starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-07-08 18:16:28 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

Conhost crash due to corrupted ConsoleWaitBlock::_WaitReplyMessage.msgHeader.ApiNumber #13447

New Issue
Open
opened 2026-01-31 03:42:57 +00:00 by claunia · 0 comments
claunia commented 2026-01-31 03:42:57 +00:00
Owner
Copy Link

Originally created by @emmett-b on GitHub (Apr 15, 2021).

Windows Terminal version (or Windows build number)

Windows Terminal version 1.6.10571.0
Windows version 21343.1000

Other Software

#include <Windows.h>
#include <vector>

int main() {

    const auto hConOut = GetStdHandle(STD_OUTPUT_HANDLE);
    const auto hConIn = GetStdHandle(STD_INPUT_HANDLE);

    if (!SetConsoleMode(hConOut, 0)) return 1;
    if (!SetConsoleMode(hConIn , 0)) return 1;

    auto buf = std::vector<char>();

    for (;;) {
        buf.resize(1000000);
        DWORD nCharRead;
        if (!ReadConsoleA(hConIn, buf.data(), DWORD(buf.size()), &nCharRead, NULL)) return 1;
        buf.resize(nCharRead);

        DWORD nCharWritten;
        if (!WriteConsoleA(hConOut, buf.data(), DWORD(buf.size()), &nCharWritten, NULL)) return 1;
    }
}

Steps to reproduce

Run the above "messaround" program with a debugger:
image

Smash your keyboard quickly and randomly. If OpenConsole doesn't crash after ~20 keystrokes, stop the program and retry.
Usually, after less than 20 tries, I get a crash.

The crash comes from _WaitReplyMessage.msgHeader.ApiNumber being corrupted:
image

There's usually another thread doing some memory management when this break point is hit:
image

It looks like a use-after-free of the ConsoleWaitBlock in the ConsoleWaitQueue.

Expected Behavior

no crash

Actual Behavior

crash

Originally created by @emmett-b on GitHub (Apr 15, 2021). ### Windows Terminal version (or Windows build number) Windows Terminal version 1.6.10571.0 Windows version 21343.1000 ### Other Software #include <Windows.h> #include <vector> int main() { const auto hConOut = GetStdHandle(STD_OUTPUT_HANDLE); const auto hConIn = GetStdHandle(STD_INPUT_HANDLE); if (!SetConsoleMode(hConOut, 0)) return 1; if (!SetConsoleMode(hConIn , 0)) return 1; auto buf = std::vector<char>(); for (;;) { buf.resize(1000000); DWORD nCharRead; if (!ReadConsoleA(hConIn, buf.data(), DWORD(buf.size()), &nCharRead, NULL)) return 1; buf.resize(nCharRead); DWORD nCharWritten; if (!WriteConsoleA(hConOut, buf.data(), DWORD(buf.size()), &nCharWritten, NULL)) return 1; } } ### Steps to reproduce Run the above "messaround" program with a debugger: ![image](https://user-images.githubusercontent.com/28929018/114794942-c9694100-9d8d-11eb-8eff-dbeca8573554.png) Smash your keyboard quickly and randomly. If OpenConsole doesn't crash after ~20 keystrokes, stop the program and retry. Usually, after less than 20 tries, I get a crash. The crash comes from `_WaitReplyMessage.msgHeader.ApiNumber` being corrupted: ![image](https://user-images.githubusercontent.com/28929018/114795069-16e5ae00-9d8e-11eb-9862-b7630c4d0d82.png) There's usually another thread doing some memory management when this break point is hit: ![image](https://user-images.githubusercontent.com/28929018/114795199-4eecf100-9d8e-11eb-9d18-245a5c0c0fb2.png) It looks like a use-after-free of the `ConsoleWaitBlock` in the `ConsoleWaitQueue`. ### Expected Behavior no crash ### Actual Behavior crash
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
⛺ Reserved
A11yCO
A11yMAS
A11ySev1
A11ySev2
A11ySev3
A11yTTValidated
A11yUsable
A11yVoiceAccess
A11yWCAG
Area-Accessibility
Area-AtlasEngine
Area-AzureShell
Area-Build
Area-Build
Area-Chat
Area-CmdPal
Area-CodeHealth
Area-Commandline
Area-CookedRead
Area-DefApp
Area-Extensibility
Area-Fonts
Area-GroupPolicy
Area-i18n
Area-Input
Area-Interaction
Area-Interop
Area-Localization
Area-Output
Area-Performance
Area-Portable
Area-Quality
Area-Remoting
Area-Rendering
Area-Schema
Area-Server
Area-Settings
Area-SettingsUI
Area-ShellExtension
Area-ShellExtension
Area-ShellExtension
Area-Suggestions
Area-Suggestions
Area-TerminalConnection
Area-TerminalControl
Area-Theming
Area-UserInterface
Area-VT
Area-Windowing
Area-WPFControl
AutoMerge
Blocking-Ingestion
Culprit-Centennial
Culprit-WinUI
Disability-All
Disability-Blind
Disability-LowVision
Disability-Mobility
External-Blocked-WinUI3
Fixed
Gathering-Data
good first issue
HCL-E+D
HCL-WindowsTerminal
Help Wanted
Impact-Compatibility
Impact-Compliance
Impact-Correctness
Impact-Visual
In-PR
InclusionBacklog
InclusionBacklog-Windows TerminalWin32
InclusionCommitted-202206
Issue-Bug
Issue-Docs
Issue-Feature
Issue-Feature
Issue-Question
Issue-Samples
Issue-Scenario
Issue-Task
Needs-Attention
Needs-Author-Feedback
Needs-Bisect
Needs-Discussion
Needs-Repro
Needs-Tag-Fix
Needs-Tag-Fix
Needs-Triage
No-Recent-Activity
Priority-0
Priority-1
Priority-2
Priority-3
Product-Cmd.exe
Product-Colortool
Product-Colortool
Product-Colortool
Product-Conhost
Product-Conpty
Product-Meta
Product-Powershell
Product-Terminal
Product-WSL
pull-request
Mirrored from GitHub Pull Request
 Resolution-Answered
Resolution-By-Design
Resolution-Duplicate
Resolution-External
Resolution-Fix-Available
Resolution-Fix-Committed
Resolution-No-Repro
Resolution-Won't-Fix
Severity-Blocking
Severity-Crash
Severity-DataLoss
spam
this-will-be-a-breaking-change
Tracking-External
WindowsTerminal_Win32
Work-Item
zAskModeBug
zInbox-Bug
No Label Area-Server Issue-Bug Priority-1 Product-Conhost Resolution-External Severity-Crash
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#13447
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?