2 months ago
- A crash occurs in the display control panel while destroying a property sheet, due to an invalid window procedure address.
- The invalid address results from a 64-bit pointer being truncated to 32 bits and then sign-extended, causing an invalid kernel-mode address.
- The correct window procedure is identified by matching the lower 32 bits with valid user-mode addresses in the process's module list.
- The bug is caused by a cast to LONG instead of LONG_PTR in C++ code, truncating the original pointer.
- The fix is a one-byte patch in the binary: changing the instruction from movsxd (sign-extend 32-bit) to mov (64-bit load).