PowerToys Run crashes when using with Program plugin

[theGuiltyMan]

Microsoft PowerToys version

0.88.0

Installation method

PowerToys auto-update

Running as admin

Yes

Area(s) with issue?

PowerToys Run

Steps to reproduce

Since version 0.87.0 whenever I try to use PowerToys Run it crashes.
I saw a few issues caused by thumbnail generation, but the program still crashes when the option is off and thumbnail files are deleted.

PowerToysReport_2025-02-02-23-35-53.zip

PowerToys.PowerLauncher.exe.36024.dmp.zip

✔️ Expected Behavior

No response

❌ Actual Behavior

No response

Other Software

No response

[similar-issues-ai]

We've found some similar issues:

• powertoy run crash #33446 , similarity score: 85%
• Unable to use PowerToys Run #15172 , similarity score: 84%
• Power toy run crash. #23615 , similarity score: 83%
• powertoys run crashing #37108 , similarity score: 82%
• PowerToys Run keeps crashing #14108 , similarity score: 82%
• Powertoys Run Crash in windows.storage.dll #26800 , similarity score: 82%
• PowerToys Run does not work and crashes #30850 , similarity score: 82%
• PowerToys Run crashes on launch #33803 , similarity score: 82%
• PowerToys Run Crash Every Time Launched #30346 , similarity score: 82%
• PowerToys Run Crashes when opened with the latest release: v0.82.0 #33635 , similarity score: 81%
• [PowerToys Run] - Crashes upon input #33169 , similarity score: 81%
• PowerToys run crashing regularly in latest update #23697 , similarity score: 81%
• PowerToys Run randomly crashes #23445 , similarity score: 81%

If any of the above are duplicates, please consider closing this issue out and adding additional context in the original issue.

Note: You can give me feedback by 👍 or 👎 this comment.

[jaimecbernardo]

Thank you for the dump. It seems PowerToys Run is failing on a specific extraction from a file. Is it possible to generate a full dump to verify which filePath we're actually trying to generate an icon for? That might help in reproducing the error on our end. 😄 /needinfo

[theGuiltyMan]

How can i generate a full dump

[jaimecbernardo]

One way of achieving this would be by creating an entry in the Registry Editor (regedit.msc), for Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\PowerToys.PowerLauncher.exe , according to the instructions in https://docs.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps

It should look something like this in the end (but for PowerLauncher) and dump type should be 2 instead of 1:

After that, please replicate the bug, navigate to %LOCALAPPDATA%\CrashDumps in the File Explorer and upload the zipped PowerToys.PowerLauncher.exe.*.dmp file to a GitHub comment.

/needinfo

[theGuiltyMan]

I tried again after deleting the files that gives the exception using the dumps, but it still kept happening with other different files/paths. I also remember these files were working previously with the power launcher, they have been there since before the 0.87.0 update. Since the size of the dumps are large github won't let me upload them here, I am sharing them using google drive.
https://drive.google.com/drive/folders/1-fqkFCv0CKRDyYujMPRSks6Fm4s-gAC5?usp=sharing

[jaimecbernardo]

Pretty weird 🤔 Something we've done is update from .NET 9.0.0 to .NET 9.0.1 . Wonder if something came from there.
I see one of the icons with issues is "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Grabber\Grabber.lnk"
Can you tell me what Application this is and where to get it?

Can you try uninstalling PowerToys 0.88.0, install 0.87.1 and see if there's still an issue? (Double checking if it's an actual PowerToys change or something that happened to the link files that might have started causing it)

[jaimecbernardo]

Thanks for sending the dumps, by the way! 😄 @theGuiltyMan
/needinfo

[theGuiltyMan]

I think this is the grabber.lnk: https://github.com/Bionus/imgbrd-grabber
I dont think the grabber.lnk is the problem because when I checked the many dump files with VS, I've seen many different files in the debugger. Also the program was installed a long time ago and was unused/not-updated for a very long time, (all modified/created timestamps are almost a year old). And there werent any problems until 0.87.0 (and .net 9).
I checked with different versions:
in 0.87.1 it doesnt work, same with 0.88
0.86.0 it works without a problem. it also generates the thumbnails.
it behaves weirdly after I reinstalled 0.88.0:

• when i uninstalled 0.86 -> restarted -> installed 0.88 (while the generate thumbnails were off) it worked.
• after I enabled the generate thumbnails settings it started crashing again. deleting the cache or turning off the setting did not resolve the issue.
• when I uninstalled 0.86 -> installed 0.88 without restart, the launcher crashed even when the generate thumbnails setting were off.
  If you want I can check the 0.86 -> 0.88 more thoroughly, currently I couldn't replicate the working case again.
  I tried disabling the plugins that were not available in .86 but the problem persisted.
  Currently the launcher in 0.88 crashes on start, when enabling the main plugin in the settings. I analysed the dump with Windbg and "ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application." might be important(?):

*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 0

    Key  : Analysis.Elapsed.mSec
    Value: 2289

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 0

    Key  : Analysis.Init.Elapsed.mSec
    Value: 3363

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 203

    Key  : Analysis.Version.DbgEng
    Value: 10.0.27725.1000

    Key  : Analysis.Version.Description
    Value: 10.2408.27.01 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2408.27.1

    Key  : CLR.BuiltBy
    Value: NET481REL1LAST_C

    Key  : CLR.Engine
    Value: CLR

    Key  : CLR.Version
    Value: 4.8.9290.0

    Key  : FailFast.Name
    Value: SET_CONTEXT_DENIED

    Key  : FailFast.Type
    Value: 48

    Key  : Failure.Bucket
    Value: FAIL_FAST_SET_CONTEXT_DENIED_c0000409_clr.dll!CreateHandleCommon

    Key  : Failure.Hash
    Value: {d9cc9c7c-474e-7bd5-d492-a4b682992c07}

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 47

    Key  : Timeline.Process.Start.DeltaSec
    Value: 5

    Key  : WER.OS.Branch
    Value: ni_release

    Key  : WER.OS.Version
    Value: 10.0.22621.1

    Key  : WER.Process.Version
    Value: 0.88.0.0


FILE_IN_CAB:  PowerToys.PowerLauncher.exe.31184.dmp

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  00000016f58bca10 -- (.cxr 0x16f58bca10)
rax=0000019388818d50 rbx=00007ff8875a5a10 rcx=00000016f58bcb00
rdx=00007ff886cab175 rsi=00007ff886d9ba68 rdi=0000019387b91360
rip=00007ff886c98f95 rsp=000001938881d260 rbp=000001938881d528
 r8=0000000000000002  r9=0000000000000002 r10=0000000000000000
r11=0000002200000001 r12=0000019387d4d2d0 r13=0000000000000000
r14=0000000000000000 r15=000001938881d528
iopl=1         ov up ei pl zr ac po cy
cs=5a10  ss=8e38  ds=875a  es=7ff8  fs=0000  gs=8cf6             efl=00009b55
clr!CreateHandleCommon+0x2d:
00007ff8`86c98f95 488bc3          mov     rax,rbx
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ff8bac14ab6 (ntdll!RcContinueExit+0x0000000000000013)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000030
Subcode: 0x30 FAST_FAIL_SET_CONTEXT_DENIED 

PROCESS_NAME:  PowerToys.PowerLauncher.dll

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000030

STACK_TEXT:  
00000193`8881d260 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : clr!CreateHandleCommon+0x2d


SYMBOL_NAME:  clr!CreateHandleCommon+2d

MODULE_NAME: clr

IMAGE_NAME:  clr.dll

STACK_COMMAND:  .process /r /p 0x1938881d528; .cxr 0x16f58bca10 ; kb

BUCKET_ID_MODPRIVATE: 1

FAILURE_BUCKET_ID:  FAIL_FAST_SET_CONTEXT_DENIED_c0000409_clr.dll!CreateHandleCommon

OS_VERSION:  10.0.22621.1

BUILDLAB_STR:  ni_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  4.8.9290.0

FAILURE_ID_HASH:  {d9cc9c7c-474e-7bd5-d492-a4b682992c07}

Followup:     MachineOwner
---------

[mantaionut]

@theGuiltyMan I've made a version that should no longer crash https://github.com/mantaionut/PowerToys/releases/tag/fix_GetThumbnail
Can you check this version if it fixes the crash for you?

[theGuiltyMan]

Unfortunately powertoys run still crashes when the program plugin is active.

crash dump
2025-02-11.txt

[mantaionut]

@theGuiltyMan I have updated the binaries https://github.com/mantaionut/PowerToys/releases/tag/fix_GetThumbnail with some extra logs that could help us identify what is the problem.
Can you retest with those binaries?
Please uninstall the previous version before doing that.

[theGuiltyMan]

Here is the log with the latest binary
2025-02-12.txt

[mantaionut]

@theGuiltyMan thanks for the logs.
Based on the logs it seems the issue is definitely with some shortcuts while other should work fine, in this case is ALVR.
Where is that executable for that shortcut located? Maybe it has something to do with long paths.
There was a new release of .net(9.0.2) which maybe fixes this issue. I've updated those binaries to include the latest .net. https://github.com/mantaionut/PowerToys/releases/tag/fix_GetThumbnail.

I've also made a change from using System.Drawing.Icon.ExtractAssociatedIcon to SHGetFileInfo which could fix your issue since the problem code is in ExtractAssociatedIcon https://github.com/mantaionut/PowerToys/releases/tag/custom_getThumbnail.

Can you retest those 2 binaries and let me know if any of them fixes your issue?

[theGuiltyMan]

The shortcut for ALVR is:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ALVR\ALVR.lnk
-> C:\Program Files\ALVR\ALVR Dashboard.exe

Unfortunately neither of the binaries resolved the issue.

Log from .net 9.0.2 binary

Log from the alternative binary

[mantaionut]

Can you give me the crash dump for the alternative binary?

[theGuiltyMan]

crash dump for the alternative binary

[mantaionut]

Thanks, right now I am not sure if this crash is caused by a bug in PowerToys or a Windows API bug.
I have created a small WPF project with 2 button. One that loads a single shortcut and the other that loads all of them in 100ms interval and display their icons.
The goal is to identify if this project crashes for you so we can see how to proceed further.
https://github.com/mantaionut/ExtractAssociatedIconTest/releases/tag/release1
You can either compile it manually or extract the zip and run WpfApp1.exe.

[theGuiltyMan]

All 3 buttons causes a crash when pressed.

Exception thrown at 0x00007FFFE2A7FE3C (KernelBase.dll) in WpfApp1.exe: 0x04242420 (parameters: 0x0000000031415927, 0x00007FFFB7170000, 0x000000ACF9D79510).

[mantaionut]

Browse button crashes too?

[theGuiltyMan]

Yes

[mantaionut]

What is the call stack for the browse button crash? Since that button only opens a window to select a file

private void BrowseButton_Click(object sender, RoutedEventArgs e)
        {
            OpenFileDialog openFileDialog = new OpenFileDialog
            {
                Title = "Select a Shortcut File",
                Filter = "Shortcut Files (*.lnk)|*.lnk",
                Multiselect = false // Allow only one file selection
            };

            if (openFileDialog.ShowDialog() == true)
            {
                FilePathTextBox.Text = openFileDialog.FileName; // Set file path in TextBox
            }
        }```

[theGuiltyMan]

[mantaionut]

Were you building it yourself or using the executable?

[theGuiltyMan]

The stack trace is from when I build myself, but the executable itself also crashes the same way

[mantaionut]

That is really weird. Can you rebuild it using .net8 instead of .net9 and see if that crashes too?

[theGuiltyMan]

.net8 works flawlessly for all the buttons

[mantaionut]

Can you open an issue in dotnet repository since this issue a .net9 bug?
Meanwhile, I've added a disable thumbnails option. The option is called Enable thumbnails from files.
https://github.com/mantaionut/PowerToys/releases/tag/no_thumbnail_option.
Please test those binaries by using the newly added option and let me know if it works fine for you.

[theGuiltyMan]

The new binary works perfectly.
Thank you for your time and assistance with this issue.
I will also report this on the .NET repository.

[mantaionut]

Can you test a build I've made with their suggestion of disabling CETCompat https://github.com/mantaionut/PowerToys/releases/tag/disable_cetcompat?
If it works I'll open a PR with it disabled.

[theGuiltyMan]

It works