Share via

Heap corruption mstsc.exe

alexds 1 Reputation point
2022-03-14T11:44:25.247+00:00

hi we have a user who always has his mstsc.exe who crashed.
i collected the dump file and ran it thru windbg and i get Heap corruption. but i was wondering what could be the cause?
see dbg output below, thanks for your help

Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(3cd4.1a8): Unknown exception - code c0000374 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007fff`d054d8c4 c3 ret
0:024> !analyze -v

  • *
  • Exception Analysis *
  • *

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 4514

Key  : Analysis.DebugAnalysisManager
Value: Create

Key  : Analysis.Elapsed.mSec
Value: 4620

Key  : Analysis.Init.CPU.mSec
Value: 468

Key  : Analysis.Init.Elapsed.mSec
Value: 60208

Key  : Analysis.Memory.CommitPeak.Mb
Value: 182

Key  : Timeline.Process.Start.DeltaSec
Value: 32

Key  : WER.OS.Branch
Value: vb_release

Key  : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key  : WER.OS.Version
Value: 10.0.19041.1

Key  : WER.Process.Version
Value: 10.0.19041.1266

FILE_IN_CAB: mstsc.exe.15572.dmp

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

CONTEXT: (.ecxr)
rax=0000000000000000 rbx=00000000c0000374 rcx=000000f6b167ef40
rdx=0000000000000000 rsi=0000000000000001 rdi=00007fffd06177f0
rip=00007fffd05af199 rsp=000000f6b167f540 rbp=0000000000000000
r8=0000000000000008 r9=000002d8b1199101 r10=0000000000000008
r11=000000f6b167ee01 r12=0000000000000001 r13=0000000000000000
r14=000002d8c8226750 r15=000002d8c8226330
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
ntdll!RtlReportFatalFailure+0x9:
00007fffd05af199 eb00 jmp ntdll!RtlReportFatalFailure+0xb (00007fffd05af19b)
Resetting default scope

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007fffd05af199 (ntdll!RtlReportFatalFailure+0x0000000000000009)
ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 00007fffd06177f0

PROCESS_NAME: mstsc.exe

ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.

EXCEPTION_CODE_STR: c0000374

EXCEPTION_PARAMETER1: 00007fffd06177f0

ADDITIONAL_DEBUG_TEXT: Enable Pageheap/AutoVerifer ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

FAULTING_THREAD: 000001a8

STACK_TEXT:
0000000000000000 0000000000000000 heap_corruption!mstsc.exe+0x0

STACK_COMMAND: ** Pseudo Context ** ManagedPseudo ** Value: ffffffff ** ; kb

SYMBOL_NAME: heap_corruption!mstsc.exe

MODULE_NAME: heap_corruption

IMAGE_NAME: heap_corruption

FAILURE_BUCKET_ID: HEAP_CORRUPTION_c0000374_heap_corruption!mstsc.exe

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {55a05363-eff9-64ff-75ad-d8da82df8fbc}

Followup: MachineOwner

Remote Desktop
Remote Desktop
A Microsoft app that connects remotely to computers and to virtual apps and desktops.
4,406 questions
Windows 10 Compatibility
Windows 10 Compatibility
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Compatibility: The extent to which hardware or software adheres to an accepted standard.
468 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 39,511 Reputation points
    2022-03-17T09:48:46.487+00:00

    Hi @alexds

    The dump file indicates an issue with the system RAM. I suggest that you swap out the RAM and see if the problem persists.

    I do hope this answers your question.

    ----------

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments