starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-02-04 05:35:20 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

Switching between buffers while a cooked read is active crashes conhost #21925

New Issue
Closed
opened 2026-01-31 07:58:29 +00:00 by claunia · 0 comments
claunia commented 2026-01-31 07:58:29 +00:00
Owner
Copy Link

Originally created by @lhecker on GitHub (Jul 4, 2024).

Windows build number

10.0.26120.0

Steps to reproduce

Run the following code:

#include <Windows.h>

int main() {
    SetConsoleOutputCP(CP_UTF8);
    SetConsoleMode(GetStdHandle(STD_INPUT_HANDLE), ENABLE_PROCESSED_INPUT | ENABLE_LINE_INPUT | ENABLE_ECHO_INPUT);
    SetConsoleMode(GetStdHandle(STD_OUTPUT_HANDLE), ENABLE_PROCESSED_OUTPUT | ENABLE_WRAP_AT_EOL_OUTPUT | ENABLE_VIRTUAL_TERMINAL_PROCESSING | DISABLE_NEWLINE_AUTO_RETURN);

    // Disabled the alternate screen buffer while a cooked read is ongoing.
    CreateThread(
        nullptr,
        0,
        [](void*) -> DWORD {
            Sleep(1000);
            WriteFile(GetStdHandle(STD_OUTPUT_HANDLE), "\x1b[?1049l", 8, nullptr, nullptr);
            return 0;
        },
        nullptr,
        0,
        nullptr
    );

    char buf[128];
    WriteFile(GetStdHandle(STD_OUTPUT_HANDLE), "\x1b[?1049h", 8, nullptr, nullptr);
    ReadFile(GetStdHandle(STD_INPUT_HANDLE), &buf[0], 128, nullptr, nullptr);
    return 0;
}

and press any (visible character) key.

Actual Behavior

The crash occurs because we don't cancel (or update) the pending cooked read in SCREEN_INFORMATION::UseAlternateScreenBuffer / UseMainScreenBuffer. Any version of conhost that supports alt buffers crashes with the above repro. Since support for ASB has existed for a while I'd not give this a P0, even if it's a stale pointer read (= bad, because unpredictable).

Originally created by @lhecker on GitHub (Jul 4, 2024). ### Windows build number 10.0.26120.0 ### Steps to reproduce Run the following code: ```cpp #include <Windows.h> int main() { SetConsoleOutputCP(CP_UTF8); SetConsoleMode(GetStdHandle(STD_INPUT_HANDLE), ENABLE_PROCESSED_INPUT | ENABLE_LINE_INPUT | ENABLE_ECHO_INPUT); SetConsoleMode(GetStdHandle(STD_OUTPUT_HANDLE), ENABLE_PROCESSED_OUTPUT | ENABLE_WRAP_AT_EOL_OUTPUT | ENABLE_VIRTUAL_TERMINAL_PROCESSING | DISABLE_NEWLINE_AUTO_RETURN); // Disabled the alternate screen buffer while a cooked read is ongoing. CreateThread( nullptr, 0, [](void*) -> DWORD { Sleep(1000); WriteFile(GetStdHandle(STD_OUTPUT_HANDLE), "\x1b[?1049l", 8, nullptr, nullptr); return 0; }, nullptr, 0, nullptr ); char buf[128]; WriteFile(GetStdHandle(STD_OUTPUT_HANDLE), "\x1b[?1049h", 8, nullptr, nullptr); ReadFile(GetStdHandle(STD_INPUT_HANDLE), &buf[0], 128, nullptr, nullptr); return 0; } ``` and press any (visible character) key. ### Actual Behavior The crash occurs because we don't cancel (or update) the pending cooked read in `SCREEN_INFORMATION::UseAlternateScreenBuffer` / `UseMainScreenBuffer`. Any version of conhost that supports alt buffers crashes with the above repro. Since support for ASB has existed for a while I'd not give this a P0, even if it's a stale pointer read (= bad, because unpredictable).
claunia added the Product-ConhostIssue-BugNeeds-Tag-FixPriority-1Area-CookedRead labels 2026-01-31 07:58:29 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
⛺ Reserved
A11yCO
A11yMAS
A11ySev1
A11ySev2
A11ySev3
A11yTTValidated
A11yUsable
A11yVoiceAccess
A11yWCAG
Area-Accessibility
Area-AtlasEngine
Area-AzureShell
Area-Build
Area-Build
Area-Chat
Area-CmdPal
Area-CodeHealth
Area-Commandline
Area-CookedRead
Area-DefApp
Area-Extensibility
Area-Fonts
Area-GroupPolicy
Area-i18n
Area-Input
Area-Interaction
Area-Interop
Area-Localization
Area-Output
Area-Performance
Area-Portable
Area-Quality
Area-Remoting
Area-Rendering
Area-Schema
Area-Server
Area-Settings
Area-SettingsUI
Area-ShellExtension
Area-ShellExtension
Area-ShellExtension
Area-Suggestions
Area-Suggestions
Area-TerminalConnection
Area-TerminalControl
Area-Theming
Area-UserInterface
Area-VT
Area-Windowing
Area-WPFControl
AutoMerge
Blocking-Ingestion
Culprit-Centennial
Culprit-WinUI
Disability-All
Disability-Blind
Disability-LowVision
Disability-Mobility
External-Blocked-WinUI3
Fixed
Gathering-Data
good first issue
HCL-E+D
HCL-WindowsTerminal
Help Wanted
Impact-Compatibility
Impact-Compliance
Impact-Correctness
Impact-Visual
In-PR
InclusionBacklog
InclusionBacklog-Windows TerminalWin32
InclusionCommitted-202206
Issue-Bug
Issue-Docs
Issue-Feature
Issue-Feature
Issue-Question
Issue-Samples
Issue-Scenario
Issue-Task
Needs-Attention
Needs-Author-Feedback
Needs-Bisect
Needs-Discussion
Needs-Repro
Needs-Tag-Fix
Needs-Tag-Fix
Needs-Triage
No-Recent-Activity
Priority-0
Priority-1
Priority-2
Priority-3
Product-Cmd.exe
Product-Colortool
Product-Colortool
Product-Colortool
Product-Conhost
Product-Conpty
Product-Meta
Product-Powershell
Product-Terminal
Product-WSL
pull-request
Mirrored from GitHub Pull Request
 Resolution-Answered
Resolution-By-Design
Resolution-Duplicate
Resolution-External
Resolution-Fix-Available
Resolution-Fix-Committed
Resolution-No-Repro
Resolution-Won't-Fix
Severity-Blocking
Severity-Crash
Severity-DataLoss
spam
this-will-be-a-breaking-change
Tracking-External
WindowsTerminal_Win32
Work-Item
zAskModeBug
zInbox-Bug
No Label Area-CookedRead Issue-Bug Needs-Tag-Fix Priority-1 Product-Conhost
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#21925
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?