{"action":"created","issue":{"url":"https://api.github.com/repos/google/UIforETW/issues/70","labels_url":"https://api.github.com/repos/google/UIforETW/issues/70/labels{/name}","comments_url":"https://api.github.com/repos/google/UIforETW/issues/70/comments","events_url":"https://api.github.com/repos/google/UIforETW/issues/70/events","html_url":"https://github.com/google/UIforETW/issues/70","id":130504623,"number":70,"title":"\"Security check failure or stack buffer overrun\"","user":{"login":"ariccio","id":2142308,"avatar_url":"https://avatars.githubusercontent.com/u/2142308?v=3","gravatar_id":"","url":"https://api.github.com/users/ariccio","html_url":"https://github.com/ariccio","followers_url":"https://api.github.com/users/ariccio/followers","following_url":"https://api.github.com/users/ariccio/following{/other_user}","gists_url":"https://api.github.com/users/ariccio/gists{/gist_id}","starred_url":"https://api.github.com/users/ariccio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ariccio/subscriptions","organizations_url":"https://api.github.com/users/ariccio/orgs","repos_url":"https://api.github.com/users/ariccio/repos","events_url":"https://api.github.com/users/ariccio/events{/privacy}","received_events_url":"https://api.github.com/users/ariccio/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-01T22:28:50Z","updated_at":"2016-02-02T00:15:46Z","closed_at":null,"body":"I got a real nasty `INVALID_ARG_FAILURE_EXPLOITABLE` at `ETWProviders64!ETWKeyDown+0x131b`. I'll update later tonight with more info."},"comment":{"url":"https://api.github.com/repos/google/UIforETW/issues/comments/178269762","html_url":"https://github.com/google/UIforETW/issues/70#issuecomment-178269762","issue_url":"https://api.github.com/repos/google/UIforETW/issues/70","id":178269762,"user":{"login":"randomascii","id":10800041,"avatar_url":"https://avatars.githubusercontent.com/u/10800041?v=3","gravatar_id":"","url":"https://api.github.com/users/randomascii","html_url":"https://github.com/randomascii","followers_url":"https://api.github.com/users/randomascii/followers","following_url":"https://api.github.com/users/randomascii/following{/other_user}","gists_url":"https://api.github.com/users/randomascii/gists{/gist_id}","starred_url":"https://api.github.com/users/randomascii/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/randomascii/subscriptions","organizations_url":"https://api.github.com/users/randomascii/orgs","repos_url":"https://api.github.com/users/randomascii/repos","events_url":"https://api.github.com/users/randomascii/events{/privacy}","received_events_url":"https://api.github.com/users/randomascii/received_events","type":"User","site_admin":false},"created_at":"2016-02-02T00:15:46Z","updated_at":"2016-02-02T00:15:46Z","body":"Thanks for the report. This should definitely be fixed.\r\n\r\nIt's probably not actually exploitable because an attacker would have no way of controlling the payload, I don't think.\r\n\r\nThe call stack is not very useful because you don't have symbols loaded for ETWProviders64.dll or for UIforETW. In fact, !analyze is so verbose that the only really valuable piece of information (\"ExceptionCode: c0000409 (Security check failure or stack buffer overrun)\") is excessively well buried.\r\n\r\nAnyway, I'll repro and fix. If you want to repro with symbols loaded, with UIforETW under a debugger, and then just paste the call stack into the issue that would be helpful."}}