Double Free in AddressDialogWithPreview

Start by locating AddressDialogWithPreview and PreviewWidget, then inspect their destruction path in the Qt6 UI. Reproduce closing a tab after opening four or more tabs on Windows and use the provided heap-corruption trace as a reference. Done means the tab can close without a double-free or stability failure.

Version and Platform (required):

• Binary Ninja Version: 5.0.7648, e79b961f
• OS: windows
• OS Version: 10
• CPU Architecture: x86_64

Bug Description:
Double Free.

Steps To Reproduce:
Unknown. Happened when closing tab in long running executable with 4 or more different tabs open. Closing the tab was my first click interaction with binary ninja that day.

Expected Behavior:
Stability

Screenshots:
None

Additional Information:

0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 0

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on CRUNCHER

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 4

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 480

    Key  : Analysis.System
    Value: CreateObject

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 1260325

    Key  : Timeline.Process.Start.DeltaSec
    Value: 539619


NTGLOBALFLAG:  0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS:  0

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffe423af3c9 (ntdll!RtlReportFatalFailure+0x0000000000000009)
   ExceptionCode: c0000374
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 00007ffe424197f0

FAULTING_THREAD:  00002830

PROCESS_NAME:  binaryninja.exe

ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.

EXCEPTION_CODE_STR:  c0000374

EXCEPTION_PARAMETER1:  00007ffe424197f0

ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [Heap_Error_Type] from Frame:[0] on thread:[PSEUDO_THREAD] ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

STACK_TEXT:  
00000000`00000000 00000000`00000000 ntdll!RtlpFreeHeapInternal+0x0


SYMBOL_NAME:  ntdll!RtlpFreeHeapInternal+0

MODULE_NAME: ntdll

IMAGE_NAME:  ntdll.dll

STACK_COMMAND:  !heap ; ** Pseudo Context ** ManagedPseudo ** Value: 22bb9f0f300 ** ; kb

FAILURE_BUCKET_ID:  HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_c0000374_ntdll.dll!RtlpFreeHeapInternal

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {f9e860eb-b03f-7415-804c-7e671e26c730}

Followup:     MachineOwner
---------

0:000> k
 # Child-SP          RetAddr           Call Site
00 0000004c`fc0fa7a0 00007ffe`423af393 ntdll!RtlReportFatalFailure+0x9
01 0000004c`fc0fa7f0 00007ffe`423b8112 ntdll!RtlReportCriticalFailure+0x97
02 0000004c`fc0fa8e0 00007ffe`423b83fa ntdll!RtlpHeapHandleError+0x12
03 0000004c`fc0fa910 00007ffe`423be081 ntdll!RtlpHpHeapHandleError+0x7a
04 0000004c`fc0fa940 00007ffe`422d5bf0 ntdll!RtlpLogHeapFailure+0x45
05 0000004c`fc0fa970 00007ffe`422d47b1 ntdll!RtlpFreeHeapInternal+0x4e0
06 0000004c`fc0faa30 00007ffe`3fccf05b ntdll!RtlFreeHeap+0x51
07 0000004c`fc0faa70 00007ffd`fc44ae84 ucrtbase!_free_base+0x1b
08 0000004c`fc0faaa0 00007ffd`fc44a897 Qt6Widgets!QLabel::clear+0x184
09 0000004c`fc0faad0 00007ffd`f03afdb5 Qt6Widgets!QLabel::~QLabel+0x27
0a 0000004c`fc0fab00 00007ffd`f2314ee0 binaryninjaui!AddressDialogWithPreview::~AddressDialogWithPreview+0x9b5
0b 0000004c`fc0fab30 00007ffd`fc32bcc2 Qt6Core!QObjectPrivate::deleteChildren+0x80
0c 0000004c`fc0fab80 00007ffd`f06c1c1b Qt6Widgets!QWidget::~QWidget+0x5e2
0d 0000004c`fc0fac20 00007ffd`f2318785 binaryninjaui!PreviewWidget::~PreviewWidget+0xcb
0e 0000004c`fc0fac50 00007ffd`fc333ad8 Qt6Core!QObject::event+0xa5
0f 0000004c`fc0fad60 00007ffd`fc3cbf33 Qt6Widgets!QWidget::event+0xe68
10 0000004c`fc0fae40 00007ffd`fc2f2082 Qt6Widgets!QFrame::event+0x33
11 0000004c`fc0fae70 00007ffd`fc2f1231 Qt6Widgets!QApplicationPrivate::notify_helper+0x152
12 0000004c`fc0faea0 00007ffd`f22d18ef Qt6Widgets!QApplication::notify+0x16d1
13 0000004c`fc0fb370 00007ffd`f22d40c2 Qt6Core!QCoreApplication::notifyInternal2+0x10f
14 0000004c`fc0fb3e0 00007ffd`f78ac27f Qt6Core!QCoreApplicationPrivate::sendPostedEvents+0x202
15 0000004c`fc0fb4d0 00007ffd`f2457360 Qt6Gui!QWindowsGuiEventDispatcher::sendPostedEvents+0xf
16 0000004c`fc0fb500 00007ffd`f78ac1f9 Qt6Core!QEventDispatcherWin32::processEvents+0x90
17 0000004c`fc0fe690 00007ffd`f22d7ff4 Qt6Gui!QWindowsGuiEventDispatcher::processEvents+0x19
18 0000004c`fc0fe6c0 00007ffd`f22cfce1 Qt6Core!QEventLoop::exec+0x1c4
19 0000004c`fc0fe760 00007ff7`32470648 Qt6Core!QCoreApplication::exec+0x161
1a 0000004c`fc0fe7e0 00007ff7`32811fb8 binaryninja!UIPluginABIVersion+0xc7a58
1b 0000004c`fc0ff970 00007ffe`41797374 binaryninja!UIPluginABIVersion+0x4693c8
1c 0000004c`fc0ff9b0 00007ffe`422fcc91 KERNEL32!BaseThreadInitThunk+0x14
1d 0000004c`fc0ff9e0 00000000`00000000 ntdll!RtlUserThreadStart+0x21