1900796 - Crash in [@ RtlpFreeHeapInternal | RtlFreeHeap | APP_DATA::FreeCachedMem] (pxcdrv.dll) - PDF-XChange Standard

Status: RESOLVED FIXED

(External Software Affecting Firefox :: Other, defect)

Description

[Yannis Juglaret [:yannis]]

We are receiving crashes that involve either pxcdrv.dll or pxcdrvL.dll, which belong to PDF-XChange Standard. The latest version of pxcdrv.dll available at the moment is 0.3.2563.0. I was able to obtain this version of the DLL by installing the free version of the product. pxcvdrvL.dll might come with the paid version, I'm not sure.

Example crash with latest version: here

Call stack (note that the function names for that DLL are not the actual functions involved but just the closest exported function found):

00 00007fff`0f7bc8d3 ntdll!RtlReportFatalFailure+0x9
01 00007fff`0f7c596a ntdll!RtlReportCriticalFailure+0x97
02 00007fff`0f7c5c4a ntdll!RtlpHeapHandleError+0x12
03 00007fff`0f7d1c45 ntdll!RtlpHpHeapHandleError+0x7a
04 00007fff`0f6ebecc ntdll!RtlpLogHeapFailure+0x45
05 00007fff`0f6eab11 ntdll!RtlpFreeHeapInternal+0x84c
06 00007fff`0f0aa57a ntdll!RtlFreeHeap+0x51
07 00007fff`0f08d8ae oleaut32!APP_DATA::FreeCachedMem+0x1cc5a
08 00007ffe`bdb607c3 oleaut32!SysFreeString+0x4e
09 00007ffe`bdaccf27 pxcdrv!Drv_SetPrinterOption+0x92583
0a 00007ffe`d456c1eb pxcdrv!MxdcGetPDEVAdjustment+0x5537
0b 00007ffe`d455b770 prntvpt!PTMergeAndValidatePrintTicketImp+0x35f
0c 00007ffe`d455f438 prntvpt!CPrintTicketServerBase::MergeAndValidatePrintTicket+0xa0
0d 00007ffe`9d97bc85 prntvpt!PTMergeAndValidatePrintTicket+0xb8
0e 00007ffe`9d97aa3e PrintPlatformConfig!PrintPlatform::MergePrintTicketWithDefault+0x26d
0f 00007ffe`9d97a6c6 PrintPlatformConfig!<lambda_993988ca6c09973954e47a20b97e5a8b>::operator()+0xb6
10 00007ffe`9d97ae70 PrintPlatformConfig!PrintCore::CaptureAndConvertExceptionToHR<<lambda_993988ca6c09973954e47a20b97e5a8b> >+0xe
11 00007ffe`4f0e789e PrintPlatformConfig!PrintPlatform::PrintPlatformPrintSchemaFactoryLegacy::CreatePrintSchemaTicket+0x120
12 00007ffe`4f0cfb45 Windows_Graphics_Printing!Windows::Graphics::Printing::OptionDetails::PrintTaskOptionDetailsServer::PrintTaskOptionsServerTransaction::BindPrinter+0x2ae
13 00007fff`0e9c78e3 Windows_Graphics_Printing!Windows::Graphics::Printing::PrintTaskServer::PrintTaskServerPriv::BindPrinter+0x265
14 00007fff`0ea3180a rpcrt4!Invoke+0x73
15 00007fff`0e996563 rpcrt4!Ndr64StubWorker+0xb8a
16 00007fff`0d71397f rpcrt4!NdrStubCall3+0xd3
17 00007fff`0d6e667d combase!CStdStubBuffer_Invoke+0x6f [onecore\com\combase\ndr\ndrole\stub.cxx @ 1479] 
18 --------`-------- combase!InvokeStubWithExceptionPolicyAndTracing::__l6::<lambda_c9f3956a20c9da92a64affc24fdd69ec>::operator()+0x22 [onecore\com\combase\dcomrem\channelb.cxx @ 1151] 
19 00007fff`0d6e6408 combase!ObjectMethodExceptionHandlingAction<<lambda_c9f3956a20c9da92a64affc24fdd69ec> >+0x4d [onecore\com\combase\dcomrem\excepn.hxx @ 94] 
1a --------`-------- combase!InvokeStubWithExceptionPolicyAndTracing+0xe1 [onecore\com\combase\dcomrem\channelb.cxx @ 1149] 
1b 00007fff`0d7180f1 combase!DefaultStubInvoke+0x268 [onecore\com\combase\dcomrem\channelb.cxx @ 1218] 
1c 00007fff`0d6ee087 combase!SyncServerCall::StubInvoke+0x41 [onecore\com\combase\dcomrem\ServerCall.hpp @ 791] 
1d --------`-------- combase!StubInvoke+0x303 [onecore\com\combase\dcomrem\channelb.cxx @ 1483] 
1e 00007fff`0d6b2579 combase!ServerCall::ContextInvoke+0x517 [onecore\com\combase\dcomrem\ctxchnl.cxx @ 1421] 
1f 00007fff`0d6b7603 combase!ComInvokeWithLockAndIPID+0x9a9 [onecore\com\combase\dcomrem\channelb.cxx @ 2152] 
20 --------`-------- combase!ThreadInvokeReturnHresult+0x17b [onecore\com\combase\dcomrem\channelb.cxx @ 6944] 
21 00007fff`0e9abbe2 combase!ThreadInvoke+0x193 [onecore\com\combase\dcomrem\channelb.cxx @ 7044] 
22 00007fff`0e97c0d4 rpcrt4!DispatchToStubInCNoAvrf+0x22
23 00007fff`0e97bd28 rpcrt4!RPC_INTERFACE::DispatchToStubWorker+0x1b4
24 00007fff`0e98b22c rpcrt4!RPC_INTERFACE::DispatchToStubWithObject+0x188
25 00007fff`0e98a8a6 rpcrt4!LRPC_SCALL::DispatchRequest+0x14c
26 00007fff`0e989e53 rpcrt4!LRPC_SCALL::HandleRequest+0x996
27 00007fff`0e989aac rpcrt4!LRPC_SASSOCIATION::HandleRequest+0x2c3
28 00007fff`0e9896d9 rpcrt4!LRPC_ADDRESS::HandleRequest+0x17c
29 00007fff`0e98d339 rpcrt4!LRPC_ADDRESS::ProcessIO+0x939
2a 00007fff`0f6fee77 rpcrt4!LrpcIoComplete+0x109
2b 00007fff`0f6e57bc ntdll!TppAlpcpExecuteCallback+0x157
2c 00007fff`0e79257d ntdll!TppWorkerThread+0x72c
2d 00007ffe`89069228 kernel32!BaseThreadInitThunk+0x1d
2e --------`-------- mozglue!mozilla::interceptor::FuncHook<mozilla::interceptor::WindowsDllInterceptor<mozilla::interceptor::VMSharingPolicyShared>,void (*)(int, void *, void *)>::operator()+0x15 [/builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/nsWindowsDllInterceptor.h @ 150] 
2f 00007fff`0f70aa48 mozglue!patched_BaseThreadInitThunk+0x28 [/builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp @ 558] 
30 00000000`00000000 ntdll!RtlUserThreadStart+0x28

These DLLs are responsible for about 24.35% of the volume on the attached signature in the last six months. I'll try to reach the developers.

Comment 1

[Yannis Juglaret [:yannis]]

I managed to get this crash in a VM by following the STR in a forum post.

STR:

• Install PDF-XChange Printer Standard (free edition).
• Start Firefox.
• In the hamburger menu, click Print.
• In the print dialog, click "Print using the system dialog".

What happens:

• The system dialog opens but Firefox crashes. The print dialog shows "your printer has experienced an unexpected configuration problem".

What should happen:

• Firefox does not crash. The system dialog lets you print.

Comment 2

[Yannis Juglaret [:yannis]]

According to the developers, this will be fixed in the next version of the products (v10.3.1) which is scheduled for next week thanks to our report.

Comment 3

[Yannis Juglaret [:yannis]]

I have confirmed that the newest version does not cause a crash with the STR from comment 1.