December 27th, 2013

Brief Q&A on the HeapEnableTerminationOnCorruption heap information flag

Question: What type of heaps are controlled by the Heap­Enable­Termination­On­Corruption flag? Answer: Any user-mode heap created by the Heap­Create function. This includes the process heap (Get­Process­Heap) but not the managed heap. Some components use Heap­Create under the hood. If so, then those heaps would also be affected. Question: What versions of Windows support Heap­Enable­Termination­On­Corruption? Answer: The flag was introduced in Windows Vista and Windows Server 2008. It is also available on Windows XP Service Pack 3. In table form:

Support Client Server

Not Available

Windows 2000
Windows XP RTM, SP1, SP2

Windows Server 2000
Windows Server 2003
Available
Windows XP SP3
Windows Vista
Windows 7
Windows Server 2008
Windows Server 2008 R2

Question: For operating systems that support it, under what conditions will termination on corruption be enabled? Answer:

  1. For all 64-bit processes.
  2. For all 32-bit processes whose executable sets the subsystem major version to 6 or higher in the image header.
  3. If you call Heap­Set­Information with the Heap­Enable­Termination­On­Corruption parameter.

Question: What is the effect of setting the subsystem major version in a DLL? Will that control whether termination on corruption is enabled for any heaps created by my DLL? Answer: No. For the purpose of rule 2 above, it is the major subsystem of the executable that decides whether termination on corruption. The major subsystem of any DLLs loaded by the process have no effect. This is consistent with other process decisions. Question: Can I enable termination on corruption for some heaps but not others? Answer: No. Turning on termination on corruption turns it on for all heaps in the process. Question: Can I disable termination on corruption after it has been enabled?

Answer: No. It is a one-way door.

Topics
Code

Author

Raymond has been involved in the evolution of Windows for more than 30 years. In 2003, he began a Web site known as The Old New Thing which has grown in popularity far beyond his wildest imagination, a development which still gives him the heebie-jeebies. The Web site spawned a book, coincidentally also titled The Old New Thing (Addison Wesley 2007). He occasionally appears on the Windows Dev Docs Twitter account to tell stories which convey no useful information.

0 comments

Discussion are closed.