TC crashes reliably with heap corruption in ntdll.dll

[al20878]

Here' s the crash report from Event Viewer:

Faulting application name: TOTALCMD64.EXE, version: 11.3.0.0, time stamp: 0x00000000
Faulting module name: ntdll.dll, version: 10.0.19041.4355, time stamp: 0x35a939aa
Exception code: 0xc0000374
Fault offset: 0x00000000000ff409
Faulting process id: 0x2c0
Faulting application start time: 0x01dabb937bc00a2a
Faulting application path: C:\Program Files\totalcmd\TOTALCMD64.EXE
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

I have, what seems to be a left-over from very-very olden days, a (hidden) folder in the "C:\Windows\" directory named "Downloaded Program Files":

c:\Windows>attrib "Downloaded Program Files"
S C:\Windows\Downloaded Program Files

c:\Windows\Downloaded Program Files>dir /A
Volume in drive C is OS
Volume Serial Number is XXXX-XXXX

Directory of c:\Windows\Downloaded Program Files

06/04/2024 10:08 PM <DIR> .
06/04/2024 10:08 PM <DIR> ..
12/07/2019 05:12 AM 65 desktop.ini
07/25/2002 06:13 PM 24,576 dwusplay.dll
07/25/2002 06:13 PM 196,608 dwusplay.exe
02/16/2005 05:15 PM 401,408 isusweb.dll
4 File(s) 622,657 bytes

c:\Windows\Downloaded Program Files>attrib
A SH C:\Windows\Downloaded Program Files\desktop.ini
A C:\Windows\Downloaded Program Files\dwusplay.dll
A C:\Windows\Downloaded Program Files\dwusplay.exe
A C:\Windows\Downloaded Program Files\isusweb.dll

Whenever I descend to that folder in TC, if I focus any of the .DLL's or the .EXE in there, TC _always_ crashes!

It tolerates focusing "desktop.ini" without crashing, though...

Using command line, if I copy any of the files that crash TC to some other place, it does not crash when I focus them. Conversely, if I copy any DLL/EXE into that directory, then TC crashes all the same if I attempt to focus the file (so it looks like it's not the contents of the file that crash TC but the location).

For some reason, explorer shows the contents of this directory as completely empty (even though, there are files in there, in reality, as "dir" confirms, too).

[ghisler(Author)]

It is probably caused by some kind of Explorer extension or plugin trying to access one of the affected files.
You can try turning off
- icons
- tooltips
- colors by file type if you use them
and check whether it still happens.

Unfortunately heap corruption normally doesn't get noticed immediately by Windows, so a stack trace would not help finding the reason - it would show the location where the heap corruption was noticed, not where it was created.

[al20878]

Thank you for your response!

Indeed, just turning off the icons completely in Settings prevents TC from crashing.

I tried to play with the settings a bit more and if I have all icons + EXE/LNK on (the first bullet) but only uncheck "Show default folder/file icons from Explorer" (all other remaining boxes still checked), TC does not crash.

So, it looks like there's something special about this location (including why Explorer fakes it empty when showing).

IDK if (re-)creating the same-named directory with the "S" attribute under "C:\Windows" is going to reproduce the issue...

I checked that having the same-named (+S) folder elsewhere does not cause any such problems.

[al20878]

I think I spoke too quickly.

TC did not crash the first time I unchecked the box for Explorer in the icons settings... Now it crashes with that box unchecked too, just when I enter the directory (no need to focus any file in there). That's bizarre, and def a change from the previously observed behavior (when a file needed to be focused).

Not only that but TC keeps crashing with "No icons" too (although not by mere entering the dir but trying to focus a file in there, including desktop.ini,
which was previously well-tolerated)...

[al20878]

Now, with icons completely disabled, disabling the tooltips seems to keep TC running in that directory instead of crashing (can move across the files and focus any)... The long-right click on the files there, produces a very curt popup, missing most of the items regularly shown elsewhere; for EXE there's "runas" and "@shell32.dll,-50944", for other files just "View / Edit / Print / Copy... etc" only the standard actions. "Properties" do not work -- nothing appears when selected and released.

[al20878]

Okay, I re-enabled icons (all except from the "Explorer" ones) but kept the tooltips disabled; TC does not crash.
I added the "Explorer" icons (tooltips still disabled); TC does not crash.
I re-enabled the tooltips while in that very directory, and upon closing the settings dialog and focusing "desktop.ini", TC crashed the same way. Wow

P.S. I restarted TC each time applying the options (except for the last change, adding the tooltips back), just for it not to use any cached data, if any (I have no idea if it keeps that, anyways).

[Dalai]

If tooltips seem to make TC crash you should check TC's tooltip configuration in Options > Display > Help texts section. Do you have custom tooltips set up that show information from content plugins? If so, remove/disable them one by one (the content plugin fields, not the plugins themselves).

If you're just using standard Win32-style tooltips it could be triggered by a shell extension. In that case use NirSoft ShellExView to disable the tooltip extensions one by one; you can leave the Microsoft extensions active, they're usually fine.

[petermad]

An interesting thing about that "Downloaded Program Files" folder is, that if I open the Properties dialog, then there is no Tabs for setting "Security", "Sharing" and "Customize" - That is in Window 10 - no such limitation under Windows 7. So Windows treats this folder different than most folders.

[Horst.Epp]

An interesting thing about that "Downloaded Program Files" folder is, that if I open the Properties dialog, then there is no Tabs for setting "Security", "Sharing" and "Customize" - That is in Window 10 - no such limitation under Windows 7. So Windows treats this folder different than most folders.

The same happens on Windows 11.
Only Previous versions are available as tab on this folder.

[petermad]

On windows 8 the folder only has the "General" tab in Properties.
On Windows XP the folder is marked as a system folder (as it is on Win 8, 10 and 11), on Windows 7 it not marked as system.