1902010 - Crash in [@ RtlpFreeHeapInternal | RtlFreeHeap | APP_DATA::FreeCachedMem] (qyui.dll) - Zhuhai Quin/QuYin/Aimo/Labelife label printer driver

Status: RESOLVED WORKSFORME

(External Software Affecting Firefox :: Other, defect)

Description

[Yannis Juglaret [:yannis]]

We are receiving crashes that involve qyui.dll. QY stands for qùyìn (趣印), a chinese company known as Quin or Zhuhai Quyin. The DLL is part of the drivers for some specific printing devices that they produce.

Example crash: here

Call stack:

ntdll!RtlReportFatalFailure+0x9
ntdll!RtlReportCriticalFailure+0x97
ntdll!RtlpHeapHandleError+0x12
ntdll!RtlpHpHeapHandleError+0x7a
ntdll!RtlpLogHeapFailure+0x45
ntdll!RtlpFreeHeapInternal+0x84c
ntdll!RtlFreeHeap+0x51
oleaut32!APP_DATA::FreeCachedMem+0x1cc5a
oleaut32!VariantClear+0x232
QYUI!??
UNIDRVUI!UniDrvUI::CPrintTicketProvider::ConvertDevModeToPrintTicketInternal+0x428
UNIDRVUI!UniDrvUI::CPrintTicketProvider::ConvertDevModeToPrintTicket+0x59
prntvpt!PTConvertDevModeToPrintTicketImp+0x156
prntvpt!CPrintTicketServerBase::ConvertDevModeToPrintTicket+0x1f
prntvpt!PTConvertDevModeToPrintTicket+0x91
PrintPlatformConfig!PrintPlatform::MergePrintTicketWithDefault+0x1cd
PrintPlatformConfig!<lambda_993988ca6c09973954e47a20b97e5a8b>::operator()+0xb6
PrintPlatformConfig!PrintCore::CaptureAndConvertExceptionToHR<<lambda_993988ca6c09973954e47a20b97e5a8b> >+0xe
PrintPlatformConfig!PrintPlatform::PrintPlatformPrintSchemaFactoryLegacy::CreatePrintSchemaTicket+0x120
Windows_Graphics_Printing!Windows::Graphics::Printing::OptionDetails::PrintTaskOptionDetailsServer::PrintTaskOptionsServerTransaction::BindPrinter+0x2ae
Windows_Graphics_Printing!Windows::Graphics::Printing::PrintTaskServer::PrintTaskServerPriv::BindPrinter+0x265
rpcrt4!Invoke+0x73
rpcrt4!Ndr64StubWorker+0xb8a
rpcrt4!NdrStubCall3+0xd3
combase!CStdStubBuffer_Invoke+0x6f [onecore\com\combase\ndr\ndrole\stub.cxx @ 1479] 
combase!InvokeStubWithExceptionPolicyAndTracing::__l6::<lambda_c9f3956a20c9da92a64affc24fdd69ec>::operator()+0x22 [onecore\com\combase\dcomrem\channelb.cxx @ 1151] 
combase!ObjectMethodExceptionHandlingAction<<lambda_c9f3956a20c9da92a64affc24fdd69ec> >+0x4d [onecore\com\combase\dcomrem\excepn.hxx @ 94] 
combase!InvokeStubWithExceptionPolicyAndTracing+0xe1 [onecore\com\combase\dcomrem\channelb.cxx @ 1149] 
combase!DefaultStubInvoke+0x268 [onecore\com\combase\dcomrem\channelb.cxx @ 1218] 
combase!SyncServerCall::StubInvoke+0x41 [onecore\com\combase\dcomrem\ServerCall.hpp @ 791] 
combase!StubInvoke+0x303 [onecore\com\combase\dcomrem\channelb.cxx @ 1483] 
combase!ServerCall::ContextInvoke+0x517 [onecore\com\combase\dcomrem\ctxchnl.cxx @ 1421] 
combase!ComInvokeWithLockAndIPID+0x9a9 [onecore\com\combase\dcomrem\channelb.cxx @ 2152] 
combase!ThreadInvokeReturnHresult+0x17b [onecore\com\combase\dcomrem\channelb.cxx @ 6944] 
combase!ThreadInvoke+0x193 [onecore\com\combase\dcomrem\channelb.cxx @ 7044] 
rpcrt4!DispatchToStubInCNoAvrf+0x22
rpcrt4!RPC_INTERFACE::DispatchToStubWorker+0x1b4
rpcrt4!RPC_INTERFACE::DispatchToStubWithObject+0x188
rpcrt4!LRPC_SCALL::DispatchRequest+0x14c
rpcrt4!LRPC_SCALL::HandleRequest+0x996
rpcrt4!LRPC_SASSOCIATION::HandleRequest+0x2c3
rpcrt4!LRPC_ADDRESS::HandleRequest+0x17c
rpcrt4!LRPC_ADDRESS::ProcessIO+0x939
rpcrt4!LrpcIoComplete+0x109
ntdll!TppAlpcpExecuteCallback+0x157
ntdll!TppWorkerThread+0x72c
kernel32!BaseThreadInitThunk+0x1d
mozglue!mozilla::interceptor::FuncHook<mozilla::interceptor::WindowsDllInterceptor<mozilla::interceptor::VMSharingPolicyShared>,void (*)(int, void *, void *)>::operator()+0x15 [/builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/nsWindowsDllInterceptor.h @ 150] 
mozglue!patched_BaseThreadInitThunk+0x28 [/builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp @ 558] 
ntdll!RtlUserThreadStart+0x28

The versions of the DLL that are represented the most in the volume are 1.5.2.0, 1.3.6.0, 1.3.10.0, 1.4.5.0. I was able to get a copy of version 1.5.5.0 here which is supposedly for some 242-BT label printer device. Analysis of the DLL shows two locations where the following pattern is used:

VARIANT var;
VariantInit(&var);
var.vt = VT_BSTR;
var.bstrVal = SysAllocString(...);
// ...
SysFreeString(var.bstrVal);
VariantClear(&var);

This causes a double free of the allocated string, first from SysFreeString, then from VariantClear, thus crashing Firefox. This DLL is responsible for about 1.77% of the volume on the attached signature in the last six months.

There is another company called AIMO which seems somewhat related to Quin, their drivers are from Quin at least. The most recent drivers available on their download page does not seem to include qyui.dll even for the product line that could relate to 242-BT ("AM-242/AM-243/AM-243BT").

Comment 1

[Ray Kraesig [:rkraesig]]

It's worth noting that it's previously been suggested that we move printing to a separate utility process (as is being done for the file-picker), specifically because of buggy print drivers.

Comment 2

[BugBot [:suhaib / :marco]]

Closing because no crashes reported for 12 weeks.