Uploaded image for project: 'Core ReactOS'
  1. Core ReactOS
  2. CORE-10413

win32k crashes if an invalid parent window handle is passed to CreateWindowEx

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Critical
    • Resolution: Fixed
    • Fix Version/s: 0.4.0
    • Component/s: Win32SS
    • Labels:
      None

      Description

      (..\win32ss\user\ntuser\window.c:2071) err: Cannot create a child window without a parrent!
      (..\win32ss\user\ntuser\window.c:2593) err: co_UserCreateWindowEx failed!
      Access violation - code c0000005 (!!! second chance !!!)
      win32k!co_UserCreateWindowEx+0x7f5:
      f2619c95 035050          add     edx,dword ptr [eax+50h]
      kd> .reload
      Connected to Windows Server 2003 3790 x86 compatible target at (Mon Oct 26 12:58:34.443 2015 (UTC + 1:00)), ptr64 FALSE
      Loading Kernel Symbols
      ....................................................
      Loading User Symbols
      ..............
      kd> kp
      ChildEBP RetAddr  
      f20ccc54 f261a765 win32k!co_UserCreateWindowEx(struct tagCREATESTRUCTW * Cs = 0xf20ccc94, struct _UNICODE_STRING * ClassName = 0xf20cccc8 "BUTTON", struct _LARGE_STRING * WindowName = 0xf20ccc84, void * acbiBuffer = 0x00000000)+0x7f5 [c:\ros\reactos-clean\reactos\win32ss\user\ntuser\window.c @ 2224]
      f20cccd0 804fec99 win32k!NtUserCreateWindowEx(unsigned long dwExStyle = 0, struct _LARGE_STRING * plstrClassName = 0x0012fd30, struct _LARGE_STRING * plstrClsVersion = 0x00000000, struct _LARGE_STRING * plstrWindowName = 0xf20ccc84, unsigned long dwStyle = 0x40000000, int x = 0, int y = 0, int nWidth = 0, int nHeight = 0, struct HWND__ * hWndParent = 0xffffffff, struct HMENU__ * hMenu = 0x00000000, struct HINSTANCE__ * hInstance = 0x00000000, void * lpParam = 0x00000000, unsigned long dwFlags = 0, void * acbiBuffer = 0x00000000)+0x215 [c:\ros\reactos-clean\reactos\win32ss\user\ntuser\window.c @ 2589]
      f20ccd1c 804fe24d nt!KiSystemCallTrampoline(void * Handler = 0xf261a550, void * Arguments = 0x0012fcd8, unsigned long StackBytes = 0x3c)+0x19 [c:\ros\reactos-clean\reactos\ntoskrnl\include\internal\i386\ke.h @ 742]
      f20ccd5c 80403e13 nt!KiSystemServiceHandler(struct _KTRAP_FRAME * TrapFrame = 0xf20ccd64, void * Arguments = 0x0012fcd8)+0x22d [c:\ros\reactos-clean\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1738]
      f20ccd5c 7c9493a4 nt!KiFastCallEntry+0x8c
      0012fccc 7c5d4b28 ntdll!KiFastSystemCallRet
      0012fcd0 7c5cc909 user32!ZwUserCreateWindowEx+0xc
      0012fdb8 7c5ccfe8 user32!User32CreateWindowEx(unsigned long dwExStyle = 0, char * lpClassName = 0x004335b4 "B", char * lpWindowName = 0x00000000 "", unsigned long dwStyle = 0x40000000, int x = 0, int y = 0, int nWidth = 0, int nHeight = 0, struct HWND__ * hWndParent = 0xffffffff, struct HMENU__ * hMenu = 0x00000000, struct HINSTANCE__ * hInstance = 0x00000000, void * lpParam = 0x00000000, unsigned long dwFlags = 0)+0x2b9 [c:\ros\reactos-clean\reactos\win32ss\user\user32\windows\window.c @ 283]
      0012fe38 00404f3e user32!CreateWindowExW(unsigned long dwExStyle = 0, wchar_t * lpClassName = 0x004335b4 "BUTTON", wchar_t * lpWindowName = 0x00000000 "", unsigned long dwStyle = 0x40000000, int x = 0, int y = 0, int nWidth = 0, int nHeight = 0, struct HWND__ * hWndParent = 0xffffffff, struct HMENU__ * hMenu = 0x00000000, struct HINSTANCE__ * hInstance = 0x00000000, void * lpParam = 0x00000000)+0x308 [c:\ros\reactos-clean\reactos\win32ss\user\user32\windows\window.c @ 567]
      0012fe78 0042bac7 user32_apitest!func_CreateWindowEx(void)+0xce [c:\ros\reactos-clean\reactos\modules\rostests\apitests\user32\createwindowex.c @ 24]
      0012fe90 0042b9ca user32_apitest!run_test(char * name = 0x00134018 "CreateWindowEx")+0x87 [c:\ros\reactos-clean\reactos\include\reactos\wine\test.h @ 636]
      0012ff1c 0042c5aa user32_apitest!main(int argc = 2, char ** argv = 0x00135d20)+0x14a [c:\ros\reactos-clean\reactos\include\reactos\wine\test.h @ 683]
      0012ffb4 0042c34f user32_apitest!__tmainCRTStartup(void)+0x24a [c:\ros\reactos-clean\reactos\lib\sdk\crt\startup\crtexe.c @ 311]
      0012ffc0 7c7ced47 user32_apitest!mainCRTStartup(void)+0x1f [c:\ros\reactos-clean\reactos\lib\sdk\crt\startup\crtexe.c @ 196]
      0012fff0 00000000 kernel32!BaseProcessStartup(<function> * lpStartAddress = 0x0042c330)+0x57 [c:\ros\reactos-clean\reactos\dll\win32\kernel32\client\proc.c @ 478]
      kd> ?? ParentWindow
      struct _WND * 0x00000000

      I have some local modifications. For clarity, the crashing line is

      Cs->x += ParentWindow->rcClient.left;

        Attachments

          Activity

            People

            • Assignee:
              Smiley Giannis Adamopoulos
              Reporter:
              ThFabba ThFabba
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: