BugId DoubleFree[0x190] bd0.aa2 @ acrord32.exe!ucrtbase.dll!_free_base summary

BugId:	DoubleFree[0x190] bd0.aa2
Location:	acrord32.exe!ucrtbase.dll!_free_base
Description:	The application attempted to free a 400/0x190 bytes heap block at 0x2A232E70 twice
Version:	AcroRd32.exe: 19.10.20069.49826 (x86) ucrtbase.dll: 10.0.17134.319 (x86)
Security impact:	Potentially exploitable security issue, if the attacker can force the application to allocate memory between the two frees
Arguments:	['R:\\DoubleFree.pdf']

BugId version 2018-11-21 19:42 by SkyLined. Licensed to netanelbs for commercial use.

Stack

ntdll.dll!vDbgPrintExWithPrefixInternal + 0x5D8EE (this frame is irrelevant to this bug)
ntdll.dll!DbgPrintEx + 0x1F (this frame is irrelevant to this bug)
verifier.dll!VerifierStopMessage + 0x24D (this frame is irrelevant to this bug)
verifier.dll!AVrfpDphReportCorruptedBlock + 0x1CF (this frame is irrelevant to this bug)
verifier.dll!AVrfpDphFindBusyMemoryNoCheck + 0x7D (this frame is irrelevant to this bug)
verifier.dll!AVrfpDphFindBusyMemory + 0x15 (this frame is irrelevant to this bug)
verifier.dll!AVrfpDphFindBusyMemoryAndRemoveFromBusyList + 0x20 (this frame is irrelevant to this bug)
verifier.dll!AVrfDebugPageHeapFree + 0x90 (this frame is irrelevant to this bug)
ntdll.dll!RtlDebugFreeHeap + 0x3E (this frame is irrelevant to this bug)
ntdll.dll!RtlpFreeHeap + 0xD5 (this frame is irrelevant to this bug)
ntdll.dll!RtlFreeHeap + 0x222 (this frame is irrelevant to this bug)
ucrtbase.dll!_free_base + 0x1B (id: bd0)
ucrtbase.dll!free + 0x18 (id: aa2)
JP2KLib.dll + 0x686D6 (no function symbol available)
JP2KLib.dll + 0x68E4B (no function symbol available)
JP2KLib.dll + 0x45590 (no function symbol available)
JP2KLib.dll + 0x4E166 (no function symbol available)
AcroRd32.dll + 0x-32D6A068 (no function symbol available)
AcroRd32.dll + 0x65F5FA (no function symbol available)
AcroRd32.dll + 0x660343 (no function symbol available)
AcroRd32.dll + 0x6561DB (no function symbol available)
AcroRd32.dll + 0x1ECD54 (no function symbol available)
AcroRd32.dll + 0x1EC3C8 (no function symbol available)
AcroRd32.dll + 0x1EB765 (no function symbol available)
AcroRd32.dll + 0x1EB6EE (no function symbol available)
AcroRd32.dll + 0x1EB5D3 (no function symbol available)
AcroRd32.dll + 0x1EA580 (no function symbol available)
AcroRd32.dll + 0x1E79C4 (no function symbol available)
AcroRd32.dll + 0x1E757E (no function symbol available)
AcroRd32.dll + 0x1CFF22 (no function symbol available)
AcroRd32.dll + 0x1CE312 (no function symbol available)
AcroRd32.dll + 0x1C054E (no function symbol available)
AcroRd32.dll + 0x1BFCDC (no function symbol available)
AcroRd32.dll + 0x1BD701 (no function symbol available)
AcroRd32.dll + 0x1BD420 (no function symbol available)
AcroRd32.dll + 0x1BD2E0 (no function symbol available)
AcroRd32.dll + 0x1BC670 (no function symbol available)
AcroRd32.dll + 0x1BB16A (no function symbol available)
AcroRd32.dll + 0x1BA034 (no function symbol available)
AcroRd32.dll + 0x1B87C2 (no function symbol available)
AcroRd32.dll + 0x1B8358 (no function symbol available)
AcroRd32.dll + 0x1B690D (no function symbol available)
AcroRd32.dll + 0x1B63F5 (no function symbol available)
AcroRd32.dll + 0x1B624F (no function symbol available)
AcroRd32.dll + 0x1B603A (no function symbol available)
AcroRd32.dll + 0x81B19 (no function symbol available)
AcroRd32.dll + 0x819F5 (no function symbol available)
USER32.dll!_InternalCallWinProc + 0x2B
USER32.dll!UserCallWinProcCheckWow + 0x3AA
USER32.dll!DispatchClientMessage + 0xEA
USER32.dll!__fnDWORD + 0x49
ntdll.dll!KiUserCallbackDispatcher + 0x4D
win32u.dll!NtUserDispatchMessage + 0xC
USER32.dll!DispatchMessageWorker + 0x31A
USER32.dll!DispatchMessageW + 0x10
AcroRd32.dll + 0x90ADA (no function symbol available)
AcroRd32.dll + 0x908A4 (no function symbol available)
AcroRd32.dll + 0x2AB59 (no function symbol available)
AcroRd32.dll + 0x2A42D (no function symbol available)
AcroRd32.exe + 0x7319 (no function symbol available)
AcroRd32.exe + 0x108F7A (no function symbol available)
KERNEL32.DLL!BaseThreadInitThunk + 0x24
ntdll.dll!__RtlUserThreadStart + 0x2F
ntdll.dll!_RtlUserThreadStart + 0x1B

⇓ click on the title of a section to open or close it.

VERIFIER STOP message

VERIFIER STOP 00000007: pid 0x318: block already freed 
        034F1000 : Heap handle
        2A260B60 : Heap block
        00000190 : Block size
        00000000 :

⇓ click on the title of a section to open or close it.

Disassembly of stack frame 12 at ucrtbase.dll!_free_base + 0x1B

74a8e0bc	83feff	cmp esi,0FFFFFFFFh
74a8e0bf	0f84f9750400	je ucrtbase!__crt_state_management::enter_os_call+0x4762e (74ad56be)
74a8e0c5	85f6	test esi,esi
74a8e0c7	0f84c5750400	je ucrtbase!__crt_state_management::enter_os_call+0x47602 (74ad5692)
74a8e0cd	6a01	push 1
74a8e0cf	57	push edi
74a8e0d0	8bce	mov ecx,esi
74a8e0d2	ff156802b774	call dword ptr [ucrtbase!__guard_check_icall_fptr (74b70268)]
74a8e0d8	ffd6	call esi
74a8e0da	8b4dfc	mov ecx,dword ptr [ebp-4]
74a8e0dd	5f	pop edi
74a8e0de	33cd	xor ecx,ebp
74a8e0e0	5e	pop esi
74a8e0e1	e83af20200	call ucrtbase!__security_check_cookie (74abd320)
74a8e0e6	8be5	mov esp,ebp
74a8e0e8	5d	pop ebp
74a8e0e9	c3	ret
74a8e0ea	cc	int 3
74a8e0eb	cc	int 3
74a8e0ec	cc	int 3
74a8e0ed	cc	int 3
74a8e0ee	cc	int 3
74a8e0ef	cc	int 3
ucrtbase!free:
74a8e0f0	8bff	mov edi,edi
74a8e0f2	55	push ebp
74a8e0f3	8bec	mov ebp,esp
74a8e0f5	51	push ecx
74a8e0f6	ff7508	push dword ptr [ebp+8]
74a8e0f9	c745fc00000000	mov dword ptr [ebp-4],0
74a8e100	8b45fc	mov eax,dword ptr [ebp-4]
74a8e103	e818000000	call ucrtbase!_free_base (74a8e120)
74a8e108	83c404	add esp,4
74a8e10b	8be5	mov esp,ebp
74a8e10d	5d	pop ebp
74a8e10e	c3	ret
74a8e10f	cc	int 3
74a8e110	cc	int 3
74a8e111	cc	int 3
74a8e112	cc	int 3
74a8e113	cc	int 3
74a8e114	cc	int 3
74a8e115	cc	int 3
74a8e116	cc	int 3
74a8e117	cc	int 3
74a8e118	cc	int 3
74a8e119	cc	int 3
74a8e11a	cc	int 3
74a8e11b	cc	int 3
74a8e11c	cc	int 3
74a8e11d	cc	int 3
74a8e11e	cc	int 3
74a8e11f	cc	int 3
ucrtbase!_free_base:
74a8e120	8bff	mov edi,edi
74a8e122	55	push ebp
74a8e123	8bec	mov ebp,esp
74a8e125	8b4508	mov eax,dword ptr [ebp+8]
74a8e128	85c0	test eax,eax
74a8e12a	7417	je ucrtbase!_free_base+0x23 (74a8e143)
74a8e12c	50	push eax
74a8e12d	6a00	push 0
74a8e12f	ff359cf0b674	push dword ptr [ucrtbase!__acrt_heap (74b6f09c)]
74a8e135	ff15f800b774	call dword ptr [ucrtbase!_imp__HeapFree (74b700f8)] // call
74a8e13b	85c0	test eax,eax // return address
74a8e13d	0f84b4750400	je ucrtbase!_free_base+0x475d7 (74ad56f7)
74a8e143	5d	pop ebp
74a8e144	c3	ret
ucrtbase!__crt_stdio_output::output_processor<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t>,__crt_stdio_output::format_validation_base<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t> > >::type_case_s:
74a8e145	8bff	mov edi,edi
74a8e147	53	push ebx
74a8e148	56	push esi
74a8e149	8bf1	mov esi,ecx
74a8e14b	57	push edi
74a8e14c	83461404	add dword ptr [esi+14h],4
74a8e150	8b4614	mov eax,dword ptr [esi+14h]
74a8e153	8b5e28	mov ebx,dword ptr [esi+28h]
74a8e156	8b78fc	mov edi,dword ptr [eax-4]
74a8e159	897e34	mov dword ptr [esi+34h],edi
74a8e15c	83fbff	cmp ebx,0FFFFFFFFh
74a8e15f	7505	jne ucrtbase!__crt_stdio_output::output_processor<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t>,__crt_stdio_output::format_validation_base<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t> > >::type_case_s+0x21 (74a8e166)
74a8e161	bbffffff7f	mov ebx,7FFFFFFFh
74a8e166	ff7604	push dword ptr [esi+4]
74a8e169	668b4e32	mov cx,word ptr [esi+32h]
74a8e16d	ff36	push dword ptr [esi]
74a8e16f	8b562c	mov edx,dword ptr [esi+2Ch]
74a8e172	e8fa650000	call ucrtbase!__crt_stdio_output::is_wide_character_specifier<wchar_t> (74a94771)
74a8e177	59	pop ecx
74a8e178	59	pop ecx
74a8e179	84c0	test al,al
74a8e17b	741e	je ucrtbase!__crt_stdio_output::output_processor<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t>,__crt_stdio_output::format_validation_base<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t> > >::type_case_s+0x56 (74a8e19b)
74a8e17d	85ff	test edi,edi
74a8e17f	0f848c750400	je ucrtbase!__crt_stdio_output::output_processor<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t>,__crt_stdio_output::format_validation_base<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t> > >::type_case_s+0x475cc (74ad5711)
74a8e185	53	push ebx
74a8e186	57	push edi
74a8e187	c6463c01	mov byte ptr [esi+3Ch],1
74a8e18b	e8e09a0100	call ucrtbase!wcsnlen (74aa7c70)
74a8e190	59	pop ecx
74a8e191	59	pop ecx
74a8e192	5f	pop edi
74a8e193	894638	mov dword ptr [esi+38h],eax
74a8e196	b001	mov al,1
74a8e198	5e	pop esi
74a8e199	5b	pop ebx
74a8e19a	c3	ret
74a8e19b	85ff	test edi,edi
74a8e19d	740b	je ucrtbase!__crt_stdio_output::output_processor<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t>,__crt_stdio_output::format_validation_base<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t> > >::type_case_s+0x65 (74a8e1aa)
74a8e19f	51	push ecx
74a8e1a0	53	push ebx
74a8e1a1	8bce	mov ecx,esi
74a8e1a3	e83dd8ffff	call ucrtbase!__crt_stdio_output::output_processor<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t>,__crt_stdio_output::format_validation_base<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t> > >::type_case_s_compute_narrow_string_length (74a8b9e5)
74a8e1a8	ebe8	jmp ucrtbase!__crt_stdio_output::output_processor<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t>,__crt_stdio_output::format_validation_base<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t> > >::type_case_s+0x4d (74a8e192)
74a8e1aa	c7463400bda674	mov dword ptr [esi+34h],offset ucrtbase!`string' (74a6bd00)
74a8e1b1	ebec	jmp ucrtbase!__crt_stdio_output::output_processor<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t>,__crt_stdio_output::format_validation_base<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t> > >::type_case_s+0x5a (74a8e19f)
74a8e1b3	cc	int 3

⇓ click on the title of a section to open or close it.

Disassembly of stack frame 13 at ucrtbase.dll!free + 0x18

74a8e078	ffd6	call esi
74a8e07a	8b4dfc	mov ecx,dword ptr [ebp-4]
74a8e07d	5f	pop edi
74a8e07e	33cd	xor ecx,ebp
74a8e080	5e	pop esi
74a8e081	e89af20200	call ucrtbase!__security_check_cookie (74abd320)
74a8e086	8be5	mov esp,ebp
74a8e088	5d	pop ebp
74a8e089	c3	ret
74a8e08a	cc	int 3
74a8e08b	cc	int 3
74a8e08c	cc	int 3
74a8e08d	cc	int 3
74a8e08e	cc	int 3
74a8e08f	cc	int 3
ucrtbase!__crt_state_management::enter_os_call:
74a8e090	8bff	mov edi,edi
74a8e092	55	push ebp
74a8e093	8bec	mov ebp,esp
74a8e095	51	push ecx
74a8e096	a1b0e2b674	mov eax,dword ptr [ucrtbase!__security_cookie (74b6e2b0)]
74a8e09b	33c5	xor eax,ebp
74a8e09d	8945fc	mov dword ptr [ebp-4],eax
74a8e0a0	a1b8f3b674	mov eax,dword ptr [ucrtbase!_fmode+0x28 (74b6f3b8)]
74a8e0a5	56	push esi
74a8e0a6	57	push edi
74a8e0a7	8b3dc4e2b674	mov edi,dword ptr [ucrtbase!__crt_global_state_mode_flsindex (74b6e2c4)]
74a8e0ad	8b35b0e2b674	mov esi,dword ptr [ucrtbase!__security_cookie (74b6e2b0)]
74a8e0b3	8bce	mov ecx,esi
74a8e0b5	83e11f	and ecx,1Fh
74a8e0b8	33f0	xor esi,eax
74a8e0ba	d3ce	ror esi,cl
74a8e0bc	83feff	cmp esi,0FFFFFFFFh
74a8e0bf	0f84f9750400	je ucrtbase!__crt_state_management::enter_os_call+0x4762e (74ad56be)
74a8e0c5	85f6	test esi,esi
74a8e0c7	0f84c5750400	je ucrtbase!__crt_state_management::enter_os_call+0x47602 (74ad5692)
74a8e0cd	6a01	push 1
74a8e0cf	57	push edi
74a8e0d0	8bce	mov ecx,esi
74a8e0d2	ff156802b774	call dword ptr [ucrtbase!__guard_check_icall_fptr (74b70268)]
74a8e0d8	ffd6	call esi
74a8e0da	8b4dfc	mov ecx,dword ptr [ebp-4]
74a8e0dd	5f	pop edi
74a8e0de	33cd	xor ecx,ebp
74a8e0e0	5e	pop esi
74a8e0e1	e83af20200	call ucrtbase!__security_check_cookie (74abd320)
74a8e0e6	8be5	mov esp,ebp
74a8e0e8	5d	pop ebp
74a8e0e9	c3	ret
74a8e0ea	cc	int 3
74a8e0eb	cc	int 3
74a8e0ec	cc	int 3
74a8e0ed	cc	int 3
74a8e0ee	cc	int 3
74a8e0ef	cc	int 3
ucrtbase!free:
74a8e0f0	8bff	mov edi,edi
74a8e0f2	55	push ebp
74a8e0f3	8bec	mov ebp,esp
74a8e0f5	51	push ecx
74a8e0f6	ff7508	push dword ptr [ebp+8]
74a8e0f9	c745fc00000000	mov dword ptr [ebp-4],0
74a8e100	8b45fc	mov eax,dword ptr [ebp-4]
74a8e103	e818000000	call ucrtbase!_free_base (74a8e120) // call
74a8e108	83c404	add esp,4 // return address
74a8e10b	8be5	mov esp,ebp
74a8e10d	5d	pop ebp
74a8e10e	c3	ret
74a8e10f	cc	int 3
74a8e110	cc	int 3
74a8e111	cc	int 3
74a8e112	cc	int 3
74a8e113	cc	int 3
74a8e114	cc	int 3
74a8e115	cc	int 3
74a8e116	cc	int 3
74a8e117	cc	int 3
74a8e118	cc	int 3
74a8e119	cc	int 3
74a8e11a	cc	int 3
74a8e11b	cc	int 3
74a8e11c	cc	int 3
74a8e11d	cc	int 3
74a8e11e	cc	int 3
74a8e11f	cc	int 3
ucrtbase!_free_base:
74a8e120	8bff	mov edi,edi
74a8e122	55	push ebp
74a8e123	8bec	mov ebp,esp
74a8e125	8b4508	mov eax,dword ptr [ebp+8]
74a8e128	85c0	test eax,eax
74a8e12a	7417	je ucrtbase!_free_base+0x23 (74a8e143)
74a8e12c	50	push eax
74a8e12d	6a00	push 0
74a8e12f	ff359cf0b674	push dword ptr [ucrtbase!__acrt_heap (74b6f09c)]
74a8e135	ff15f800b774	call dword ptr [ucrtbase!_imp__HeapFree (74b700f8)]
74a8e13b	85c0	test eax,eax
74a8e13d	0f84b4750400	je ucrtbase!_free_base+0x475d7 (74ad56f7)
74a8e143	5d	pop ebp
74a8e144	c3	ret
ucrtbase!__crt_stdio_output::output_processor<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t>,__crt_stdio_output::format_validation_base<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t> > >::type_case_s:
74a8e145	8bff	mov edi,edi
74a8e147	53	push ebx
74a8e148	56	push esi
74a8e149	8bf1	mov esi,ecx
74a8e14b	57	push edi
74a8e14c	83461404	add dword ptr [esi+14h],4
74a8e150	8b4614	mov eax,dword ptr [esi+14h]
74a8e153	8b5e28	mov ebx,dword ptr [esi+28h]
74a8e156	8b78fc	mov edi,dword ptr [eax-4]
74a8e159	897e34	mov dword ptr [esi+34h],edi
74a8e15c	83fbff	cmp ebx,0FFFFFFFFh
74a8e15f	7505	jne ucrtbase!__crt_stdio_output::output_processor<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t>,__crt_stdio_output::format_validation_base<wchar_t,__crt_stdio_output::string_output_adapter<wchar_t> > >::type_case_s+0x21 (74a8e166)
74a8e161	bbffffff7f	mov ebx,7FFFFFFFh
74a8e166	ff7604	push dword ptr [esi+4]
74a8e169	668b4e32	mov cx,word ptr [esi+32h]

⇓ click on the title of a section to open or close it.

Binary information

AcroRd32.exe

Loaded symbol image file	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Image path	AcroRd32.exe
Image name	AcroRd32.exe
Timestamp	Wed Dec 19 19:58:38 2018 (5C1A86CE)
CheckSum	00274EFE
ImageSize	0026C000
File version	19.10.20069.49826
Product version	19.10.20069.49826
File flags	0 (Mask 3F)
File OS	50004 CE Win32
File type	1.0 App
File date	00000000.00000000
Translations	0409.04e4
CompanyName	Adobe Systems Incorporated
ProductName	Adobe Acrobat Reader DC
OriginalFilename	AcroRd32.exe
ProductVersion	19.10.20069.311970
FileVersion	19.10.20069.311970
FileDescription	Adobe Acrobat Reader DC
LegalCopyright	Copyright 1984-2018 Adobe Systems Incorporated and its licensors. All rights reserved.

ucrtbase.dll

Loaded symbol image file	C:\Windows\System32\ucrtbase.dll
Image path	C:\Windows\SysWOW64\ucrtbase.dll
Image name	ucrtbase.dll
Timestamp	C1F0557A (This is a reproducible build file hash, not a timestamp)
CheckSum	0012E4B1
ImageSize	0011E000
File version	10.0.17134.319
Product version	10.0.17134.319
File flags	0 (Mask 3F)
File OS	40004 NT Win32
File type	2.0 Dll
File date	00000000.00000000
Translations	0409.04b0
CompanyName	Microsoft Corporation
ProductName	Microsoft« Windows« Operating System
InternalName	ucrtbase.dll
OriginalFilename	ucrtbase.dll
ProductVersion	10.0.17134.319
FileVersion	10.0.17134.319 (WinBuild.160101.0800)
FileDescription	Microsoft« C Runtime Library
LegalCopyright	⌐ Microsoft Corporation. All rights reserved.

⇓ click on the title of a section to open or close it.

Application and cdb output log

*** wait with pending attach
************* Path validation summary **************
Response Time (ms) Location
Deferred cache*
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred symsrv*symsrv.dll*C:\mss*http://msdl.microsoft.com/download/symbols
Symbol search path is: cache*;srv*http://msdl.microsoft.com/download/symbols;symsrv*symsrv.dll*C:\mss*http://msdl.microsoft.com/download/symbols
Executable search path is:
Page heap: pid 0x318: page heap enabled with flags 0x3.
Page heap: pid 0x318: page heap enabled with flags 0x3.
C:\Users\john\AppData\Roaming
===========================================================
VERIFIER STOP 00000007: pid 0x318: block already freed
        034F1000 : Heap handle
        2A260B60 : Heap block
        00000190 : Block size
        00000000 :

⇓ click on the title of a section to open or close it.