Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

How to get stack limits for a user dump?

193 views
Skip to first unread message

Richard Lewis Haggard

unread,
Oct 31, 2009, 11:50:01 AM10/31/09
to
I'm been given a user dump of a crash and asked to determine why it crashed.
I suspect that the stack limits have been exceeded because !analyze -v says

FAILURE_BUCKET_ID: INVALID_POINTER_WRITE_c0000005_oleaut32.dll!CNumInfo::Init

BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_WRITE_oleaut32!CNumInfo::Init+68

and the an exception has been thrown as a result of executing this code:

770ecb36 894710 mov dword ptr [edi+10h],eax
770ecb39 7536 jne oleaut32!CNumInfo::Init+0x9d (770ecb71)
770ecb3b 56 push esi

but I don't know how to prove it because I can't quite figure out how to get
the current thread's stack size. Because this is a user dump, the commands
I'd normally use like !teb are not available.

How can I get the thread's start and stop stack limits from WinDbg?

Richard Lewis Haggard

unread,
Oct 31, 2009, 11:53:01 AM10/31/09
to

I did not figure out how to get the stack start/stop but I did figure out how
to prove that the stack is being exceeded:

0:000> dd esp-8 L 4
00129120 ???????? 00000000 7c94e9c0 7c8025cb

This shows pretty conclusively that the stack's limits have been reached.
===

Ivan Brugiolo [MSFT]

unread,
Oct 31, 2009, 2:21:33 PM10/31/09
to
Those two should be the values you are looking for

0:000> !teb @$teb
TEB at 000007fffffde000
ExceptionList: 0000000000000000
StackBase: 00000000001d0000
StackLimit: 00000000001bf000

--
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

"Richard Lewis Haggard" <RichardLe...@discussions.microsoft.com>
wrote in message news:F89D6269-8BD4-4C20...@microsoft.com...

Kalle Olavi Niemitalo

unread,
Oct 31, 2009, 2:11:24 PM10/31/09
to
Richard Lewis Haggard <RichardLe...@discussions.microsoft.com> writes:

> I did not figure out how to get the stack start/stop but I did figure out how
> to prove that the stack is being exceeded:
>
> 0:000> dd esp-8 L 4
> 00129120 ???????? 00000000 7c94e9c0 7c8025cb
>
> This shows pretty conclusively that the stack's limits have been reached.

I don't think so, because 0x00129124 is not aligned to the page size.

Which version of Windows saved this dump?

0 new messages