Memory Access Violation inside CString

0
votes

I am using one Windows application which parses certain binary file. The app is crashing (Read access violation) every time at a certain location.

I am trying to find out the root cause of the crash.

(f74.fac): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=02b74141 ebx=00000000 ecx=02760000 edx=00414141 esi=00000000 edi=01426fe4
eip=7c91081e esp=0012eb64 ebp=0012eb8c iopl=0         nv up ei ng nz na pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00010287
ntdll!RtlpImageNtHeader+0x35:
7c91081e 813850450000    cmp     dword ptr [eax],4550h ds:0023:02b74141=????????

At Crash Point:

0:000> u eip
ntdll!RtlpImageNtHeader+0x35:
7c91081e 813850450000    cmp     dword ptr [eax],4550h
7c910824 0f858b830200    jne     ntdll!RtlpImageNtHeader+0x3d (7c938bb5)
7c91082a 834dfcff        or      dword ptr [ebp-4],0FFFFFFFFh
7c91082e e8cfe5ffff      call    ntdll!_SEH_epilog (7c90ee02)
7c910833 c20400          ret     4
7c910836 90              nop
7c910837 90              nop
7c910838 ff              ???

Stack Trace :

0:000> kb
ChildEBP RetAddr  Args to Child              
0012eb8c 7c91708f 02760000 00000216 0012f3d0 ntdll!RtlpImageNtHeader+0x35
0012ee40 7c916042 02734da8 0012eeb8 00000000 ntdll!LdrpCheckForLoadedDll+0x4cd
0012f0fc 7c9162da 00000000 02734da8 0012f3f0 ntdll!LdrpLoadDll+0x1ba
0012f3a4 7c801bb9 02734da8 0012f3f0 0012f3d0 ntdll!LdrLoadDll+0x230
0012f40c 7c801d6e 7ffdec00 00000000 00000001 kernel32!LoadLibraryExW+0x18e
*** WARNING: Unable to verify checksum for image00400000
*** ERROR: Module load completed but symbols could not be loaded for image00400000
0012f420 00407b8c 017f3ed8 00000000 00000001 kernel32!LoadLibraryExA+0x1f
WARNING: Stack unwind information not available. Following frames may be wrong.
0012f4a4 7c80c710 73eae590 0012f49c 0012f558 image00400000+0x7b8c
0012f4c8 73dd4381 017f3ed8 017f3db8 00000047 kernel32!lstrlenA+0x3b
0012f528 73dd2263 0012f628 00000000 0012f4f0 MFC42!CString::CString+0x47
0012f538 73dd2725 017ef0ac 0012f628 00407846 MFC42!CFixedAlloc::Free+0x28
0012f544 00407846 0012f628 00000000 017ef158 MFC42!CString::~CString+0x1c
00000000 00000000 00000000 00000000 00000000 image00400000+0x7846

Not sure,But I'm guessing its a problem related to heap as CString uses heap allocation. So please suggest the possible cause for this crash. Please let me know if more information is needed.

Thanks in Advance,

1
c++crashwindbgaccess-violation
It's an access violation. Most likely from something in your code that is incorrect. Since you don't show any of your code, it's impossible for us to help. - Chad
Actually its not my code.I'm using that compiled binary app.Will it help,if I share windbg crash dump ?? - Dev.K.
What does du 017f3ed8 return? - Lieven Keersmaekers
wrong base address you binary 02b74141=???????? points nowhere RtlpImageNtHeader cheks != PE signature NtHeaders = (PIMAGE_NT_HEADERS)((ULONG_PTR)Base + DosHeader->e_lfanew); /* Verify the PE Signature */ if (NtHeaders->Signature != IMAGE_NT_SIGNATURE)RtlpImageNtHeader - sergmat
Now, since you don't load (have?) symbols for this app, I would not trust the stack this far. What's the library that gets loaded (da 017f3ed8)? - deemok

1 Answers

0
votes

Parsing binary file does not have valid MZ/PE headers. Binary base in ecx=02760000 is valid, in edx=00414141 must be an offset to the IMAGE_NT_HEADERS structure in bytes istead of 414141 'AAA'. You may see 00414141 using dd 02760000+3c L1 command. RtlpImageNtHeader adds 414141 to you Base and this is mast be PE signature. Show output from !address 02760000, !dh 02760000, !address 02b74141 I may assume that 02b74141 is not mapped at all.