I've (just) also hit this specific issue when opening a file from the most recent files list. I initially thought it was a bug in DSpellCheck, because of the stack trace, but upon seeing the buffer that was overrun:

Microsoft (R) Windows Debugger Version 6.3.9600.17200 X86
Copyright (c) Microsoft Corporation. All rights reserved.

0:007> g
(4d70.4920): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0000f0f0 ebx=77508fc0 ecx=14396000 edx=14395f30 esi=00da5fcc edi=14395f32
eip=00a01c20 esp=00da5ec8 ebp=00da5ed0 iopl=0         nv up ei ng nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
notepad__+0x1c20:
00a01c20 668b01          mov     ax,word ptr [ecx]        ds:002b:14396000=????
*** WARNING: Unable to verify checksum for C:\Program Files (x86)\Notepad++\plugins\DSpellCheck.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\Notepad++\plugins\DSpellCheck.dll - 
0:000> k
ChildEBP RetAddr  
WARNING: Stack unwind information not available. Following frames may be wrong.
00da5ed0 00a64cf1 notepad__+0x1c20
00da6654 00a636fd notepad__+0x64cf1
00da8d54 00a5b55e notepad__+0x636fd
00daa758 00a5e2ce notepad__+0x5b55e
00daa7a4 00a5abc8 notepad__+0x5e2ce
00daa7bc 77898e71 notepad__+0x5abc8
00daa7e8 778990d1 USER32!_InternalCallWinProc+0x2b
00daa87c 7789ddd5 USER32!UserCallWinProcCheckWow+0x18e
00daa8b8 5f8bca95 USER32!CallWindowProcW+0x8d
00daa940 77898e71 DSpellCheck+0xca95
00daa96c 778990d1 USER32!_InternalCallWinProc+0x2b
00daaa00 7789a66f USER32!UserCallWinProcCheckWow+0x18e
00daaa6c 7789a6e0 USER32!DispatchMessageWorker+0x208
00daaa78 00b37301 USER32!DispatchMessageW+0x10
00dff9c8 00b42fb6 notepad__+0x137301
00dffa14 77117c04 notepad__+0x142fb6
00dffa28 77e2ad1f KERNEL32!BaseThreadInitThunk+0x24
00dffa70 77e2acea ntdll!__RtlUserThreadStart+0x2f
00dffa80 00000000 ntdll!_RtlUserThreadStart+0x1b
0:000> !lmi DSpellCheck
Loaded Module Info: [dspellcheck] 
         Module: DSpellCheck
   Base Address: 5f8b0000
     Image Name: C:\Program Files (x86)\Notepad++\plugins\DSpellCheck.dll
   Machine Type: 332 (I386)
     Time Stamp: 5522d45d Mon Apr 06 14:45:49 2015
           Size: 184000
       CheckSum: 0
Characteristics: 2102  
Debug Directories not present
     Image Type: FILE     - Image read successfully from symbol search path.
                 C:\Program Files (x86)\Notepad++\plugins\DSpellCheck.dll
    Symbol Type: EXPORT   - PDB not found
    Load Report: export symbols
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Current verifier stop:
APPLICATION_VERIFIER_HEAPS_FIRST_CHANCE_ACCESS_VIOLATION (13)
First chance access violation for current stack trace.
This is the most common application verifier stop. Typically it is caused by a
buffer overrun error. The heap verifier places a non-accessible page at the end
of a heap allocation and a buffer overrun will cause an exception by
touching this page. To debug this stop identify the access address that caused
the exception and then use the following debugger command:
    !heap -p -a ACCESS_ADDRESS
This command will give details about the nature of the error and what heap block is
overrun. It will also give the stack trace for the block allocation.
There are several other causes for this stop. For example accessing a heap block
after being freed. The same debugger command will be useful for this case too. 
Arguments:
Arg1: 0df40000, Invalid address causing the exception. 
Arg2: 00b4139c, Code address executing the invalid access. 
Arg3: 00da88a4, Exception record. 
Arg4: 00da88f4, Context record. 

Previous verifier stop:
APPLICATION_VERIFIER_HEAPS_FIRST_CHANCE_ACCESS_VIOLATION (13)
First chance access violation for current stack trace.
This is the most common application verifier stop. Typically it is caused by a
buffer overrun error. The heap verifier places a non-accessible page at the end
of a heap allocation and a buffer overrun will cause an exception by
touching this page. To debug this stop identify the access address that caused
the exception and then use the following debugger command:
    !heap -p -a ACCESS_ADDRESS
This command will give details about the nature of the error and what heap block is
overrun. It will also give the stack trace for the block allocation.
There are several other causes for this stop. For example accessing a heap block
after being freed. The same debugger command will be useful for this case too. 
Arguments:
Arg1: 0df40000, Invalid address causing the exception. 
Arg2: 00b4139c, Code address executing the invalid access. 
Arg3: 00da88a4, Exception record. 
Arg4: 00da88f4, Context record. 

