Hi ,
Our application is Windows Application Developed in .Net Framework 4.5 and the application got a feature to show PDF documents inside .Net Windows Web Browser control.
We faced a application crash at the production environment while user does operation and keeping PDF document opened within the same application .
We have raised a ticket to Microsoft and had confirmed that the issue in AdobePDF64.dll .
I have given the details below.
Time Travel Position: 34B9340000014.
user32!UserCallWinProcCheckWow+0x190:
00007ffe`204244d2 41ffd6 call r14 {acropdf64!DllUnregisterServer+0x2e85c (00000000`6a695e08)}
0:000> kn
# Child-SP RetAddr Call Site
00 0000000d`ec86d450 00007ffe`20423fe2 user32!UserCallWinProcCheckWow+0x190 [d:\blue_gdr\windows\core\ntuser\client\clmsg.c @ 159]
01 0000000d`ec86d510 00007ffe`2042aaef user32!DispatchClientMessage+0xa2 [d:\blue_gdr\windows\core\ntuser\client\client.c @ 3272]
02 0000000d`ec86d570 00007ffe`21e7cb1f user32!__fnINOUTLPPOINT5+0x2f [d:\blue_gdr\windows\core\ntuser\inc\ntcb.h @ 1999]
03 0000000d`ec86d5d0 0000000d`ef69b5bc ntdll!KiUserCallbackDispatcherContinue [d:\blue_gdr\minkernel\ntos\rtl\amd64\trampoln.asm @ 572]
04 00000418`00000788 00000000`00000000 0x0000000d`ef69b5bc
0:000> rr9
r9=0000000dec86d640
--> this is right before passing LPARAM to Adobe’s component acropdf64. LPARAM is the fourth parameter, so it is in r9.
Step in to the function:
Time Travel Position: 34B9340000024.
acropdf64!DllUnregisterServer+0x2e88f:
00000000`6a695e3b 4d63e1 movsxd r12,r9d
0:000> kn
# Child-SP RetAddr Call Site
00 0000000d`ec86d3e0 00007ffe`204244d5 acropdf64!DllUnregisterServer+0x2e88f
01 0000000d`ec86d450 00007ffe`20423fe2 user32!UserCallWinProcCheckWow+0x193 [d:\blue_gdr\windows\core\ntuser\client\clmsg.c @ 159]
02 0000000d`ec86d510 00007ffe`2042aaef user32!DispatchClientMessage+0xa2 [d:\blue_gdr\windows\core\ntuser\client\client.c @ 3272]
...
--> "movsxd r12,r9d" indicates that Adobe treats LPARAM as a 32 bit number and assign it to a signed 64 bit variable.
Before the move:
0:000> rr9
r9=0000000dec86d640
0:000> p
Time Travel Position: 34B9340000025.
acropdf64!DllUnregisterServer+0x2e892:
00000000`6a695e3e 66894c2440 mov word ptr [rsp+40h],cx ss:0000000d`ec86d420=0000
After the move:
0:000> rr12
r12=ffffffffec86d640
--> the address is not correct.
Right before calling back to Windows where the access violation occurs:
Time Travel Position: 34B94C000003E.
acropdf64!DllUnregisterServer+0x2e903:
00000000`6a695eaf ff156bfb0200 call qword ptr [acropdf64!DllUnregisterServer+0x5e474 (00000000`6a6c5a20)] ds:00000000`6a6c5a20={ntdll!NtdllDefWindowProc_A (00007ffe`21e7aa00)}
0:000> kn
# Child-SP RetAddr Call Site
00 0000000d`ec86d3e0 00007ffe`204244d5 acropdf64!DllUnregisterServer+0x2e903
01 0000000d`ec86d450 00007ffe`20423fe2 user32!UserCallWinProcCheckWow+0x193 [d:\blue_gdr\windows\core\ntuser\client\clmsg.c @ 159]
02 0000000d`ec86d510 00007ffe`2042aaef user32!DispatchClientMessage+0xa2 [d:\blue_gdr\windows\core\ntuser\client\client.c @ 3272]
...
0:000> ub .
acropdf64!DllUnregisterServer+0x2e8e9:
00000000`6a695e95 7406 je acropdf64!DllUnregisterServer+0x2e8f1 (00000000`6a695e9d)
00000000`6a695e97 89b098000000 mov dword ptr [rax+98h],esi
00000000`6a695e9d bb06000000 mov ebx,6
00000000`6a695ea2 eb14 jmp acropdf64!DllUnregisterServer+0x2e90c (00000000`6a695eb8)
00000000`6a695ea4 4d8bcc mov r9,r12
00000000`6a695ea7 4c8bc6 mov r8,rsi
00000000`6a695eaa 8bd7 mov edx,edi
00000000`6a695eac 488bcd mov rcx,rbp
0:000> rr9
r9=ffffffffec86d640
--> r9 comes from r12 that contains the bad value.
Now step over:
0:000> p
(3280.32f8): Access violation - code c0000005 (first/second chance not available)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
Time Travel Position: 34B9540000001.
user32!RealDefWindowProcWorker+0x1e3:
00007ffe`2042e247 41847120 test byte ptr [r9+20h],sil ds:ffffffff`ec86d660=??
0:000> rr9
r9=ffffffffec86d640
--> the same bad value resulting into Access Violation.
------------------------------------------------------------
Would you please help us to solve the problem?
Regards
Arockiya