Corrupt malloc()'s internal tracking information

Write garbage into data areas used by malloc to track memory allocations. This simulates the kind of heap overflow and/or heap corruption likely to occur in an application; if the crash reporter itself uses malloc, the corrupted heap will likely trigger a crash in the crash reporter itself.

Provider X86-64
HockeyApp
SDK: 4.1.3 Date: 05/18/2017 (i)
Sentry
SDK: 3.0.7 Date: 07/03/2017 (i)
Bugsnag
SDK: 5.0.0 Date: 02/16/2016 (i)
Apple
Date: 05/18/2017 (i)

Expected Report Details:

-[CRLCrashCorruptMalloc crash] (CRLCrashCorruptMalloc.m:46)
-[CRLMainWindowController causeCrash:] (CRLMainWindowController.m:72)

Click a status icon above to see the crashing thread’s stack trace with further info.

HockeyApp - x86_64

Exception Type:  SIGBUS
Exception Codes: BUS_ADRERR at 0x0
Crashed Thread:  0

Thread 0 Crashed:
0   libsystem_notify.dylib 0x00007fff96e6222d _nc_table_find_64 + 42
1   libsystem_notify.dylib 0x00007fff96e5f21e registration_node_find + 52
2   libsystem_notify.dylib 0x00007fff96e6078d notify_check + 104
3   libsystem_c.dylib      0x00007fff96ce1164 notify_check_tz + 23
4   libsystem_c.dylib      0x00007fff96ce0d97 tzsetwall_basic + 44
5   libsystem_c.dylib      0x00007fff96ce2844 localtime_r + 40
6   CoreFoundation         0x00007fff815c942d _populateBanner + 93
7   CoreFoundation         0x00007fff815c7e24 _CFLogvEx2Predicate + 356
8   CoreFoundation         0x00007fff81537f4d _CFLogvEx3 + 477
9   Foundation             0x00007fff82f6f665 _NSLogv + 116
10  Foundation             0x00007fff82f5a7ee NSLog + 151
11  CrashLib               0x00000001071cda03 -[CRLCrashCorruptMalloc crash] (CRLCrashCorruptMalloc.m:46)
12  CrashProbe             0x00000001071bdc31 -[CRLMainWindowController causeCrash:] (CRLMainWindowController.m:72)
13  libsystem_trace.dylib  0x00007fff96e883a7 _os_activity_initiate_impl + 52
14  AppKit                 0x00007fff7f754721 -[NSApplication(NSResponder) sendAction:to:from:] + 455
15  AppKit                 0x00007fff7f238cc4 -[NSControl sendAction:to:] + 85
16  AppKit                 0x00007fff7f238bec __26-[NSCell _sendActionFrom:]_block_invoke + 135
17  libsystem_trace.dylib  0x00007fff96e883a7 _os_activity_initiate_impl + 52
18  AppKit                 0x00007fff7f238b44 -[NSCell _sendActionFrom:] + 127
19  AppKit                 0x00007fff7f27b539 -[NSButtonCell _sendActionFrom:] + 97
20  libsystem_trace.dylib  0x00007fff96e883a7 _os_activity_initiate_impl + 52
21  AppKit                 0x00007fff7f237426 -[NSCell trackMouse:inRect:ofView:untilMouseUp:] + 2480
22  AppKit                 0x00007fff7f27b272 -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:] + 797
23  AppKit                 0x00007fff7f235ddb -[NSControl mouseDown:] + 831
24  AppKit                 0x00007fff7f8d024f -[NSWindow(NSEventRouting) _handleMouseDownEvent:isDelayedEvent:] + 6340
25  AppKit                 0x00007fff7f8cca6c -[NSWindow(NSEventRouting) _reallySendEvent:isDelayedEvent:] + 1941
26  AppKit                 0x00007fff7f8cbf0a -[NSWindow(NSEventRouting) sendEvent:] + 540
27  AppKit                 0x00007fff7f750681 -[NSApplication(NSEvent) sendEvent:] + 1144
28  HockeySDK              0x00000001071ef54e -[BITCrashExceptionApplication sendEvent:] (BITCrashExceptionApplication.m:48)
29  AppKit                 0x00007fff7efcb427 -[NSApplication run] + 1001
30  AppKit                 0x00007fff7ef95e0e NSApplicationMain + 1236
31  CrashProbe             0x00000001071bdef0 main (main.m:13)
32  libdyld.dylib          0x00007fff96c56235 start + 0

Sentry - x86_64

OS Version: macOS 10.12.5 (16F73)
Report Version: 104

Exception Type: EXC_BAD_ACCESS (SIGBUS)
Exception Codes: BUS_NOOP at 0x000060800003b000
Crashed Thread: 0

Application Specific Information:
Attempted to dereference garbage pointer 0x60800003b000.

Thread 0 name:
Thread 0 Crashed:
0   libsystem_notify.dylib          0xffff28ba422d      _nc_table_find_64
1   libsystem_notify.dylib          0xffff28ba121e      registration_node_find
2   libsystem_notify.dylib          0xffff28ba278d      notify_check
3   libsystem_c.dylib               0xffff28855164      notify_check_tz
4   libsystem_c.dylib               0xffff28854d97      tzsetwall_basic
5   libsystem_c.dylib               0xffff28856844      localtime_r
6   CoreFoundation                  0xfffefd8ab42d      _populateBanner
7   CoreFoundation                  0xfffefd8a9e24      _CFLogvEx2Predicate
8   CoreFoundation                  0xfffefd819f4d      _CFLogvEx3
9   Foundation                      0xffff00cc9665      _NSLogv
10  Foundation                      0xffff00cb47ee      NSLog
11  CrashLib                        0x10d870ac1         -[CRLCrashCorruptMalloc crash] (CRLCrashCorruptMalloc.m:46)
12  CrashProbe                      0x20d74bbba         -[CRLMainWindowController causeCrash:] (CRLMainWindowController.m:72)
13  libsystem_trace.dylib           0xffff28bf63a7      _os_activity_initiate_impl
14  AppKit                          0xfffef9571721      -[NSApplication(NSResponder) sendAction:to:from:]
15  AppKit                          0xfffef9055cc4      -[NSControl sendAction:to:]
16  AppKit                          0xfffef9055bec      __26-[NSCell _sendActionFrom:]_block_invoke
17  libsystem_trace.dylib           0xffff28bf63a7      _os_activity_initiate_impl
18  AppKit                          0xfffef9055b44      -[NSCell _sendActionFrom:]
19  AppKit                          0xfffef9098539      -[NSButtonCell _sendActionFrom:]
20  libsystem_trace.dylib           0xffff28bf63a7      _os_activity_initiate_impl
21  AppKit                          0xfffef9054426      -[NSCell trackMouse:inRect:ofView:untilMouseUp:]
22  AppKit                          0xfffef9098272      -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:]
23  AppKit                          0xfffef9052ddb      -[NSControl mouseDown:]
24  AppKit                          0xfffef96ed24f      -[NSWindow(NSEventRouting) _handleMouseDownEvent:isDelayedEvent:]
25  AppKit                          0xfffef96e9a6c      -[NSWindow(NSEventRouting) _reallySendEvent:isDelayedEvent:]
26  AppKit                          0xfffef96e8f0a      -[NSWindow(NSEventRouting) sendEvent:]
27  AppKit                          0xfffef956d681      -[NSApplication(NSEvent) sendEvent:]
28  AppKit                          0xfffef8de8427      -[NSApplication run]
29  AppKit                          0xfffef8db2e0e      NSApplicationMain
30  CrashProbe                      0x20d74be79         main (main.m:13)
31  libdyld.dylib                   0xffff28790235      start

Bugsnag - x86_64

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Attempted to dereference garbage pointer 0x10efbc000.
                                                                                                    
0  libsystem_notify.dylib nc_table_find_64                                                      
1  libsystem_notify.dylib registration_node_find                                                
2  libsystem_notify.dylib notify_check                                                          
3  libsystem_c.dylib      notify_check_tz                                                       
4  libsystem_c.dylib      tzsetwall_basic                                                       
5  libsystem_c.dylib      localtime_r                                                           
6  CoreFoundation         _CFLogCString                                                         
7  CoreFoundation         CFLogvEx2                                                             
8  CoreFoundation         CFLogvEx3                                                             
9  Foundation             NSLogv                                                                
10 Foundation             NSLog                                                                 
11 CrashProbe             -[CRLCrashCorruptMalloc crash] (CRLCrashCorruptMalloc.m:46)           
12 CrashProbe             -[CRLMainWindowController causeCrash:] (CRLMainWindowController.m:72) 
13 libsystem_trace.dylib  os_activity_initiate                                                  
14 AppKit                 -[NSApplication sendAction:to:from:]                                  
15 AppKit                 -[NSControl sendAction:to:]                                           
16 AppKit                 _26-[NSCell _sendActionFrom:]_block_invoke                            
17 libsystem_trace.dylib  os_activity_initiate                                                  
18 AppKit                 -[NSCell _sendActionFrom:]                                            
19 libsystem_trace.dylib  os_activity_initiate                                                  
20 AppKit                 -[NSCell trackMouse:inRect:ofView:untilMouseUp:]                      
21 AppKit                 -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:]                
22 AppKit                 -[NSControl mouseDown:]                                               
23 AppKit                 -[NSWindow _handleMouseDownEvent:isDelayedEvent:]                     
24 AppKit                 -[NSWindow _reallySendEvent:isDelayedEvent:]                          
25 AppKit                 -[NSWindow sendEvent:]                                                
26 AppKit                 -[NSApplication sendEvent:]                                           
27 AppKit                 -[NSApplication run]                                                  
28 AppKit                 NSApplicationMain                                                     
29 CrashProbe             main (main.m:13)                                                      
30 libdyld.dylib          start

