starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-02-03 21:25:34 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

Crash: Use after free of std::function through CodepointWidthDetector #3330

New Issue
Closed
opened 2026-01-30 23:18:48 +00:00 by claunia · 7 comments
claunia commented 2026-01-30 23:18:48 +00:00
Owner
Copy Link

Originally created by @0xabu on GitHub (Aug 9, 2019).

Originally assigned to: @DHowett-MSFT on GitHub.

Environment

Windows build number: Microsoft Windows [Version 10.0.18362.267]
Windows Terminal version (if applicable): 0.3.2171.0

Steps to reproduce

I'm honestly not sure what I was doing. This might be #2251?

Expected behavior

The terminal shouldn't crash.

Actual behavior

ExceptionAddress: 00007ffdd2990f60 (uiautomationcore!MenuOpened_Event_GUID)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000008
   Parameter[1]: 00007ffdd2990f60
Attempt to execute non-executable address 00007ffdd2990f60

 # Child-SP          RetAddr           Call Site
0c 00000004`2aefe098 00007ffd`b226761b uiautomationcore!MenuOpened_Event_GUID
0d (Inline Function) --------`-------- TerminalControl!std::_Invoker_pmf_pointer::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 
0e (Inline Function) --------`-------- TerminalControl!std::invoke+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 
0f (Inline Function) --------`-------- TerminalControl!std::_Invoker_ret<std::_Unforced,0>::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1492] 
10 (Inline Function) --------`-------- TerminalControl!std::_Call_binder+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1485] 
11 (Inline Function) --------`-------- TerminalControl!std::_Binder<std::_Unforced,bool (__cdecl Microsoft::Console::Render::Renderer::*)(std::basic_string_view<wchar_t,std::char_traits<wchar_t> >),Microsoft::Console::Render::Renderer *,std::_Ph<1> const &>::operator()+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1531] 
12 (Inline Function) --------`-------- TerminalControl!std::_Invoker_functor::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 
13 (Inline Function) --------`-------- TerminalControl!std::invoke+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 
14 (Inline Function) --------`-------- TerminalControl!std::_Invoker_ret<bool,0>::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1483] 
15 00000004`2aefe0a0 00000000`00000000 TerminalControl!std::_Func_impl_no_alloc<std::_Binder<std::_Unforced,bool (__cdecl Microsoft::Console::Render::Renderer::*)(std::basic_string_view<wchar_t,std::char_traits<wchar_t> >),Microsoft::Console::Render::Renderer *,std::_Ph<1> const &>,bool,std::basic_string_view<wchar_t,std::char_traits<wchar_t> > >::_Do_call+0x1b [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1007]

I'm happy to share the crash dump out of band.

Originally created by @0xabu on GitHub (Aug 9, 2019). Originally assigned to: @DHowett-MSFT on GitHub. # Environment ```none Windows build number: Microsoft Windows [Version 10.0.18362.267] Windows Terminal version (if applicable): 0.3.2171.0 ``` # Steps to reproduce I'm honestly not sure what I was doing. This might be #2251? # Expected behavior The terminal shouldn't crash. # Actual behavior ``` ExceptionAddress: 00007ffdd2990f60 (uiautomationcore!MenuOpened_Event_GUID) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000008 Parameter[1]: 00007ffdd2990f60 Attempt to execute non-executable address 00007ffdd2990f60 # Child-SP RetAddr Call Site 0c 00000004`2aefe098 00007ffd`b226761b uiautomationcore!MenuOpened_Event_GUID 0d (Inline Function) --------`-------- TerminalControl!std::_Invoker_pmf_pointer::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 0e (Inline Function) --------`-------- TerminalControl!std::invoke+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 0f (Inline Function) --------`-------- TerminalControl!std::_Invoker_ret<std::_Unforced,0>::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1492] 10 (Inline Function) --------`-------- TerminalControl!std::_Call_binder+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1485] 11 (Inline Function) --------`-------- TerminalControl!std::_Binder<std::_Unforced,bool (__cdecl Microsoft::Console::Render::Renderer::*)(std::basic_string_view<wchar_t,std::char_traits<wchar_t> >),Microsoft::Console::Render::Renderer *,std::_Ph<1> const &>::operator()+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1531] 12 (Inline Function) --------`-------- TerminalControl!std::_Invoker_functor::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 13 (Inline Function) --------`-------- TerminalControl!std::invoke+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 14 (Inline Function) --------`-------- TerminalControl!std::_Invoker_ret<bool,0>::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1483] 15 00000004`2aefe0a0 00000000`00000000 TerminalControl!std::_Func_impl_no_alloc<std::_Binder<std::_Unforced,bool (__cdecl Microsoft::Console::Render::Renderer::*)(std::basic_string_view<wchar_t,std::char_traits<wchar_t> >),Microsoft::Console::Render::Renderer *,std::_Ph<1> const &>,bool,std::basic_string_view<wchar_t,std::char_traits<wchar_t> > >::_Do_call+0x1b [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1007] ``` I'm happy to share the crash dump out of band.
claunia commented 2026-01-30 23:18:49 +00:00
Author
Owner
Copy Link

@0xabu commented on GitHub (Aug 9, 2019):

Did someone set a callback pointing to a GUID?

@0xabu commented on GitHub (Aug 9, 2019): Did someone set a callback pointing to a GUID?
claunia commented 2026-01-30 23:18:50 +00:00
Author
Owner
Copy Link

@DHowett-MSFT commented on GitHub (Aug 9, 2019):

This is more likely a use-after-free or an std::function parked on an invalid address than an actual callback pointing to a GUID 😁

@DHowett-MSFT commented on GitHub (Aug 9, 2019): This is more likely a use-after-free or an std::function parked on an invalid address than an actual callback pointing to a GUID :grin:
claunia commented 2026-01-30 23:18:50 +00:00
Author
Owner
Copy Link

@0xabu commented on GitHub (Aug 9, 2019):

Hmm, after ~1 week without any crash, I just hit a second in the space of a few minutes. Same symptom (std::invoke callback gone awry), different stack.

ExceptionAddress: 00007ffdc19e8b4b (TerminalControl!Microsoft::Console::Render::Renderer::`vcall'{120}'+0x0000000000000003)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

0c 000000de`62bfe498 00007ffd`c19e76ab TerminalControl!Microsoft::Console::Render::Renderer::`vcall'{120}'+0x3
0d (Inline Function) --------`-------- TerminalControl!std::_Invoker_pmf_pointer::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 
0e (Inline Function) --------`-------- TerminalControl!std::invoke+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 
0f (Inline Function) --------`-------- TerminalControl!std::_Invoker_ret<std::_Unforced,0>::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1492] 
10 (Inline Function) --------`-------- TerminalControl!std::_Call_binder+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1485] 
11 (Inline Function) --------`-------- TerminalControl!std::_Binder<std::_Unforced,bool (__cdecl Microsoft::Console::Render::Renderer::*)(std::basic_string_view<wchar_t,std::char_traits<wchar_t> >),Microsoft::Console::Render::Renderer *,std::_Ph<1> const &>::operator()+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1531] 
12 (Inline Function) --------`-------- TerminalControl!std::_Invoker_functor::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 
13 (Inline Function) --------`-------- TerminalControl!std::invoke+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 
14 (Inline Function) --------`-------- TerminalControl!std::_Invoker_ret<bool,0>::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1483] 
15 000000de`62bfe4a0 00007ffd`c1a0ba9c TerminalControl!std::_Func_impl_no_alloc<std::_Binder<std::_Unforced,bool (__cdecl Microsoft::Console::Render::Renderer::*)(std::basic_string_view<wchar_t,std::char_traits<wchar_t> >),Microsoft::Console::Render::Renderer *,std::_Ph<1> const &>,bool,std::basic_string_view<wchar_t,std::char_traits<wchar_t> > >::_Do_call+0x1b [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1007] 
16 (Inline Function) --------`-------- TerminalControl!std::_Func_class<bool,std::basic_string_view<wchar_t,std::char_traits<wchar_t> > >::operator()+0x1d [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1049] 
17 000000de`62bfe4e0 00007ffd`c1a0b988 TerminalControl!CodepointWidthDetector::_checkFallbackViaCache+0xec [E:\BA\30\s\src\types\CodepointWidthDetector.cpp @ 148] 
18 000000de`62bfe5c0 00007ffd`c19f868e TerminalControl!CodepointWidthDetector::_lookupIsWide+0x118 [E:\BA\30\s\src\types\CodepointWidthDetector.cpp @ 117] 
19 (Inline Function) --------`-------- TerminalControl!OutputCellView::{ctor}+0x12 [E:\BA\30\s\src\buffer\out\OutputCellView.cpp @ 19] 
1a 000000de`62bfe610 00007ffd`c1a1926b TerminalControl!OutputCellIterator::s_GenerateView+0x17e [E:\BA\30\s\src\buffer\out\OutputCellIterator.cpp @ 412] 
1b (Inline Function) --------`-------- TerminalControl!OutputCellIterator::s_GenerateView+0x56 [E:\BA\30\s\src\buffer\out\OutputCellIterator.cpp @ 387] 
1c (Inline Function) --------`-------- TerminalControl!OutputCellIterator::{ctor}+0x60 [E:\BA\30\s\src\buffer\out\OutputCellIterator.cpp @ 102] 
1d 000000de`62bfe690 00007ffd`c1a1b1d9 TerminalControl!Microsoft::Terminal::Core::Terminal::_WriteBuffer+0x34b [E:\BA\30\s\src\cascadia\TerminalCore\Terminal.cpp @ 374] 
1e 000000de`62bfea80 00007ffd`c1a1c878 TerminalControl!Microsoft::Terminal::Core::Terminal::PrintString+0x9 [E:\BA\30\s\src\cascadia\TerminalCore\TerminalApi.cpp @ 16] 
1f 000000de`62bfeab0 00007ffd`c1a1f063 TerminalControl!TerminalDispatch::PrintString+0x28 [E:\BA\30\s\src\cascadia\TerminalCore\TerminalDispatch.cpp @ 31] 
20 000000de`62bfeaf0 00007ffd`c1a22a8b TerminalControl!Microsoft::Console::VirtualTerminal::OutputStateMachineEngine::ActionPrintString+0x23 [E:\BA\30\s\src\terminal\parser\OutputStateMachineEngine.cpp @ 109] 
21 000000de`62bfeb20 00007ffd`c19e75be TerminalControl!Microsoft::Console::VirtualTerminal::StateMachine::ProcessString+0xeb [E:\BA\30\s\src\terminal\parser\stateMachine.cpp @ 1373] 
22 (Inline Function) --------`-------- TerminalControl!Microsoft::Terminal::Core::Terminal::Write+0x2c [E:\BA\30\s\src\cascadia\TerminalCore\Terminal.cpp @ 188] 
23 (Inline Function) --------`-------- TerminalControl!winrt::Microsoft::Terminal::TerminalControl::implementation::TermControl::_InitializeTerminal::__l2::<lambda_b88b9f699081dc558b4b31a208759546>::operator()+0x5d [E:\BA\30\s\src\cascadia\TerminalControl\TermControl.cpp @ 435] 
24 000000de`62bfeb60 00007ffd`c458e819 TerminalControl!winrt::impl::delegate<winrt::Microsoft::Terminal::TerminalConnection::TerminalOutputEventArgs,<lambda_b88b9f699081dc558b4b31a208759546> >::Invoke+0xbe [E:\BA\30\s\src\cascadia\TerminalControl\Generated Files\winrt\Microsoft.Terminal.TerminalConnection.h @ 90] 
25 (Inline Function) --------`-------- TerminalConnection!winrt::Microsoft::Terminal::TerminalConnection::TerminalOutputEventArgs::operator()+0xc [E:\BA\30\s\src\cascadia\TerminalConnection\Generated Files\winrt\Microsoft.Terminal.TerminalConnection.h @ 247] 
26 000000de`62bfebe0 00007ffd`c458876b TerminalConnection!winrt::impl::invoke<winrt::Microsoft::Terminal::TerminalConnection::TerminalOutputEventArgs,winrt::hstring>+0x19 [E:\BA\30\s\src\cascadia\TerminalConnection\Generated Files\winrt\base.h @ 4901] 
27 000000de`62bfec20 00007ffd`c45a13da TerminalConnection!winrt::event<winrt::Microsoft::Terminal::TerminalConnection::TerminalOutputEventArgs>::operator()<winrt::hstring>+0x9b [E:\BA\30\s\src\cascadia\TerminalConnection\Generated Files\winrt\base.h @ 5033] 
