VC++ 6.0 - WinDbg stack trace shows a crash point at malloc

Question

The stack trace in windbg after application crash is as below:

ntdll+0x11766
msvcrt!free+0x1ae
msvcrt!free+0x1cc
msvcrt!malloc+0x27
mfc42!Ordinal823+0x2f

Please let me know what is this Ordinal means and why free is invoked twice?

Answer 1

When the crash is inside malloc or free, the cause is most likely heap corruption. The cause for corruption may have happened in code not related to the current stack. To verify if the heap is corrupted, use

!heap –s –v

You will need symbols for this, in advance use

.symfix

You are probably not in free at all, due to lack of symbols the stack is displayed with offset to the nearest exports, hence the big offset (free+0x1cc ) Inspect the stack after the .symfix and enjoy !

To find the root cause for memory corruption different approaches can be used, but if possible full page heap is a good one.