Apple - x86_64

Exception Type:        EXC_CRASH (SIGABRT)
Exception Codes:       0x0000000000000000, 0x0000000000000000

Application Specific Information:
abort() called
*** error for object 0x60000003eb80: Invalid pointer dequeued from free list
 

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0  libsystem_kernel.dylib         0x00007fff95058d42 __pthread_kill + 10
1  libsystem_pthread.dylib        0x00007fff951465bf pthread_kill + 90
2  libsystem_c.dylib              0x00007fff94fbe420 abort + 129
3  libsystem_malloc.dylib         0x00007fff950bdd98 nanozone_error + 525
4  libsystem_malloc.dylib         0x00007fff950b3588 _nano_malloc_check_clear + 427
5  libsystem_malloc.dylib         0x00007fff950b3a77 nano_calloc + 70
6  libsystem_malloc.dylib         0x00007fff950ae43e malloc_zone_calloc + 87
7  libsystem_malloc.dylib         0x00007fff950aed7f calloc + 30
8  libobjc.A.dylib                0x00007fff94636e9d class_createInstance + 88
9  libdispatch.dylib              0x00007fff94ef476b _os_object_alloc_realized + 35
10 libxpc.dylib                   0x00007fff951750fa xpc_uint64_create + 26
11 libxpc.dylib                   0x00007fff951750bd xpc_dictionary_set_uint64 + 24
12 libxpc.dylib                   0x00007fff951780f5 _bootstrap_create_request + 44
13 libxpc.dylib                   0x00007fff95177e9f bootstrap_look_up3 + 76
14 libxpc.dylib                   0x00007fff95177e41 bootstrap_look_up2 + 45
15 libxpc.dylib                   0x00007fff9517a0a3 xpc_pipe_create + 61
16 libsystem_trace.dylib          0x00007fff9515dfd2 _os_trace_diagnosticd_pipe + 82
17 libsystem_trace.dylib          0x00007fff95167c6b _os_log_impl_stream + 42
18 libsystem_trace.dylib          0x00007fff95167365 _os_log_impl_flatten_and_send + 4127
19 libsystem_trace.dylib          0x00007fff9516870d _os_log_with_args_impl + 464
20 com.apple.CoreFoundation       0x00007fff7f822f27 _CFLogvEx3 + 231
21 com.apple.Foundation           0x00007fff812596f5 _NSLogv + 117
22 com.apple.Foundation           0x00007fff8124487e NSLog + 152
23 net.hockeyapp.CrashLib         0x00000001095eaa03 -[CRLCrashCorruptMalloc crash] + 61 (CRLCrashCorruptMalloc.m:47) | Wrong line number
24 net.hockeyapp.CrashProbe.apple 0x00000001095ddc35 -[CRLMainWindowController causeCrash:] + 75 (CRLMainWindowController.m:72)
25 libsystem_trace.dylib          0x00007fff9515c3a7 _os_activity_initiate_impl + 53
26 com.apple.AppKit               0x00007fff7da41791 -[NSApplication(NSResponder) sendAction:to:from:] + 456
27 com.apple.AppKit               0x00007fff7d526000 -[NSControl sendAction:to:] + 86
28 com.apple.AppKit               0x00007fff7d525f28 __26-[NSCell _sendActionFrom:]_block_invoke + 136
29 libsystem_trace.dylib          0x00007fff9515c3a7 _os_activity_initiate_impl + 53
30 com.apple.AppKit               0x00007fff7d525e80 -[NSCell _sendActionFrom:] + 128
31 com.apple.AppKit               0x00007fff7d568875 -[NSButtonCell _sendActionFrom:] + 98
32 libsystem_trace.dylib          0x00007fff9515c3a7 _os_activity_initiate_impl + 53
33 com.apple.AppKit               0x00007fff7d524762 -[NSCell trackMouse:inRect:ofView:untilMouseUp:] + 2481
34 com.apple.AppKit               0x00007fff7d5685ae -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:] + 798
35 com.apple.AppKit               0x00007fff7d523117 -[NSControl mouseDown:] + 832
36 com.apple.AppKit               0x00007fff7dbbd2bf -[NSWindow(NSEventRouting) _handleMouseDownEvent:isDelayedEvent:] + 6341
37 com.apple.AppKit               0x00007fff7dbb9adc -[NSWindow(NSEventRouting) _reallySendEvent:isDelayedEvent:] + 1942
38 com.apple.AppKit               0x00007fff7dbb8f7a -[NSWindow(NSEventRouting) sendEvent:] + 541
39 com.apple.AppKit               0x00007fff7da3d6f1 -[NSApplication(NSEvent) sendEvent:] + 1145
40 com.apple.AppKit               0x00007fff7d2b87f7 -[NSApplication run] + 1002
41 com.apple.AppKit               0x00007fff7d2831de NSApplicationMain + 1237
42 net.hockeyapp.CrashProbe.apple 0x00000001095ddef4 main + 9 (main.m:13)
43 libdyld.dylib                  0x00007fff94f2a235 start + 1