crash of conhost.exe when removing scrollback buffer #19284

Closed
opened 2026-01-31 06:38:58 +00:00 by claunia · 4 comments
Owner

Originally created by @ssbssa on GitHub (Jan 30, 2023).

Windows Terminal version

No response

Windows build number

10.0.19044.2486

Other Software

No response

Steps to reproduce

Compile and start the following program in a cmd or powershell console:

#include <windows.h>

int main()
{
  HANDLE con = GetStdHandle(STD_OUTPUT_HANDLE);
  CONSOLE_SCREEN_BUFFER_INFO csbi;
  GetConsoleScreenBufferInfo(con, &csbi);

  // start with no scrollback
  COORD con_size = {
    csbi.srWindow.Right - csbi.srWindow.Left + 1,
    csbi.srWindow.Bottom - csbi.srWindow.Top + 1
  };
  SetConsoleScreenBufferSize(con, con_size);

  // add scrollback
  COORD con_scroll_size = {
    con_size.X,
    con_size.Y + 5
  };
  SetConsoleScreenBufferSize(con, con_scroll_size);

  // scroll down 1 line
  SMALL_RECT con_pos = {
    0,
    1,
    csbi.srWindow.Right - csbi.srWindow.Left,
    csbi.srWindow.Bottom - csbi.srWindow.Top + 1
  };
  SetConsoleWindowInfo(con, TRUE, &con_pos);

  // remove scrollback again
  SetConsoleScreenBufferSize(con, con_size); // <- after this conhost.exe crashes

  // small delay so console has time to crash
  Sleep(100);

  // check if console is still here
  if(!GetConsoleScreenBufferInfo(con, &csbi))
    // this returns error code 233 (ERROR_PIPE_NOT_CONNECTED)
    return GetLastError();

  return 0;
}

Expected Behavior

That the console window is still here after the program finished.

Actual Behavior

The console window disappears because conhost.exe crashes.

I see the following in the Event Viewer:

Event 1000, Application Error

Faulting application name: conhost.exe, version: 10.0.19041.1566, time stamp: 0x56b24be3
Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf
Exception code: 0xc0000409
Fault offset: 0x000000000007286e
Faulting process id: 0x8f8
Faulting application start time: 0x01d9349ec77f207f
Faulting application path: C:\Windows\system32\conhost.exe
Faulting module path: C:\Windows\System32\ucrtbase.dll
Report Id: 2debb667-aa6d-443c-a387-96a3ca9b04b4
Faulting package full name: 
Faulting package-relative application ID: 

And:

Event 1001, Windows Error Reporting

Fault bucket , type 0
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: conhost.exe
P2: 10.0.19041.1566
P3: 56b24be3
P4: ucrtbase.dll
P5: 10.0.19041.789
P6: 2bd748bf
P7: 000000000007286e
P8: c0000409
P9: 0000000000000007
P10: 

0xc0000409 is STATUS_STACK_BUFFER_OVERRUN, and 7 is fast failure code FAST_FAIL_FATAL_APP_EXIT.

Originally created by @ssbssa on GitHub (Jan 30, 2023). ### Windows Terminal version _No response_ ### Windows build number 10.0.19044.2486 ### Other Software _No response_ ### Steps to reproduce Compile and start the following program in a cmd or powershell console: ```c #include <windows.h> int main() { HANDLE con = GetStdHandle(STD_OUTPUT_HANDLE); CONSOLE_SCREEN_BUFFER_INFO csbi; GetConsoleScreenBufferInfo(con, &csbi); // start with no scrollback COORD con_size = { csbi.srWindow.Right - csbi.srWindow.Left + 1, csbi.srWindow.Bottom - csbi.srWindow.Top + 1 }; SetConsoleScreenBufferSize(con, con_size); // add scrollback COORD con_scroll_size = { con_size.X, con_size.Y + 5 }; SetConsoleScreenBufferSize(con, con_scroll_size); // scroll down 1 line SMALL_RECT con_pos = { 0, 1, csbi.srWindow.Right - csbi.srWindow.Left, csbi.srWindow.Bottom - csbi.srWindow.Top + 1 }; SetConsoleWindowInfo(con, TRUE, &con_pos); // remove scrollback again SetConsoleScreenBufferSize(con, con_size); // <- after this conhost.exe crashes // small delay so console has time to crash Sleep(100); // check if console is still here if(!GetConsoleScreenBufferInfo(con, &csbi)) // this returns error code 233 (ERROR_PIPE_NOT_CONNECTED) return GetLastError(); return 0; } ``` ### Expected Behavior That the console window is still here after the program finished. ### Actual Behavior The console window disappears because conhost.exe crashes. I see the following in the Event Viewer: ``` Event 1000, Application Error Faulting application name: conhost.exe, version: 10.0.19041.1566, time stamp: 0x56b24be3 Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf Exception code: 0xc0000409 Fault offset: 0x000000000007286e Faulting process id: 0x8f8 Faulting application start time: 0x01d9349ec77f207f Faulting application path: C:\Windows\system32\conhost.exe Faulting module path: C:\Windows\System32\ucrtbase.dll Report Id: 2debb667-aa6d-443c-a387-96a3ca9b04b4 Faulting package full name: Faulting package-relative application ID: ``` And: ``` Event 1001, Windows Error Reporting Fault bucket , type 0 Event Name: BEX64 Response: Not available Cab Id: 0 Problem signature: P1: conhost.exe P2: 10.0.19041.1566 P3: 56b24be3 P4: ucrtbase.dll P5: 10.0.19041.789 P6: 2bd748bf P7: 000000000007286e P8: c0000409 P9: 0000000000000007 P10: ``` 0xc0000409 is STATUS_STACK_BUFFER_OVERRUN, and 7 is fast failure code FAST_FAIL_FATAL_APP_EXIT.
claunia added the Issue-BugResolution-Duplicate labels 2026-01-31 06:38:59 +00:00
Author
Owner

@zadjii-msft commented on GitHub (Jan 30, 2023):

This looks vaguely like #8453 or #9461, which I don't think made its way to 1904x builds. I wonder if there's a simple way for us to have you try out the openconsole.exe (read: conhost) from a newer release and see if that fixes it... You should be able to grab the latest msixbundle and unzip that to grab the OpenConsole.exe out of that, but I don't know if we have a better writeup of how to do that laying around...

@zadjii-msft commented on GitHub (Jan 30, 2023): This looks vaguely like #8453 or #9461, which I don't think made its way to 1904x builds. I wonder if there's a simple way for us to have you try out the `openconsole.exe` (read: conhost) from a newer release and see if that fixes it... You should be able to grab the latest msixbundle and unzip that to grab the OpenConsole.exe out of that, but I don't know if we have a better writeup of how to do that laying around...
Author
Owner

@ssbssa commented on GitHub (Jan 30, 2023):

I've now tried the OpenConsole.exe from Microsoft.WindowsTerminal_Win10_1.16.10261.0_8wekyb3d8bbwe.msixbundle.
Yes, with this I can't reproduce the crash any longer, that's great.

But it also has some weird scrolling behavior for some programs now, where whenever I enter some text it scrolls back to some specific location.
Before it only did that if the cursor was below the visible area, but now it also does that when the cursor is already visible.

@ssbssa commented on GitHub (Jan 30, 2023): I've now tried the OpenConsole.exe from Microsoft.WindowsTerminal_Win10_1.16.10261.0_8wekyb3d8bbwe.msixbundle. Yes, with this I can't reproduce the crash any longer, that's great. But it also has some weird scrolling behavior for some programs now, where whenever I enter some text it scrolls back to some specific location. Before it only did that if the cursor was below the visible area, but now it also does that when the cursor is already visible.
Author
Owner

@carlos-zamora commented on GitHub (Feb 1, 2023):

Thanks. Glad this helped. I'm gonna close this one out as a /dup of #9461.

Would you mind filing a new issue with repro steps for the other issue you're seeing?

@carlos-zamora commented on GitHub (Feb 1, 2023): Thanks. Glad this helped. I'm gonna close this one out as a /dup of #9461. Would you mind filing a new issue with repro steps for the other issue you're seeing?
Author
Owner

@microsoft-github-policy-service[bot] commented on GitHub (Feb 1, 2023):

Hi! We've identified this issue as a duplicate of another one that already exists on this Issue Tracker. This specific instance is being closed in favor of tracking the concern over on the referenced thread. Thanks for your report!

@microsoft-github-policy-service[bot] commented on GitHub (Feb 1, 2023): Hi! We've identified this issue as a duplicate of another one that already exists on this Issue Tracker. This specific instance is being closed in favor of tracking the concern over on the referenced thread. Thanks for your report!
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#19284