w3wp.exe crashes with C0000005 when HTTP Headers are modified after UpdateRequestCach event

Published Jan 08 2019 03:13 PM 1,135 Views
Microsoft

w3wp.exe crashes with C0000005 exception code when HTTP Headers are modified after UpdateRequestCach event.

 

The call stack looks like below:

 

00 000000ab`a2d5ef80 00007ffe`d2ad4f12 ntdll!RtlReportCriticalFailure(long StatusCode = 0n-1563038352, void * FailureInfo = 0x00000000`00000000)+0x8c 

01 000000ab`a2d5f090 00007ffe`d2ad5b10 ntdll!RtlpHeapHandleError(long ErrorLevel = 0n-768565248)+0x12 

02 000000ab`a2d5f0c0 00007ffe`d2a8a5ff ntdll!RtlpLogHeapFailure(_HEAP_FAILURE_TYPE FailureType = heap_failure_block_not_busy (0n8), void * HeapAddress = 0x000000a7`2ae10000, void * Address = 0x000000ab`9e16c470, void * Param1 = 0x00000000`00000000, void * Param2 = 0x00000000`00000000)+0xa4 

03 (Inline Function) --------`-------- ntdll!RtlpProbeUserBufferUnsafe+0x74ef3 

04 (Inline Function) --------`-------- ntdll!RtlpProbeUserBuffer+0x74efd 

05 000000ab`a2d5f0f0 00007ffe`b93d7fa0 ntdll!RtlFreeHeap+0x74f2f 

06 000000ab`a2d5f190 00007ffe`b93d4e2d cachhttp!RESPONSE_ENTRY::~RESPONSE_ENTRY(void)+0xcc 

07 000000ab`a2d5f1c0 00007ffe`b93d4d3e cachhttp!RESPONSE_ENTRY::DereferenceResponseEntry(void)+0x19 

08 000000ab`a2d5f1f0 00007ffe`b93d4692 cachhttp!OUTPUT_ENTRY::ClearIdentityResponseEntry(void)+0x26 

09 (Inline Function) --------`-------- cachhttp!OUTPUT_ENTRY::{dtor}+0x5

0a 000000ab`a2d5f220 00007ffe`b93d4def cachhttp!OUTPUT_ENTRY::`scalar deleting destructor'(void)+0xe

0b 000000ab`a2d5f250 00007ffe`b93d715f cachhttp!OUTPUT_ENTRY::DereferenceOutputEntry(void)+0x13 

0c (Inline Function) --------`-------- cachhttp!OUTPUT_CACHE::AddRefRecord+0x17

0d 000000ab`a2d5f280 00007ffe`c912615e cachhttp!CTypedHashTable<OUTPUT_CACHE,OUTPUT_ENTRY,OUTPUT_KEY * __ptr64,CLKRHashTable>::_AddRefRecord(void * pvRecord = 0x00007ffe`d230a000, int nIncr = 0n0)+0x1b 

0e 000000ab`a2d5f2b0 00007ffe`c9127f9e iisutil!CLKRLinearHashTable::_DeleteNode(class CBucket * pbkt = 0x000000a7`2bbfe270, class CNodeClump ** rpnc = 0x000000ab`a2d5f310, class CNodeClump ** rpncPrev = 0x000000ab`a2d5f318, int * riNode = 0x000000ab`a2d5f360)+0x3e 

0f 000000ab`a2d5f2e0 00007ffe`c9122130 iisutil!CLKRLinearHashTable::_DeleteIf(<function> * pfnPredicate = 0x00007ffe`b93d23e0, void * pvState = 0x000000ab`a2d5f3c0, LK_PREDICATE * rlkp = 0x000000ab`a2d5f3a0)+0x124 

10 000000ab`a2d5f360 00007ffe`b93d4d83 iisutil!CLKRHashTable::DeleteIf(<function> * pfnPredicate = 0x00007ffe`b93d23e0, void * pvState = 0x000000ab`a2d5f3c0)+0x60 

11 000000ab`a2d5f3a0 00007ffe`b93d3f74 cachhttp!CTypedHashTable<OUTPUT_CACHE,OUTPUT_ENTRY,OUTPUT_KEY * __ptr64,CLKRHashTable>::DeleteIf(<function> * pfnPredicate = 0x01d11c88`00000000, void * pvState = 0x000000ab`a2d5ece0)+0x2f 

12 000000ab`a2d5f3f0 00007ffe`d29f8b9e cachhttp!OUTPUT_CACHE::ScavengerCallback+0x2254 

13 000000ab`a2d5f470 00007ffe`d29f8f2e ntdll!RtlpTpTimerCallback(struct _TP_CALLBACK_INSTANCE * Instance = 0x00007ffe`d29f8b20, void * Context = 0x000000ab`7de35580, struct _TP_TIMER * Timer = 0x000000ab`7dd6bc90)+0x7e 

14 000000ab`a2d5f4b0 00007ffe`d2a18e8d ntdll!TppTimerpExecuteCallback(struct _TP_CALLBACK_INSTANCE * Instance = 0x000000ab`a2d5f668, struct _TP_TASK * Task = 0x000000ab`7dd6bc90)+0x8e

15 000000ab`a2d5f4f0 00007ffe`d21f13d2 ntdll!TppWorkerThread(void * Parameter = 0x000000a7`2ae190e0)+0x47d 

16 000000ab`a2d5f8d0 00007ffe`d29f54f4 kernel32!BaseThreadInitThunk(unsigned long RunProcessInit = <Value unavailable error>, <function> * StartAddress = 0x00007ffe`d2a18a10, void * Argument = 0x000000a7`2ae190e0)+0x22 

17 000000ab`a2d5f900 00000000`00000000 ntdll!RtlUserThreadStart(<function> * StartAddress = 0x00007ffe`d2a18a10, void * Argument = 0x000000a7`2ae190e0)+0x34 

 

The HTTP headers modification needs to be done on any event before UpdateRequestCache event.

Version history
Last update:
‎Jan 23 2019 02:00 PM
Updated by: