Corrupt malloc()'s internal tracking information

Write garbage into data areas used by malloc to track memory allocations. This simulates the kind of heap overflow and/or heap corruption likely to occur in an application; if the crash reporter itself uses malloc, the corrupted heap will likely trigger a crash in the crash reporter itself.

Provider X86-64
HockeyApp
SDK: 4.1.2 Date: 02/124/2017 (i)
Bugsnag
SDK: 5.0.0 Date: 02/16/2016 (i)
Crashlytics
SDK: 3.4.1 Date: 12/10/2015 (i)
Apple
Date: 06/24/2015 (i)

Expected Report Details:

-[CRLCrashCorruptMalloc crash] (CRLCrashCorruptMalloc.m:46)
-[CRLMainWindowController causeCrash:] (CRLMainWindowController.m:72)

Click a status icon above to see the crashing thread’s stack trace with further info.

HockeyApp - x86_64

Exception Type:  SIGBUS
Exception Codes: BUS_ADRERR at 0x0
Crashed Thread:  0

Thread 0 Crashed:
0  libobjc.A.dylib       0x00007fffde67363c object_setClass + 61
1  CoreFoundation        0x00007fffc9985a9e _CFRuntimeCreateInstance + 558
2  CoreFoundation        0x00007fffc99b70e4 _CFStringCreateWithFormatAndArgumentsAux2 + 84
3  CoreFoundation        0x00007fffc9af5a98 _CFLogvEx2Predicate + 136
4  CoreFoundation        0x00007fffc9a65956 _CFLogvEx3 + 486
5  Foundation            0x00007fffcb49e735 _NSLogv + 117
6  Foundation            0x00007fffcb4898be NSLog + 152
7  CrashLib              0x0000000102562a00 -[CRLCrashCorruptMalloc crash] (CRLCrashCorruptMalloc.m:46)
8  CrashProbe            0x0000000102555b3d -[CRLMainWindowController causeCrash:] (CRLMainWindowController.m:72)
9  libsystem_trace.dylib 0x00007fffdf193c3d _os_activity_initiate + 61
10 AppKit                0x00007fffc7cb7c9c -[NSApplication(NSResponder) sendAction:to:from:] + 456
11 AppKit                0x00007fffc779d460 -[NSControl sendAction:to:] + 86
12 AppKit                0x00007fffc779d388 __26-[NSCell _sendActionFrom:]_block_invoke + 136
13 libsystem_trace.dylib 0x00007fffdf193c3d _os_activity_initiate + 61
14 AppKit                0x00007fffc779d2e0 -[NSCell _sendActionFrom:] + 128
15 AppKit                0x00007fffc77dfcd9 -[NSButtonCell _sendActionFrom:] + 98
16 libsystem_trace.dylib 0x00007fffdf193c3d _os_activity_initiate + 61
17 AppKit                0x00007fffc779bbc6 -[NSCell trackMouse:inRect:ofView:untilMouseUp:] + 2481
18 AppKit                0x00007fffc77dfa12 -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:] + 798
19 AppKit                0x00007fffc779a57b -[NSControl mouseDown:] + 832
20 AppKit                0x00007fffc7e2f603 -[NSWindow(NSEventRouting) _handleMouseDownEvent:isDelayedEvent:] + 6341
21 AppKit                0x00007fffc7e2be20 -[NSWindow(NSEventRouting) _reallySendEvent:isDelayedEvent:] + 1942
22 AppKit                0x00007fffc7e2b2be -[NSWindow(NSEventRouting) sendEvent:] + 541
23 AppKit                0x00007fffc7cb3bf5 -[NSApplication(NSEvent) sendEvent:] + 1145
24 HockeySDK             0x0000000102580914 -[BITCrashExceptionApplication sendEvent:] (BITCrashExceptionApplication.m:48)
25 AppKit                0x00007fffc752ff81 -[NSApplication run] + 1002
26 AppKit                0x00007fffc74fa850 NSApplicationMain + 1237
27 CrashProbe            0x0000000102555ea4 main (main.m:13)
28 libdyld.dylib         0x00007fffdef61255 start + 1

Bugsnag - x86_64

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Attempted to dereference garbage pointer 0x10efbc000.
                                                                                                    
0  libsystem_notify.dylib nc_table_find_64                                                      
1  libsystem_notify.dylib registration_node_find                                                
2  libsystem_notify.dylib notify_check                                                          
3  libsystem_c.dylib      notify_check_tz                                                       
4  libsystem_c.dylib      tzsetwall_basic                                                       
5  libsystem_c.dylib      localtime_r                                                           
6  CoreFoundation         _CFLogCString                                                         
7  CoreFoundation         CFLogvEx2                                                             
8  CoreFoundation         CFLogvEx3                                                             
9  Foundation             NSLogv                                                                
10 Foundation             NSLog                                                                 
11 CrashProbe             -[CRLCrashCorruptMalloc crash] (CRLCrashCorruptMalloc.m:46)           
12 CrashProbe             -[CRLMainWindowController causeCrash:] (CRLMainWindowController.m:72) 
13 libsystem_trace.dylib  os_activity_initiate                                                  
14 AppKit                 -[NSApplication sendAction:to:from:]                                  
15 AppKit                 -[NSControl sendAction:to:]                                           
16 AppKit                 _26-[NSCell _sendActionFrom:]_block_invoke                            
17 libsystem_trace.dylib  os_activity_initiate                                                  
18 AppKit                 -[NSCell _sendActionFrom:]                                            
19 libsystem_trace.dylib  os_activity_initiate                                                  
20 AppKit                 -[NSCell trackMouse:inRect:ofView:untilMouseUp:]                      
21 AppKit                 -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:]                
22 AppKit                 -[NSControl mouseDown:]                                               
23 AppKit                 -[NSWindow _handleMouseDownEvent:isDelayedEvent:]                     
24 AppKit                 -[NSWindow _reallySendEvent:isDelayedEvent:]                          
25 AppKit                 -[NSWindow sendEvent:]                                                
26 AppKit                 -[NSApplication sendEvent:]                                           
27 AppKit                 -[NSApplication run]                                                  
28 AppKit                 NSApplicationMain                                                     
29 CrashProbe             main (main.m:13)                                                      
30 libdyld.dylib          start

Crashlytics - x86_64

Crashed: com.apple.main-thread
SIGABRT ABORT at 0x0000000000000000

Thread : Crashed: com.apple.main-thread
0  libsystem_kernel.dylib 0x7fff894df002 __pthread_kill + 10
1  libsystem_pthread.dyli 0x7fff8a6495c5 pthread_kill + 90
2  libsystem_c.dylib      0x7fff86dbe6e7 abort + 129
3  libsystem_malloc.dylib 0x7fff8a74ae66 szone_error + 626
4  libsystem_malloc.dylib 0x7fff8a73e827 tiny_malloc_from_free_list + 347
5  libsystem_malloc.dylib 0x7fff8a73d715 szone_malloc_should_clear + 292
6  libsystem_malloc.dylib 0x7fff8a7409b7 malloc_zone_calloc + 78
7  libsystem_malloc.dylib 0x7fff8a741359 calloc + 49
8  libsystem_asl.dylib    0x7fff863001b3 asl_client_open + 35
9  libsystem_asl.dylib    0x7fff86300d98 asl_open + 14
10 CoreFoundation         0x7fff876dcf51 __CFLogCString + 641
11 CoreFoundation         0x7fff8778da32 _CFLogvEx2 + 290
12 CoreFoundation         0x7fff8778db0b _CFLogvEx3 + 171
13 Foundation             0x7fff9282bce1 _NSLogv + 117
14 Foundation             0x7fff9273f735 NSLog + 152
15 CrashLib               0x00010fb3ba8f -[CRLCrashCorruptMalloc crash] (CRLCrashCorruptMalloc.m:46)
16 CrashProbe             0x00010fab86e1 -[CRLMainWindowController causeCrash:] (CRLMainWindowController.m:72)
17 libsystem_trace.dylib  0x7fff84dea07a _os_activity_initiate + 75
18 AppKit                 0x7fff8df9551d -[NSApplication sendAction:to:from:] + 460
19 AppKit                 0x7fff8dfaa486 -[NSControl sendAction:to:] + 86
20 AppKit                 0x7fff8dfaa3b0 __26-[NSCell _sendActionFrom:]_block_invoke + 131
21 libsystem_trace.dylib  0x7fff84dea07a _os_activity_initiate + 75
22 AppKit                 0x7fff8dfaa30d -[NSCell _sendActionFrom:] + 144
23 libsystem_trace.dylib  0x7fff84dea07a _os_activity_initiate + 75
24 AppKit                 0x7fff8dfa8932 -[NSCell trackMouse:inRect:ofView:untilMouseUp:] + 2693
25 AppKit                 0x7fff8dffdd58 -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:] + 744
26 AppKit                 0x7fff8dfa705c -[NSControl mouseDown:] + 669
27 AppKit                 0x7fff8e554d1d -[NSWindow _handleMouseDownEvent:isDelayedEvent:] + 6322
28 AppKit                 0x7fff8e555fad -[NSWindow _reallySendEvent:isDelayedEvent:] + 212
29 AppKit                 0x7fff8deae735 -[NSWindow sendEvent:] + 517
30 AppKit                 0x7fff8deaae49 -[NSApplication sendEvent:] + 2540
31 AppKit                 0x7fff8ddde03a -[NSApplication run] + 796
32 AppKit                 0x7fff8dd60520 NSApplicationMain + 1176
33 CrashProbe             0x00010fab8a46 main (main.m:13)
34 libdyld.dylib          0x7fff850755ad start + 1

Apple - x86_64

Exception Type:        EXC_CRASH (SIGABRT)
Exception Codes:       0x0000000000000000, 0x0000000000000000

Application Specific Information:
Performing @selector(causeCrash:) from sender NSButton 0x618000142940
abort() called
*** error for object 0x610000278c40: Invalid pointer dequeued from free list
 

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0  libsystem_kernel.dylib   0x00007fff8a48a286 __pthread_kill + 10
1  libsystem_c.dylib        0x00007fff8f803b53 abort + 129
2  libsystem_malloc.dylib   0x00007fff8aa97f3c nanozone_error + 524
3  libsystem_malloc.dylib   0x00007fff8aa85a5c _nano_malloc_check_clear + 370
4  libsystem_malloc.dylib   0x00007fff8aa858cc nano_malloc + 35
5  libsystem_malloc.dylib   0x00007fff8aa85877 malloc_zone_malloc + 71
6  com.apple.CoreFoundation 0x00007fff8584ee0e _CFRuntimeCreateInstance + 350
7  com.apple.CoreFoundation 0x00007fff859802f4 _CFStringCreateWithFormatAndArgumentsAux2 + 84
8  com.apple.CoreFoundation 0x00007fff8599377f _CFLogvEx2 + 127
9  com.apple.Foundation     0x00007fff8df09c47 NSLogv + 99
10 com.apple.Foundation     0x00007fff8df09bc0 NSLog + 148
11 net.hockeyapp.CrashLib   0x000000010556c3ed -[CRLCrashCorruptMalloc crash] + 61 (CRLCrashCorruptMalloc.m:47)
12 net.hockeyapp.CrashProbe 0x000000010555f473 -[CRLMainWindowController causeCrash:] + 75 (CRLMainWindowController.m:72)
13 libsystem_trace.dylib    0x00007fff91233cd7 _os_activity_initiate + 75
14 com.apple.AppKit         0x00007fff8bc45fb1 -[NSApplication sendAction:to:from:] + 452
15 com.apple.AppKit         0x00007fff8bc5ba46 -[NSControl sendAction:to:] + 86
16 com.apple.AppKit         0x00007fff8bc5b962 __26-[NSCell _sendActionFrom:]_block_invoke + 131
17 libsystem_trace.dylib    0x00007fff91233cd7 _os_activity_initiate + 75
18 com.apple.AppKit         0x00007fff8bc5b8bf -[NSCell _sendActionFrom:] + 144
19 libsystem_trace.dylib    0x00007fff91233cd7 _os_activity_initiate + 75
20 com.apple.AppKit         0x00007fff8bc59db3 -[NSCell trackMouse:inRect:ofView:untilMouseUp:] + 2821
21 com.apple.AppKit         0x00007fff8bcb245f -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:] + 770
22 com.apple.AppKit         0x00007fff8bc58466 -[NSControl mouseDown:] + 714
23 com.apple.AppKit         0x00007fff8c1c22fc -[NSWindow _reallySendEvent:isDelayedEvent:] + 14125
24 com.apple.AppKit         0x00007fff8bb51d76 -[NSWindow sendEvent:] + 470
25 com.apple.AppKit         0x00007fff8bb4e312 -[NSApplication sendEvent:] + 2504
26 com.apple.AppKit         0x00007fff8ba77c68 -[NSApplication run] + 711
27 com.apple.AppKit         0x00007fff8b9f4354 NSApplicationMain + 1832
28 net.hockeyapp.CrashProbe 0x000000010555f7d9 main + 9 (main.m:13)
29 libdyld.dylib            0x00007fff8aaa75c9 start + 1