[TC9.50B6] Crash when viewing .ICO file with BMP file contents

[pi.degroote]

When I opened a .ICO file which had actually a BMP file content, Total Commander 9.50 beta 6 suddenly crashed (closed).

This file made part of an old DOS game 'Maxtris'.

In case you want, I can also send you that file to verify it...

[Horst.Epp]

Pure Lister or any plugins installed ?

[pi.degroote]

This happens with the pure Lister (without additional plugins), when the graphics are loaded.

It also crashes when loading a PNG file with the [accidental] .ICO file name extension.

I use the 64-bit version of Total Commander on Windows 10 version 1909.

[Horst.Epp]

I can confirme it
Here the WER report:

Code: Select all

Version=1
EventType=BEX64
EventTime=132188127620941604
ReportType=2
Consent=1
UploadTime=132188127624020368
ReportStatus=268435456
ReportIdentifier=5a4c616b-4165-491c-b6bc-56afd4a1fa3e
IntegratorReportIdentifier=b73e14b7-31d3-4562-ab94-a20c4cd6add9
Wow64Host=34404
NsAppName=totalcmd64.exe
OriginalFilename=totalcmd64.exe
AppSessionGuid=00000fd8-0001-003b-74b2-6dc866a0d501
TargetAppId=W:00062ad95695a6dfd86c056081d56f02220d00000904!0000b3441230bab093fcd5e0df8ff562548aceafaf4c!totalcmd64.exe
TargetAppVer=1970//01//01:00:00:00!8cf560!totalcmd64.exe
BootId=4294967295
ServiceSplit=1358950817
TargetAsId=5078
UserImpactVector=271581456
IsFatal=1
EtwNonCollectReason=1
Response.BucketId=454220288e1b1bfed55d8d51a43a689a
Response.BucketTable=5
Response.LegacyBucketId=1539542029417736346
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=totalcmd64.exe
Sig[1].Name=Application Version
Sig[1].Value=9.5.0.0
Sig[2].Name=Application Timestamp
Sig[2].Value=00000000
Sig[3].Name=Fault Module Name
Sig[3].Value=StackHash_3413
Sig[4].Name=Fault Module Version
Sig[4].Value=0.0.0.0
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=00000000
Sig[6].Name=Exception Offset
Sig[6].Value=PCH_84_FROM_unknown+0x0000000000000000
Sig[7].Name=Exception Code
Sig[7].Value=c0000005
Sig[8].Name=Exception Data
Sig[8].Value=0000000000000008
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=10.0.18363.2.0.0.768.101
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1031
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=3413
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=34133290fbdbd7d1b1cd392f1c29f037
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=e637
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=e637095cc31b7dfb87cb6d9d644712ee
UI[2]=C:\Tools\Wincmd\totalcmd64.exe
LoadedModule[0]=C:\Tools\Wincmd\totalcmd64.exe
LoadedModule[1]=C:\WINDOWS\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\WINDOWS\System32\KERNEL32.DLL
LoadedModule[3]=C:\WINDOWS\System32\KERNELBASE.dll
LoadedModule[4]=C:\WINDOWS\SYSTEM32\apphelp.dll
LoadedModule[5]=C:\WINDOWS\SYSTEM32\AcGenral.DLL
LoadedModule[6]=C:\WINDOWS\System32\msvcrt.dll
LoadedModule[7]=C:\WINDOWS\System32\sechost.dll
LoadedModule[8]=C:\WINDOWS\System32\RPCRT4.dll
LoadedModule[9]=C:\WINDOWS\System32\SHLWAPI.dll
LoadedModule[10]=C:\WINDOWS\System32\combase.dll
LoadedModule[11]=C:\WINDOWS\System32\ucrtbase.dll
LoadedModule[12]=C:\WINDOWS\System32\bcryptPrimitives.dll
LoadedModule[13]=C:\WINDOWS\System32\GDI32.dll
LoadedModule[14]=C:\WINDOWS\System32\win32u.dll
LoadedModule[15]=C:\WINDOWS\System32\gdi32full.dll
LoadedModule[16]=C:\WINDOWS\System32\msvcp_win.dll
LoadedModule[17]=C:\WINDOWS\System32\USER32.dll
LoadedModule[18]=C:\WINDOWS\System32\ole32.dll
LoadedModule[19]=C:\WINDOWS\System32\advapi32.dll
LoadedModule[20]=C:\WINDOWS\System32\SHELL32.dll
LoadedModule[21]=C:\WINDOWS\System32\cfgmgr32.dll
LoadedModule[22]=C:\WINDOWS\System32\shcore.dll
LoadedModule[23]=C:\WINDOWS\System32\windows.storage.dll
LoadedModule[24]=C:\WINDOWS\System32\profapi.dll
LoadedModule[25]=C:\WINDOWS\System32\powrprof.dll
LoadedModule[26]=C:\WINDOWS\System32\UMPDC.dll
LoadedModule[27]=C:\WINDOWS\System32\kernel.appcore.dll
LoadedModule[28]=C:\WINDOWS\System32\cryptsp.dll
LoadedModule[29]=C:\WINDOWS\SYSTEM32\USERENV.dll
LoadedModule[30]=C:\WINDOWS\SYSTEM32\MPR.dll
LoadedModule[31]=C:\WINDOWS\SYSTEM32\SspiCli.dll
LoadedModule[32]=C:\WINDOWS\System32\IMM32.DLL
LoadedModule[33]=C:\WINDOWS\System32\comdlg32.dll
LoadedModule[34]=C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.476_none_e6c4b11b130f2595\comctl32.dll
LoadedModule[35]=C:\WINDOWS\System32\oleaut32.dll
LoadedModule[36]=C:\WINDOWS\SYSTEM32\winspool.drv
LoadedModule[37]=C:\WINDOWS\SYSTEM32\version.dll
LoadedModule[38]=C:\WINDOWS\SYSTEM32\winmm.dll
LoadedModule[39]=C:\WINDOWS\System32\bcrypt.dll
LoadedModule[40]=C:\WINDOWS\SYSTEM32\winmmbase.dll
LoadedModule[41]=C:\WINDOWS\SYSTEM32\PROPSYS.dll
LoadedModule[42]=C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL
LoadedModule[43]=C:\WINDOWS\system32\uxtheme.dll
LoadedModule[44]=C:\WINDOWS\system32\dwmapi.DLL
LoadedModule[45]=C:\WINDOWS\SYSTEM32\msimg32.dll
LoadedModule[46]=C:\WINDOWS\SYSTEM32\WindowsCodecs.dll
LoadedModule[47]=C:\WINDOWS\System32\clbcatq.dll
LoadedModule[48]=C:\WINDOWS\System32\MSCTF.dll
LoadedModule[49]=C:\WINDOWS\SYSTEM32\Uiautomationcore.dll
LoadedModule[50]=C:\WINDOWS\System32\TextInputFramework.dll
LoadedModule[51]=C:\WINDOWS\System32\CoreMessaging.dll
LoadedModule[52]=C:\WINDOWS\System32\CoreUIComponents.dll
LoadedModule[53]=C:\WINDOWS\SYSTEM32\ntmarta.dll
LoadedModule[54]=C:\WINDOWS\SYSTEM32\wintypes.dll
LoadedModule[55]=C:\WINDOWS\System32\iertutil.dll
LoadedModule[56]=C:\WINDOWS\system32\wtsapi32.dll
LoadedModule[57]=C:\WINDOWS\SYSTEM32\WINSTA.dll
LoadedModule[58]=C:\WINDOWS\system32\dataexchange.dll
LoadedModule[59]=C:\WINDOWS\system32\d3d11.dll
LoadedModule[60]=C:\WINDOWS\system32\dcomp.dll
LoadedModule[61]=C:\WINDOWS\system32\dxgi.dll
LoadedModule[62]=C:\WINDOWS\SYSTEM32\dxcore.dll
LoadedModule[63]=C:\WINDOWS\system32\twinapi.appcore.dll
LoadedModule[64]=C:\WINDOWS\system32\RMCLIENT.dll
LoadedModule[65]=C:\WINDOWS\SYSTEM32\mscms.dll
LoadedModule[66]=C:\WINDOWS\SYSTEM32\ColorAdapterClient.dll
LoadedModule[67]=C:\WINDOWS\System32\drprov.dll
LoadedModule[68]=C:\WINDOWS\System32\ntlanman.dll
LoadedModule[69]=C:\WINDOWS\System32\davclnt.dll
LoadedModule[70]=C:\WINDOWS\System32\DAVHLPR.dll
LoadedModule[71]=C:\WINDOWS\System32\wkscli.dll
LoadedModule[72]=C:\WINDOWS\SYSTEM32\cscapi.dll
LoadedModule[73]=C:\WINDOWS\System32\netutils.dll
LoadedModule[74]=C:\WINDOWS\System32\coml2.dll
LoadedModule[75]=C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
LoadedModule[76]=C:\Windows\System32\dlnashext.dll
LoadedModule[77]=C:\Windows\System32\PlayToDevice.dll
LoadedModule[78]=C:\Windows\System32\DevDispItemProvider.dll
LoadedModule[79]=C:\WINDOWS\System32\MMDevApi.dll
LoadedModule[80]=C:\WINDOWS\System32\DEVOBJ.dll
LoadedModule[81]=C:\Windows\System32\PortableDeviceApi.dll
LoadedModule[82]=C:\WINDOWS\System32\SETUPAPI.dll
LoadedModule[83]=C:\WINDOWS\System32\WINTRUST.dll
LoadedModule[84]=C:\WINDOWS\System32\MSASN1.dll
LoadedModule[85]=C:\WINDOWS\System32\CRYPT32.dll
LoadedModule[86]=C:\Windows\System32\EhStorAPI.dll
LoadedModule[87]=C:\Windows\System32\thumbcache.dll
LoadedModule[88]=C:\WINDOWS\SYSTEM32\policymanager.dll
LoadedModule[89]=C:\WINDOWS\SYSTEM32\msvcp110_win.dll
LoadedModule[90]=C:\WINDOWS\system32\netapi32.dll
LoadedModule[91]=C:\WINDOWS\SYSTEM32\SRVCLI.DLL
LoadedModule[92]=C:\WINDOWS\system32\USP10.DLL
LoadedModule[93]=C:\Windows\System32\MrmCoreR.dll
LoadedModule[94]=C:\WINDOWS\SYSTEM32\LINKINFO.dll
LoadedModule[95]=C:\WINDOWS\SYSTEM32\edputil.dll
LoadedModule[96]=C:\Windows\System32\Windows.StateRepositoryPS.dll
LoadedModule[97]=C:\Windows\System32\Windows.UI.AppDefaults.dll
LoadedModule[98]=C:\WINDOWS\SYSTEM32\urlmon.dll
LoadedModule[99]=C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL
LoadedModule[100]=C:\WINDOWS\SYSTEM32\CLDAPI.dll
LoadedModule[101]=C:\WINDOWS\SYSTEM32\FLTLIB.DLL
LoadedModule[102]=C:\WINDOWS\system32\PhotoMetadataHandler.dll
LoadedModule[103]=C:\Windows\System32\appresolver.dll
LoadedModule[104]=C:\Windows\System32\SLC.dll
LoadedModule[105]=C:\Windows\System32\Bcp47Langs.dll
LoadedModule[106]=C:\Windows\System32\sppc.dll
LoadedModule[107]=C:\Windows\System32\OneCoreCommonProxyStub.dll
LoadedModule[108]=C:\Windows\System32\OneCoreUAPCommonProxyStub.dll
State[0].Key=Transport.DoneStage1
State[0].Value=1
OsInfo[0].Key=vermaj
OsInfo[0].Value=10
OsInfo[1].Key=vermin
OsInfo[1].Value=0
OsInfo[2].Key=verbld
OsInfo[2].Value=18363
OsInfo[3].Key=ubr
OsInfo[3].Value=476
OsInfo[4].Key=versp
OsInfo[4].Value=0
OsInfo[5].Key=arch
OsInfo[5].Value=9
OsInfo[6].Key=lcid
OsInfo[6].Value=1031
OsInfo[7].Key=geoid
OsInfo[7].Value=94
OsInfo[8].Key=sku
OsInfo[8].Value=101
OsInfo[9].Key=domain
OsInfo[9].Value=0
OsInfo[10].Key=prodsuite
OsInfo[10].Value=768
OsInfo[11].Key=ntprodtype
OsInfo[11].Value=1
OsInfo[12].Key=platid
OsInfo[12].Value=10
OsInfo[13].Key=sr
OsInfo[13].Value=0
OsInfo[14].Key=tmsi
OsInfo[14].Value=262114
OsInfo[15].Key=osinsty
OsInfo[15].Value=3
OsInfo[16].Key=iever
OsInfo[16].Value=11.476.18362.0-11.0.160
OsInfo[17].Key=portos
OsInfo[17].Value=0
OsInfo[18].Key=ram
OsInfo[18].Value=16335
OsInfo[19].Key=svolsz
OsInfo[19].Value=1850
OsInfo[20].Key=wimbt
OsInfo[20].Value=0
OsInfo[21].Key=blddt
OsInfo[21].Value=190318
OsInfo[22].Key=bldtm
OsInfo[22].Value=1202
OsInfo[23].Key=bldbrch
OsInfo[23].Value=19h1_release
OsInfo[24].Key=bldchk
OsInfo[24].Value=0
OsInfo[25].Key=wpvermaj
OsInfo[25].Value=0
OsInfo[26].Key=wpvermin
OsInfo[26].Value=0
OsInfo[27].Key=wpbuildmaj
OsInfo[27].Value=0
OsInfo[28].Key=wpbuildmin
OsInfo[28].Value=0
OsInfo[29].Key=osver
OsInfo[29].Value=10.0.18362.476.amd64fre.19h1_release.190318-1202
OsInfo[30].Key=buildflightid
OsInfo[30].Value=b5dad544-5ea9-4a6a-ae41-aa25fcef0018
OsInfo[31].Key=edition
OsInfo[31].Value=Core
OsInfo[32].Key=ring
OsInfo[32].Value=Retail
OsInfo[33].Key=expid
OsInfo[34].Key=containerid
OsInfo[35].Key=containertype
OsInfo[36].Key=edu
OsInfo[36].Value=0
FriendlyEventName=Stopped working
ConsentKey=BEX64
AppName=Total Commander
AppPath=C:\Tools\Wincmd\totalcmd64.exe
NsPartner=windows
NsGroup=windows8
ApplicationIdentity=FC32FE79FC100E598AAC9A79075F2DD4
MetadataHash=726763597

[ghisler(Author)]

Confirmed, thanks. Seems to be a bug in the Lazarus library.

[pi.degroote]

I think that this issue is very important because it can, perhaps, allow the execution of malicious code, through images, ending in '.ICO'.

[ghisler(Author)]

Fortunately it can't. The Lazarus image library was sending an exception "Invalid format". TC caught this exception and deleted the image object. Unfortunately further down it deleted the same image object again (regularly, where it would delete it without the exception), causing the crash.

[ghisler(Author)]

This should be fixed in beta 7, please test!

[Horst.Epp]

This should be fixed in beta 7, please test!

Fix confirmed for beta 7