[SOLVED] Firefox Crashing: thread mbae.dll EXCEPTION_STACK_BUFFER_OVERRUN

[Tinstaafl]

Firefox Crashing thread: mbae.dll; EXCEPTION_STACK_BUFFER_OVERRUN;  signature: mbae.dll@0x423d

I have been troubleshooting an ongoing crash problem with Firefox 39.0 on Windows 7 SP1 32-bit. It only seems to crash certain web sites,
mostly the more modern ones such as Flipboard.com, qz.com, or theverge.com. Not having any problems with Chrome, but Firefox is my
preferred browser on Windows ...

Today I was able to reproduce the error consistently both in Firefox Safe Mode (no addons, graphic acceleration disabled), as well as
normal mode when going to www.theverge.com.

I submitted a crash report to Mozilla at: https://crash-stats.mozilla.com/report/index/58590532-24de-468b-bdef-a951e2150722#frames

I was surprised to see that the crashing thread was mbae.dll.

I disabled my MBAE protection and the website worked ok in Firefox, no more crashes. Re-enabled MBAE protection and the crashes started
again, just like flipping a switch on/off.

I could not find any related threads. MBAE has not indicated any errors, and seems to be running just fine.

Malwarebytes Anti-Exploit version: 1.07.1.1010
Firefox 39.0
Avira Free 2015
Windows 7 SP-1 32-bit Pro
Intel Core i3-3240
4 GB ram
Intel HD graphics 2500

[Tinstaafl]

Update: have uninstalled, rebooted, and re-installed MBAE 1.07 and still getting the same crash in Firefox, normal or safe mode. 

In Tools; Advanced; have disabled: "Use Hardware Acceleration". 

In about:config I have also disabled this option: "layers.offmainthreadcomposition.enabled"

 

This crash is limited to just one known website at this time, otherwise Firefox is performing well. No problems with Chrome 43 or Internet Explorer 11.

 

Additional crash output from the Firefox crash dialog:

 

  Problem Event Name:    APPCRASH

  Application Name:    plugin-container.exe
  Application Version:    39.0.0.5659
  Application Timestamp:    55934d06
  Fault Module Name:    mozalloc.dll
  Fault Module Version:    39.0.0.5659
  Fault Module Timestamp:    55933a83
  Exception Code:    80000003
  Exception Offset:    00001aa1
  OS Version:    6.1.7601.2.1.0.256.48
  Locale ID:    1033
  Additional Information 1:    0a9e
  Additional Information 2:    0a9e372d3b4ad19135b953a78882e789
  Additional Information 3:    0a9e
  Additional Information 4:    0a9e372d3b4ad19135b953a78882e789
 

[pbust]

Hello Tinstafl welcome to the forum and thanks for posting.

 

This problem was solved in the latest version. Please download the latest from https://downloads.malwarebytes.org/file/mbae and install over the top of your existing version.

 

Let me know how it goes.

[Tinstaafl]

Thanks... I noticed that 1011 was available after my previous post. Have already tried it, with the same result, same crash error: mbae.dll; EXCEPTION_STACK_BUFFER_OVERRUN

[pbust]

Hmmm... can you try 1014 to see if the problem persists?

https://forums.malwarebytes.org/index.php?/topic/170015-malwarebytes-anti-exploit-10711014/

[Tinstaafl]

Hmmm... well now I cannot get it to crash again on 1011.  Maybe it was content related and something updated the page element that was creating the crash. Hard to tell, there are like nearly 100 articles on that Verge home page, so I have no idea what might have changed.

 

But it definitley did crash on 1011 earlier. Like I said, it was a rare thing that occasionally caused a crash, and just so happened to do it consistently on this one site today so I dug into the details of the Mozilla crash log.

 

If I can find another site that causes same error, I will try the 1014, which I assume is "beta"?

 

Thanks again!

[pbust]

1014 is the fix that we will release later this week. So its actually more stable than 1011.

[Tinstaafl]

Good to know, thanks!

 

And thanks to your team for a great product ... hated to think I might have to run without for a while ... especially with all those hacking team zero-days in the wild...

 

Also use MBAM scans weekly :-)

[pbust]

Thanks!

I'll leave this thread open for a few days until I hear back from you that you have not experienced this problem anymore with 1014.