FAULTING_IP: 
notepad__+1c20
00a01c20 668b01          mov     ax,word ptr [ecx]

EXCEPTION_RECORD:  00da88a4 -- (.exr 0xda88a4)
ExceptionAddress: bad1bad1
   ExceptionCode: bad1bad1
  ExceptionFlags: bad1bad1
NumberParameters: -1160660271
   Parameter[0]: bad1bad1
   Parameter[1]: bad1bad1
   Parameter[2]: bad1bad1
   Parameter[3]: bad1bad1
   Parameter[4]: bad1bad1
   Parameter[5]: bad1bad1
   Parameter[6]: bad1bad1
   Parameter[7]: bad1bad1
   Parameter[8]: bad1bad1
   Parameter[9]: bad1bad1
   Parameter[10]: bad1bad1
   Parameter[11]: bad1bad1
   Parameter[12]: bad1bad1
   Parameter[13]: bad1bad1
   Parameter[14]: bad1bad1

CONTEXT:  00000000 -- (.cxr 0x0;r)
eax=0000f0f0 ebx=77508fc0 ecx=14396000 edx=14395f30 esi=00da5fcc edi=14395f32
eip=00a01c20 esp=00da5ec8 ebp=00da5ed0 iopl=0         nv up ei ng nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
notepad__+0x1c20:
00a01c20 668b01          mov     ax,word ptr [ecx]        ds:002b:14396000=????

FAULTING_THREAD:  00004920

PROCESS_NAME:  notepad++.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  14396000

READ_ADDRESS:  14396000 

FOLLOWUP_IP: 
notepad__+14139c
00b4139c 0fb6041e        movzx   eax,byte ptr [esi+ebx]

NTGLOBALFLAG:  2000100

APPLICATION_VERIFIER_FLAGS:  81443267

APP:  notepad++.exe

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre

ADDITIONAL_DEBUG_TEXT:  Exploitable because of a buffer overrun or underrun when full pageheap is enabled

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_EXPLOITABLE

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ_EXPLOITABLE

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ_EXPLOITABLE

LAST_CONTROL_TRANSFER:  from 00a64cf1 to 00a01c20

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
00da5ed0 00a64cf1 14395f30 c8d5c095 00000000 notepad__+0x1c20
00da6654 00a636fd 14395f30 00000000 00000000 notepad__+0x64cf1
00da8d54 00a5b55e 0000a03f c8d50199 00a5aba0 notepad__+0x636fd
00daa758 00a5e2ce 000909d6 00000111 0000a03f notepad__+0x5b55e
00daa7a4 00a5abc8 000909d6 00000111 0000a03f notepad__+0x5e2ce
00daa7bc 77898e71 000909d6 00000111 0000a03f notepad__+0x5abc8
00daa7e8 778990d1 00a5aba0 000909d6 00000111 USER32!_InternalCallWinProc+0x2b
00daa87c 7789ddd5 00a5aba0 00000000 00000111 USER32!UserCallWinProcCheckWow+0x18e
00daa8b8 5f8bca95 00a5aba0 000909d6 00000111 USER32!CallWindowProcW+0x8d
00daa940 77898e71 000909d6 00000111 0000a03f DSpellCheck+0xca95
00daa96c 778990d1 5f8bc720 000909d6 00000111 USER32!_InternalCallWinProc+0x2b
00daaa00 7789a66f 5f8bc720 00000000 00000111 USER32!UserCallWinProcCheckWow+0x18e
00daaa6c 7789a6e0 bf116343 00dff9c8 00b37301 USER32!DispatchMessageWorker+0x208
00daaa78 00b37301 00daaa94 c8d05f09 00b42eaf USER32!DispatchMessageW+0x10
00dff9c8 00b42fb6 00a00000 00000000 091acff9 notepad__+0x137301
00dffa14 77117c04 7e9e8000 77117be0 bf7e4b51 notepad__+0x142fb6
00dffa28 77e2ad1f 7e9e8000 bf8071a8 00000000 KERNEL32!BaseThreadInitThunk+0x24
00dffa70 77e2acea ffffffff 77e10215 00000000 ntdll!__RtlUserThreadStart+0x2f
00dffa80 00000000 00b42eaf 7e9e8000 00000000 ntdll!_RtlUserThreadStart+0x1b


STACK_COMMAND:  .cxr 0x0 ; kb

SYMBOL_NAME:  notepad__+14139c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: notepad__

IMAGE_NAME:  notepad++.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  555fcdf9

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_EXPLOITABLE_c0000005_notepad++.exe!Unknown

BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_READ_EXPLOITABLE_notepad__+14139c

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:invalid_pointer_read_exploitable_c0000005_notepad++.exe!unknown

FAILURE_ID_HASH:  {32293818-bbe7-ba7c-d491-6fa48a74f722}

Followup: MachineOwner
---------

0:000> da 0df3FFD8
0df3ffd8  "C:\Users\Alexander Riccio\Dropbo"
0df3fff8  "x.......????????????????????????"
0df40018  "????????????????????????????????"
0df40038  "????????????????????????????????"
0df40058  "????????????????????????????????"
0df40078  "????????????????????????????????"
0df40098  "????????????????????????????????"
0df400b8  "????????????????????????????????"
0df400d8  "????????????????????????????????"
0df400f8  "????????????????????????????????"
0df40118  "????????????????????????????????"
0df40138  "????????????????????????????????"

...I knew that DSpellCheck wasn't the culprit.

Failed to detect Dropbox in Windows10 #135

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions