2a57d503 ntdll!RtlReportFatalFailure+0x9
0a 00000057`0b0fb1c0 00007ffb`2a58659a ntdll!RtlReportCriticalFailure+0x97
0b 00000057`0b0fb2b0 00007ffb`2a58687a ntdll!RtlpHeapHandleError+0x12
0c 00000057`0b0fb2e0 00007ffb`2a592875 ntdll!RtlpHpHeapHandleError+0x7a
0d 00000057`0b0fb310 00007ffb`2a4ac3dc ntdll!RtlpLogHeapFailure+0x45
0e 00000057`0b0fb340 00007ffb`2a4ab021 ntdll!RtlpFreeHeapInternal+0x84c
0f 00000057`0b0fb400 00007ffb`27f7364b ntdll!RtlFreeHeap+0x51
10 00000057`0b0fb440 00007ff9`fd9fae84 ucrtbase!_free_base+0x1b
11 00000057`0b0fb470 00007ff9`fd9fa897 Qt6Widgets!QLabel::clear+0x184
12 00000057`0b0fb4a0 00007ff6`7546ea15 Qt6Widgets!QLabel::~QLabel+0x27
13 00000057`0b0fb4d0 00007ff9`fe804ee0 binaryninja+0x77ea15
14 00000057`0b0fb500 00007ff9`fd8dbcc2 Qt6Core!QObjectPrivate::deleteChildren+0x80
15 00000057`0b0fb550 00007ff6`762ebc4f Qt6Widgets!QWidget::~QWidget+0x5e2
16 00000057`0b0fb5f0 00007ff9`fe808785 binaryninja+0x15fbc4f
17 00000057`0b0fb620 00007ff9`fd8e3ad8 Qt6Core!QObject::event+0xa5
18 00000057`0b0fb730 00007ff9`fd97bf33 Qt6Widgets!QWidget::event+0xe68
19 00000057`0b0fb810 00007ff9`fd8a2082 Qt6Widgets!QFrame::event+0x33
1a 00000057`0b0fb840 00007ff9`fd8a1231 Qt6Widgets!QApplicationPrivate::notify_helper+0x152
1b 00000057`0b0fb870 00007ff9`fe7c18ef Qt6Widgets!QApplication::notify+0x16d1
1c 00000057`0b0fbd40 00007ff9`fe7c40c2 Qt6Core!QCoreApplication::notifyInternal2+0x10f
1d 00000057`0b0fbdb0 00007ff9`fe23c27f Qt6Core!QCoreApplicationPrivate::sendPostedEvents+0x202
1e 00000057`0b0fbea0 00007ff9`fe947360 Qt6Gui!QWindowsGuiEventDispatcher::sendPostedEvents+0xf
1f 00000057`0b0fbed0 00007ff9`fe23c1f9 Qt6Core!QEventDispatcherWin32::processEvents+0x90
20 00000057`0b0ff060 00007ff9`fe7c7ff4 Qt6Gui!QWindowsGuiEventDispatcher::processEvents+0x19
21 00000057`0b0ff090 00007ff9`fe7bfce1 Qt6Core!QEventLoop::exec+0x1c4
22 00000057`0b0ff130 00007ff6`7556d727 Qt6Core!QCoreApplication::exec+0x161
23 00000057`0b0ff1b0 00007ff6`7c4f85c4 binaryninja+0x87d727
24 00000057`0b0ffcd0 00007ffb`2923259d binaryninja+0x78085c4
25 00000057`0b0ffd10 00007ffb`2a4caf58 kernel32!BaseThreadInitThunk+0x1d
26 00000057`0b0ffd40 00000000`00000000 ntdll!RtlUserThreadStart+0x28
Expected Behavior:
Screenshots/Video Recording: na
Binary: na
Additional Information: na
Did you happen to save the module base addresses?