28 000000de`62bfec70 00007ffd`f6ed7bd4 TerminalConnection!winrt::Microsoft::Terminal::TerminalConnection::implementation::ConhostConnection::_OutputThread+0x16a [E:\BA\30\s\src\cascadia\TerminalConnection\ConhostConnection.cpp @ 218]
@0xabu commented on GitHub (Aug 9, 2019): Hmm, after ~1 week without any crash, I just hit a second in the space of a few minutes. Same symptom (std::invoke callback gone awry), different stack. ``` ExceptionAddress: 00007ffdc19e8b4b (TerminalControl!Microsoft::Console::Render::Renderer::`vcall'{120}'+0x0000000000000003) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff 0c 000000de`62bfe498 00007ffd`c19e76ab TerminalControl!Microsoft::Console::Render::Renderer::`vcall'{120}'+0x3 0d (Inline Function) --------`-------- TerminalControl!std::_Invoker_pmf_pointer::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 0e (Inline Function) --------`-------- TerminalControl!std::invoke+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 0f (Inline Function) --------`-------- TerminalControl!std::_Invoker_ret<std::_Unforced,0>::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1492] 10 (Inline Function) --------`-------- TerminalControl!std::_Call_binder+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1485] 11 (Inline Function) --------`-------- TerminalControl!std::_Binder<std::_Unforced,bool (__cdecl Microsoft::Console::Render::Renderer::*)(std::basic_string_view<wchar_t,std::char_traits<wchar_t> >),Microsoft::Console::Render::Renderer *,std::_Ph<1> const &>::operator()+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1531] 12 (Inline Function) --------`-------- TerminalControl!std::_Invoker_functor::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 13 (Inline Function) --------`-------- TerminalControl!std::invoke+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1457] 14 (Inline Function) --------`-------- TerminalControl!std::_Invoker_ret<bool,0>::_Call+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\type_traits @ 1483] 15 000000de`62bfe4a0 00007ffd`c1a0ba9c TerminalControl!std::_Func_impl_no_alloc<std::_Binder<std::_Unforced,bool (__cdecl Microsoft::Console::Render::Renderer::*)(std::basic_string_view<wchar_t,std::char_traits<wchar_t> >),Microsoft::Console::Render::Renderer *,std::_Ph<1> const &>,bool,std::basic_string_view<wchar_t,std::char_traits<wchar_t> > >::_Do_call+0x1b [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1007] 16 (Inline Function) --------`-------- TerminalControl!std::_Func_class<bool,std::basic_string_view<wchar_t,std::char_traits<wchar_t> > >::operator()+0x1d [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.22.27905\include\functional @ 1049] 17 000000de`62bfe4e0 00007ffd`c1a0b988 TerminalControl!CodepointWidthDetector::_checkFallbackViaCache+0xec [E:\BA\30\s\src\types\CodepointWidthDetector.cpp @ 148] 18 000000de`62bfe5c0 00007ffd`c19f868e TerminalControl!CodepointWidthDetector::_lookupIsWide+0x118 [E:\BA\30\s\src\types\CodepointWidthDetector.cpp @ 117] 19 (Inline Function) --------`-------- TerminalControl!OutputCellView::{ctor}+0x12 [E:\BA\30\s\src\buffer\out\OutputCellView.cpp @ 19] 1a 000000de`62bfe610 00007ffd`c1a1926b TerminalControl!OutputCellIterator::s_GenerateView+0x17e [E:\BA\30\s\src\buffer\out\OutputCellIterator.cpp @ 412] 1b (Inline Function) --------`-------- TerminalControl!OutputCellIterator::s_GenerateView+0x56 [E:\BA\30\s\src\buffer\out\OutputCellIterator.cpp @ 387] 1c (Inline Function) --------`-------- TerminalControl!OutputCellIterator::{ctor}+0x60 [E:\BA\30\s\src\buffer\out\OutputCellIterator.cpp @ 102] 1d 000000de`62bfe690 00007ffd`c1a1b1d9 TerminalControl!Microsoft::Terminal::Core::Terminal::_WriteBuffer+0x34b [E:\BA\30\s\src\cascadia\TerminalCore\Terminal.cpp @ 374] 1e 000000de`62bfea80 00007ffd`c1a1c878 TerminalControl!Microsoft::Terminal::Core::Terminal::PrintString+0x9 [E:\BA\30\s\src\cascadia\TerminalCore\TerminalApi.cpp @ 16] 1f 000000de`62bfeab0 00007ffd`c1a1f063 TerminalControl!TerminalDispatch::PrintString+0x28 [E:\BA\30\s\src\cascadia\TerminalCore\TerminalDispatch.cpp @ 31] 20 000000de`62bfeaf0 00007ffd`c1a22a8b TerminalControl!Microsoft::Console::VirtualTerminal::OutputStateMachineEngine::ActionPrintString+0x23 [E:\BA\30\s\src\terminal\parser\OutputStateMachineEngine.cpp @ 109] 21 000000de`62bfeb20 00007ffd`c19e75be TerminalControl!Microsoft::Console::VirtualTerminal::StateMachine::ProcessString+0xeb [E:\BA\30\s\src\terminal\parser\stateMachine.cpp @ 1373] 22 (Inline Function) --------`-------- TerminalControl!Microsoft::Terminal::Core::Terminal::Write+0x2c [E:\BA\30\s\src\cascadia\TerminalCore\Terminal.cpp @ 188] 23 (Inline Function) --------`-------- TerminalControl!winrt::Microsoft::Terminal::TerminalControl::implementation::TermControl::_InitializeTerminal::__l2::<lambda_b88b9f699081dc558b4b31a208759546>::operator()+0x5d [E:\BA\30\s\src\cascadia\TerminalControl\TermControl.cpp @ 435] 24 000000de`62bfeb60 00007ffd`c458e819 TerminalControl!winrt::impl::delegate<winrt::Microsoft::Terminal::TerminalConnection::TerminalOutputEventArgs,<lambda_b88b9f699081dc558b4b31a208759546> >::Invoke+0xbe [E:\BA\30\s\src\cascadia\TerminalControl\Generated Files\winrt\Microsoft.Terminal.TerminalConnection.h @ 90] 25 (Inline Function) --------`-------- TerminalConnection!winrt::Microsoft::Terminal::TerminalConnection::TerminalOutputEventArgs::operator()+0xc [E:\BA\30\s\src\cascadia\TerminalConnection\Generated Files\winrt\Microsoft.Terminal.TerminalConnection.h @ 247] 26 000000de`62bfebe0 00007ffd`c458876b TerminalConnection!winrt::impl::invoke<winrt::Microsoft::Terminal::TerminalConnection::TerminalOutputEventArgs,winrt::hstring>+0x19 [E:\BA\30\s\src\cascadia\TerminalConnection\Generated Files\winrt\base.h @ 4901] 27 000000de`62bfec20 00007ffd`c45a13da TerminalConnection!winrt::event<winrt::Microsoft::Terminal::TerminalConnection::TerminalOutputEventArgs>::operator()<winrt::hstring>+0x9b [E:\BA\30\s\src\cascadia\TerminalConnection\Generated Files\winrt\base.h @ 5033] 28 000000de`62bfec70 00007ffd`f6ed7bd4 TerminalConnection!winrt::Microsoft::Terminal::TerminalConnection::implementation::ConhostConnection::_OutputThread+0x16a [E:\BA\30\s\src\cascadia\TerminalConnection\ConhostConnection.cpp @ 218] ```
claunia commented 2026-01-30 23:18:50 +00:00
Author
Owner
Copy Link

@DHowett-MSFT commented on GitHub (Aug 16, 2019):

This looks like a UAF of probably a dessicated husk of a CodepointWidthDetector. We should probably not be constructing and destroying those things lightly, but we should almost certainly not be mistreating them like this.

All of the CABs @0xabu provided lead to the same sad end.

Thanks!

@DHowett-MSFT commented on GitHub (Aug 16, 2019): This looks like a UAF of probably a dessicated husk of a `CodepointWidthDetector`. _We should probably not be constructing and destroying those things lightly,_ but we should almost certainly not be mistreating them like this. All of the CABs @0xabu provided lead to the same sad end. Thanks!
claunia commented 2026-01-30 23:18:50 +00:00
Author
Owner
Copy Link

@DHowett-MSFT commented on GitHub (Aug 17, 2019):

Oh jeez, it's because we have a singleton codepoint width detector and we bind its width detector fallback to an instance of a single terminal control's renderer.

This also means that the answer for glyph widths in one tab will change based on the font in the most recently created tab.

@DHowett-MSFT commented on GitHub (Aug 17, 2019): Oh jeez, it's because we have a singleton codepoint width detector and we bind its width detector fallback to an instance of a single terminal control's renderer. This also means that the answer for glyph widths in one tab will change based on the font in the most recently created tab.
claunia commented 2026-01-30 23:18:50 +00:00
Author
Owner
Copy Link

@miniksa commented on GitHub (Sep 24, 2019):

Assigning Dustin because we talked about this briefly in the hallway and I want to remember to not pick it up out from under what his idea is here.

@miniksa commented on GitHub (Sep 24, 2019): Assigning Dustin because we talked about this briefly in the hallway and I want to remember to not pick it up out from under what his idea is here.
claunia commented 2026-01-30 23:18:51 +00:00
Author
Owner
Copy Link

@ghost commented on GitHub (Oct 23, 2019):

:tada:This issue was addressed in #2928, which has now been successfully released as Windows Terminal Preview v0.6.2951.0.🎉

Handy links:

@ghost commented on GitHub (Oct 23, 2019): :tada:This issue was addressed in #2928, which has now been successfully released as `Windows Terminal Preview v0.6.2951.0`.:tada: Handy links: * [Release Notes](https://github.com/microsoft/terminal/releases/tag/v0.6.2951.0) * [Store Download](https://www.microsoft.com/store/apps/9n0dx20hk701?cid=storebadge&ocid=badge)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
⛺ Reserved
A11yCO
A11yMAS
A11ySev1
A11ySev2
A11ySev3
A11yTTValidated
A11yUsable
A11yVoiceAccess
A11yWCAG
Area-Accessibility
Area-AtlasEngine
Area-AzureShell
Area-Build
Area-Build
Area-Chat
Area-CmdPal
Area-CodeHealth
Area-Commandline
Area-CookedRead
Area-DefApp
Area-Extensibility
Area-Fonts
Area-GroupPolicy
Area-i18n
Area-Input
Area-Interaction
Area-Interop
Area-Localization
Area-Output
Area-Performance
Area-Portable
Area-Quality
Area-Remoting
Area-Rendering
Area-Schema
Area-Server
Area-Settings
Area-SettingsUI
Area-ShellExtension
Area-ShellExtension
Area-ShellExtension
Area-Suggestions
Area-Suggestions
Area-TerminalConnection
Area-TerminalControl
Area-Theming
Area-UserInterface
Area-VT
Area-Windowing
Area-WPFControl
AutoMerge
Blocking-Ingestion
Culprit-Centennial
Culprit-WinUI
Disability-All
Disability-Blind
Disability-LowVision
Disability-Mobility
External-Blocked-WinUI3
Fixed
Gathering-Data
good first issue
HCL-E+D
HCL-WindowsTerminal
Help Wanted
Impact-Compatibility
Impact-Compliance
Impact-Correctness
Impact-Visual
In-PR
InclusionBacklog
InclusionBacklog-Windows TerminalWin32
InclusionCommitted-202206
Issue-Bug
Issue-Docs
Issue-Feature
Issue-Feature
Issue-Question
Issue-Samples
Issue-Scenario
Issue-Task
Needs-Attention
Needs-Author-Feedback
Needs-Bisect
Needs-Discussion
Needs-Repro
Needs-Tag-Fix
Needs-Tag-Fix
Needs-Triage
No-Recent-Activity
Priority-0
Priority-1
Priority-2
Priority-3
Product-Cmd.exe
Product-Colortool
Product-Colortool
Product-Colortool
Product-Conhost
Product-Conpty
Product-Meta
Product-Powershell
Product-Terminal
Product-WSL
pull-request
Mirrored from GitHub Pull Request
 Resolution-Answered
Resolution-By-Design
Resolution-Duplicate
Resolution-External
Resolution-Fix-Available
Resolution-Fix-Committed
Resolution-No-Repro
Resolution-Won't-Fix
Severity-Blocking
Severity-Crash
Severity-DataLoss
spam
this-will-be-a-breaking-change
Tracking-External
WindowsTerminal_Win32
Work-Item
zAskModeBug
zInbox-Bug
No Label Area-Server Issue-Bug Needs-Tag-Fix Product-Conhost Product-Terminal Resolution-Fix-Committed Severity-Crash
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#3330
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?