hi we have a user who always has his mstsc.exe who crashed.
i collected the dump file and ran it thru windbg and i get Heap corruption. but i was wondering what could be the cause?
see dbg output below, thanks for your help
Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(3cd4.1a8): Unknown exception - code c0000374 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007fff`d054d8c4 c3 ret
0:024> !analyze -v
Exception Analysis *
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4514
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 4620
Key : Analysis.Init.CPU.mSec
Value: 468
Key : Analysis.Init.Elapsed.mSec
Value: 60208
Key : Analysis.Memory.CommitPeak.Mb
Value: 182
Key : Timeline.Process.Start.DeltaSec
Value: 32
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
Key : WER.Process.Version
Value: 10.0.19041.1266
FILE_IN_CAB: mstsc.exe.15572.dmp
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
CONTEXT: (.ecxr)
rax=0000000000000000 rbx=00000000c0000374 rcx=000000f6b167ef40
rdx=0000000000000000 rsi=0000000000000001 rdi=00007fffd06177f0
rip=00007fffd05af199 rsp=000000f6b167f540 rbp=0000000000000000
r8=0000000000000008 r9=000002d8b1199101 r10=0000000000000008
r11=000000f6b167ee01 r12=0000000000000001 r13=0000000000000000
r14=000002d8c8226750 r15=000002d8c8226330
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
ntdll!RtlReportFatalFailure+0x9:
00007fff`d05af199 eb00 jmp ntdll!RtlReportFatalFailure+0xb (00007fff`d05af19b)
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007fffd05af199 (ntdll!RtlReportFatalFailure+0x0000000000000009)
ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 00007fffd06177f0
PROCESS_NAME: mstsc.exe
ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.
EXCEPTION_CODE_STR: c0000374
EXCEPTION_PARAMETER1: 00007fffd06177f0
ADDITIONAL_DEBUG_TEXT: Enable Pageheap/AutoVerifer ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
FAULTING_THREAD: 000001a8
STACK_TEXT:
00000000`00000000 00000000`00000000 heap_corruption!mstsc.exe+0x0
STACK_COMMAND: Pseudo Context ManagedPseudo Value: ffffffff ; kb
SYMBOL_NAME: heap_corruption!mstsc.exe
MODULE_NAME: heap_corruption
IMAGE_NAME: heap_corruption
FAILURE_BUCKET_ID: HEAP_CORRUPTION_c0000374_heap_corruption!mstsc.exe
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {55a05363-eff9-64ff-75ad-d8da82df8fbc}