all module base addresses
show / hide
0:000> lm
start end module name
00007ff6`74cf0000 00007ff6`81ea8000 binaryninja (no symbols)
00007ff9`fa790000 00007ff9`fb0b8000 dbgeng (deferred)
00007ff9`fd890000 00007ff9`fde9d000 Qt6Widgets (export symbols) Qt6Widgets.dll
00007ff9`fdea0000 00007ff9`fe718000 Qt6Gui (export symbols) Qt6Gui.dll
00007ff9`fe720000 00007ff9`fece8000 Qt6Core (export symbols) Qt6Core.dll
00007ffa`4f860000 00007ffa`4f869000 wsock32 (deferred)
00007ffa`56a50000 00007ffa`56b48000 Microsoft_VisualStudio_Setup_Configuration_Native (deferred)
00007ffa`83d70000 00007ffa`83fa8000 dbghelp (deferred)
00007ffa`8f680000 00007ffa`8f6c4000 MSVCP140_2 (deferred)
00007ffa`ace80000 00007ffa`acf9b000 dbgmodel (deferred)
00007ffa`acfa0000 00007ffa`ad022000 Qt6Svg (deferred)
00007ffa`ad030000 00007ffa`ad0bf000 qjpeg (deferred)
00007ffa`ad0c0000 00007ffa`ad1a0000 qwindows (deferred)
00007ffa`b1e50000 00007ffa`b1e59000 MSVCP140_1 (deferred)
00007ffa`ce940000 00007ffa`ce966000 D3D12 (deferred)
00007ffa`d0980000 00007ffa`d09b8000 dbgcore (deferred)
00007ffa`d36d0000 00007ffa`d36dc000 qsvg (deferred)
00007ffa`d36e0000 00007ffa`d36ee000 qgif (deferred)
00007ffa`ec350000 00007ffa`ec79c000 UIAutomationCore (deferred)
00007ffa`effc0000 00007ffa`f001e000 dataexchange (deferred)
00007ffa`f2630000 00007ffa`f27a5000 Windows_UI_Immersive (deferred)
00007ffa`f5700000 00007ffa`f58a8000 d3d9 (deferred)
00007ffa`fa9c0000 00007ffa`fa9e8000 edputil (deferred)
00007ffb`012a0000 00007ffb`012a9000 IconCodecService (deferred)
00007ffb`02830000 00007ffb`02847000 wtdccm (deferred)
00007ffb`02e70000 00007ffb`02e89000 netapi32 (deferred)
00007ffb`03a70000 00007ffb`03a8e000 mpr (deferred)
00007ffb`049a0000 00007ffb`049c8000 srvcli (deferred)
00007ffb`053b0000 00007ffb`053bc000 VCRUNTIME140_1 (deferred)
00007ffb`053c0000 00007ffb`05448000 msvcp140 (deferred)
00007ffb`05450000 00007ffb`0546f000 VCRUNTIME140 (deferred)
00007ffb`059c0000 00007ffb`05b3e000 Windows_UI (deferred)
00007ffb`0d770000 00007ffb`0d8b3000 textinputframework (deferred)
00007ffb`0e260000 00007ffb`0e313000 comctl32 (deferred)
00007ffb`0e8a0000 00007ffb`0eb3b000 comctl32_7ffb0e8a0000 (deferred)
00007ffb`1bd00000 00007ffb`1c06c000 CoreUIComponents (deferred)
00007ffb`1ce50000 00007ffb`1ce99000 directxdatabasehelper (deferred)
00007ffb`1d460000 00007ffb`1d497000 xmllite (deferred)
00007ffb`1d610000 00007ffb`1d642000 cryptnet (deferred)
00007ffb`1e600000 00007ffb`1e857000 d3d11 (deferred)
00007ffb`1e860000 00007ffb`1ead3000 DWrite (deferred)
00007ffb`1f1a0000 00007ffb`1f2d5000 CoreMessaging (deferred)
00007ffb`1f7f0000 00007ffb`1f7fa000 version (deferred)
00007ffb`1f980000 00007ffb`1f9b4000 winmm (deferred)
00007ffb`1f9c0000 00007ffb`1fc66000 twinapi_appcore (deferred)
00007ffb`217a0000 00007ffb`21950000 WindowsCodecs (deferred)
00007ffb`21990000 00007ffb`21a43000 uxtheme (deferred)
00007ffb`21b10000 00007ffb`21c07000 dxgi (deferred)
00007ffb`21c10000 00007ffb`21c3e000 dwmapi (deferred)
00007ffb`24a10000 00007ffb`24a47000 DXCore (deferred)
00007ffb`254b0000 00007ffb`25dcd000 windows_storage (deferred)
00007ffb`25ff0000 00007ffb`25ffc000 netutils (deferred)
00007ffb`260e0000 00007ffb`2610d000 IPHLPAPI (deferred)
00007ffb`26110000 00007ffb`26160000 authz (deferred)
00007ffb`263d0000 00007ffb`263e3000 umpdc (deferred)
00007ffb`263f0000 00007ffb`2643d000 powrprof (deferred)
00007ffb`26440000 00007ffb`26454000 wtsapi32 (deferred)
00007ffb`26460000 00007ffb`2646c000 secur32 (deferred)
00007ffb`265f0000 00007ffb`26627000 rsaenh (deferred)
00007ffb`26690000 00007ffb`266a8000 kernel_appcore (deferred)
00007ffb`268f0000 00007ffb`26933000 sspicli (deferred)
00007ffb`26c00000 00007ffb`26c28000 userenv (deferred)
00007ffb`26d60000 00007ffb`26d6c000 CRYPTBASE (deferred)
00007ffb`26d70000 00007ffb`26d8b000 cryptsp (deferred)
00007ffb`26dc0000 00007ffb`26dd2000 msasn1 (deferred)
00007ffb`26ee0000 00007ffb`26f17000 ntasn1 (deferred)
00007ffb`26f20000 00007ffb`26f4d000 ncrypt (deferred)
00007ffb`27220000 00007ffb`2724c000 devobj (deferred)
00007ffb`27250000 00007ffb`2729e000 cfgmgr32 (deferred)
00007ffb`27490000 00007ffb`274bb000 profapi (deferred)
00007ffb`27560000 00007ffb`276c7000 crypt32 (deferred)
00007ffb`276d0000 00007ffb`276f6000 win32u (deferred)
00007ffb`27700000 00007ffb`2783f000 WinTypes (deferred)
00007ffb`27840000 00007ffb`27962000 gdi32full (deferred)
00007ffb`27970000 00007ffb`27998000 bcrypt (deferred)
00007ffb`279a0000 00007ffb`27a3a000 msvcp_win (deferred)
00007ffb`27a40000 00007ffb`27abb000 bcryptprimitives (deferred)
00007ffb`27b80000 00007ffb`27f53000 KERNELBASE (deferred)
00007ffb`27f60000 00007ffb`28071000 ucrtbase # (pdb symbols) d:\\symbols\ucrtbase.pdb\B3FB7E9697D3F52D70C3BEB2AF2B94821\ucrtbase.pdb
00007ffb`28080000 00007ffb`280fc000 wintrust (deferred)
00007ffb`28190000 00007ffb`28341000 user32 (deferred)
00007ffb`28350000 00007ffb`28400000 clbcatq (deferred)
00007ffb`28410000 00007ffb`284c1000 advapi32 (deferred)
00007ffb`284d0000 00007ffb`285d5000 comdlg32 (deferred)
00007ffb`285e0000 00007ffb`28e7d000 shell32 (deferred)
00007ffb`28e80000 00007ffb`29213000 combase (deferred)
00007ffb`29220000 00007ffb`292e4000 kernel32 # (pdb symbols) d:\\symbols\kernel32.pdb\8A5554B5F43F20F493564AA802625FBD1\kernel32.pdb
00007ffb`294c0000 00007ffb`29661000 ole32 (deferred)
00007ffb`29670000 00007ffb`29ae4000 setupapi (deferred)
00007ffb`29af0000 00007ffb`29bc7000 oleaut32 (deferred)
00007ffb`29bf0000 00007ffb`29c19000 gdi32 (deferred)
00007ffb`29c80000 00007ffb`29cb1000 imm32 (deferred)
00007ffb`29d60000 00007ffb`29e74000 rpcrt4 (deferred)
00007ffb`29f50000 00007ffb`29ff7000 msvcrt (deferred)
00007ffb`2a000000 00007ffb`2a15e000 msctf (deferred)
00007ffb`2a160000 00007ffb`2a1d1000 ws2_32 (deferred)
00007ffb`2a1e0000 00007ffb`2a246000 shlwapi (deferred)
00007ffb`2a250000 00007ffb`2a2f7000 sechost (deferred)
00007ffb`2a300000 00007ffb`2a40b000 SHCore (deferred)
00007ffb`2a410000 00007ffb`2a42f000 imagehlp (deferred)
00007ffb`2a470000 00007ffb`2a687000 ntdll # (pdb symbols) d:\\symbols\ntdll.pdb\1D4D267D40C0A40F66FA6648222A6C821\ntdll.pdb
Unloaded modules:
00007ffb`250a0000 00007ffb`250b5000 resourcepolicyclient.dll
00007ffa`ace40000 00007ffa`ace7a000 nvdlistx.dll
00007ffa`ace40000 00007ffa`ace7a000 nvdlistx.dll
00007ffa`ace40000 00007ffa`ace7a000 nvdlistx.dll
00007ffa`ace40000 00007ffa`ace7a000 nvdlistx.dll
00007ffb`129d0000 00007ffb`12a6f000 IntelControlLib.dll
00007ffa`ad630000 00007ffa`ad67d000 ControlLib.dll
00007ffb`250a0000 00007ffb`250b5000 resourcepolicyclient.dll
00007ffa`ad640000 00007ffa`ad67a000 nvdlistx.dll
00007ffa`ad640000 00007ffa`ad67a000 nvdlistx.dll
00007ffa`57f90000 00007ffa`594c6000 igd9dxva64.dll
00007ffa`aa560000 00007ffa`ac28e000 media_bin_64.dll
00007ffa`594d0000 00007ffa`5aa67000 igd9trinity64.dll
00007ffb`14190000 00007ffb`141b6000 igc64.dll
00007ffb`10f20000 00007ffb`11362000 igdgmm64.dll
00007ffa`5aa70000 00007ffa`5ace5000 igdumdim64.dll
00007ffa`a4620000 00007ffa`a68a7000 nvd3dumx.dll
00007ffa`e41e0000 00007ffa`e7c91000 nvgpucomp64.dll
00007ffa`e3cc0000 00007ffa`e3d99000 NvMemMapStoragex.dll
00007ffa`e88f0000 00007ffa`e89b2000 nvldumdx.dll
00007ffb`1d4a0000 00007ffb`1d602000 drvstore.dll
00007ffb`26e30000 00007ffb`26e80000 wldp.dll
This looks like memory corruption/UAF
new crash, still caused by closing the tab page
0:000> k
# Child-SP RetAddr Call Site
00 000000d3`cb9ba0a8 00007ffb`2a5591f8 ntdll!NtWaitForMultipleObjects+0x14
01 000000d3`cb9ba0b0 00007ffb`2a5587ce ntdll!WerpWaitForCrashReporting+0xa8
02 000000d3`cb9ba130 00007ffb`2a557f6b ntdll!RtlReportExceptionHelper+0x33e
03 000000d3`cb9ba200 00007ffb`2a57d574 ntdll!RtlReportException+0x9b
04 000000d3`cb9ba280 00007ffb`2a4ff827 ntdll!RtlReportFatalFailure$filt$0+0x33
05 000000d3`cb9ba2b0 00007ffb`2a515e1f ntdll!_C_specific_handler+0x97
06 000000d3`cb9ba320 00007ffb`2a48e8a6 ntdll!RtlpExecuteHandlerForException+0xf
07 000000d3`cb9ba350 00007ffb`2a4c4975 ntdll!RtlDispatchException+0x286
08 000000d3`cb9baaa0 00007ffb`2a57d539 ntdll!RtlRaiseException+0x195
09 000000d3`cb9bb280 00007ffb`2a57d503 ntdll!RtlReportFatalFailure+0x9
0a 000000d3`cb9bb2d0 00007ffb`2a58659a ntdll!RtlReportCriticalFailure+0x97
0b 000000d3`cb9bb3c0 00007ffb`2a58687a ntdll!RtlpHeapHandleError+0x12
0c 000000d3`cb9bb3f0 00007ffb`2a592875 ntdll!RtlpHpHeapHandleError+0x7a
0d 000000d3`cb9bb420 00007ffb`2a4ac3dc ntdll!RtlpLogHeapFailure+0x45
0e 000000d3`cb9bb450 00007ffb`2a4ab021 ntdll!RtlpFreeHeapInternal+0x84c
0f 000000d3`cb9bb510 00007ffb`27f7364b ntdll!RtlFreeHeap+0x51
10 000000d3`cb9bb550 00007ffa`0617ae84 ucrtbase!_free_base+0x1b
11 000000d3`cb9bb580 00007ffa`0617a897 Qt6Widgets!QLabel::clear+0x184
12 000000d3`cb9bb5b0 00007ff7`3db7ea15 Qt6Widgets!QLabel::~QLabel+0x27
13 000000d3`cb9bb5e0 00007ffa`05524ee0 binaryninja+0x77ea15
14 000000d3`cb9bb610 00007ffa`0605bcc2 Qt6Core!QObjectPrivate::deleteChildren+0x80
15 000000d3`cb9bb660 00007ff7`3e9fbc4f Qt6Widgets!QWidget::~QWidget+0x5e2
16 000000d3`cb9bb700 00007ffa`05528785 binaryninja+0x15fbc4f
17 000000d3`cb9bb730 00007ffa`06063ad8 Qt6Core!QObject::event+0xa5
18 000000d3`cb9bb840 00007ffa`060fbf33 Qt6Widgets!QWidget::event+0xe68
19 000000d3`cb9bb920 00007ffa`06022082 Qt6Widgets!QFrame::event+0x33
1a 000000d3`cb9bb950 00007ffa`06021231 Qt6Widgets!QApplicationPrivate::notify_helper+0x152
1b 000000d3`cb9bb980 00007ffa`054e18ef Qt6Widgets!QApplication::notify+0x16d1
1c 000000d3`cb9bbe50 00007ffa`054e40c2 Qt6Core!QCoreApplication::notifyInternal2+0x10f
1d 000000d3`cb9bbec0 00007ff9`fe88c27f Qt6Core!QCoreApplicationPrivate::sendPostedEvents+0x202
1e 000000d3`cb9bbfb0 00007ffa`05667360 Qt6Gui!QWindowsGuiEventDispatcher::sendPostedEvents+0xf
1f 000000d3`cb9bbfe0 00007ff9`fe88c1f9 Qt6Core!QEventDispatcherWin32::processEvents+0x90
20 000000d3`cb9bf170 00007ffa`054e7ff4 Qt6Gui!QWindowsGuiEventDispatcher::processEvents+0x19
21 000000d3`cb9bf1a0 00007ffa`054dfce1 Qt6Core!QEventLoop::exec+0x1c4
22 000000d3`cb9bf240 00007ff7`3dc7d727 Qt6Core!QCoreApplication::exec+0x161
23 000000d3`cb9bf2c0 00007ff7`44c085c4 binaryninja+0x87d727
24 000000d3`cb9bfde0 00007ffb`2923259d binaryninja+0x78085c4
25 000000d3`cb9bfe20 00007ffb`2a4caf58 kernel32!BaseThreadInitThunk+0x1d
26 000000d3`cb9bfe50 00000000`00000000 ntdll!RtlUserThreadStart+0x28