瑞星卡卡安全论坛

版本：17.46.22
症状：dllhost（iis out of pooling attach的那个）内存使用持续上涨。
通过抓dump文件，我们发现：
Function  Source  Destination
vbscript+115e      vbscript
vbscript!DllGetClassObject+74      vbscript
RavScrCh!DllGetClassObject+b2      vbscript!DllGetClassObject
OLE32!CClassCache::CDllPathEntry::DllGetClassObject+35     
OLE32!CClassCache::CDllFnPtrMoniker::BindToObject+166      OLE32!CClassCache::CDllPathEntry::DllGetClassObject
OLE32!CClassCache::SearchForLoadedClass+71     
OLE32!ICoCreateInstanceEx+c9      OLE32!CClassCache::SearchForLoadedClass
OLE32!CoCreateInstanceEx+2b      OLE32!ICoCreateInstanceEx
OLE32!CoCreateInstance+35      OLE32!CoCreateInstanceEx
asp!CActiveScriptEngine::Init+a9     
asp!CScriptManager::GetEngine+1d9      asp!CActiveScriptEngine::Init
asp!AllocAndLoadEngines+171      asp!CScriptManager::GetEngine
asp!ExecuteRequest+147      asp!AllocAndLoadEngines
asp!Execute+17e      asp!ExecuteRequest
asp!CHitObj::ViperAsyncCallback+452      asp!Execute
asp!CViperAsyncRequest::OnCall+3f      asp!CHitObj::ViperAsyncCallback
comsvcs!STAActivityWorkHelper+a  .\stathred.cpp @ 1384   
OLE32!EnterForCallback+6a     
OLE32!SwitchForCallback+12f      OLE32!EnterForCallback
OLE32!PerformCallback+50      OLE32!SwitchForCallback
OLE32!CObjectContext::InternalContextCallback+10d      OLE32!PerformCallback
OLE32!CObjectContext::DoCallback+1a     
comsvcs!STAActivityWork::DoWork+75  ..\inc\STAThred.h @ 353   
comsvcs!STAThread::STAThreadWorker+2fa  .\stathred.cpp @ 590   
comsvcs!STAThread::STAThreadWorker+353  .\stathred.cpp @ 614   
KERNEL32!BaseThreadStart+52     

或者：

Function  Source  Destination
NTDLL!RtlpAllocateDebugInfo+63      NTDLL!RtlAllocateHeap
NTDLL!RtlInitializeCriticalSectionAndSpinCount+6a      NTDLL!RtlpAllocateDebugInfo
NTDLL!RtlInitializeCriticalSection+b      NTDLL!RtlInitializeCriticalSectionAndSpinCount
RavScrCh!DllUnregisterServer+8c1     
OLE32!CreateInprocInstanceHelper+1a     
OLE32!ICoCreateInstanceEx+134      OLE32!CreateInprocInstanceHelper
OLE32!CoCreateInstanceEx+2b      OLE32!ICoCreateInstanceEx
OLE32!CoCreateInstance+35      OLE32!CoCreateInstanceEx
asp!CActiveScriptEngine::Init+a9     
asp!CScriptManager::GetEngine+1d9      asp!CActiveScriptEngine::Init
asp!AllocAndLoadEngines+171      asp!CScriptManager::GetEngine
asp!ExecuteRequest+147      asp!AllocAndLoadEngines
asp!Execute+17e      asp!ExecuteRequest
asp!CHitObj::ViperAsyncCallback+452      asp!Execute
asp!CViperAsyncRequest::OnCall+3f      asp!CHitObj::ViperAsyncCallback
comsvcs!STAActivityWorkHelper+a  .\stathred.cpp @ 1384   
OLE32!EnterForCallback+6a     
OLE32!SwitchForCallback+12f      OLE32!EnterForCallback
OLE32!PerformCallback+50      OLE32!SwitchForCallback
OLE32!CObjectContext::InternalContextCallback+10d      OLE32!PerformCallback
OLE32!CObjectContext::DoCallback+1a     
comsvcs!STAActivityWork::DoWork+75  ..\inc\STAThred.h @ 353   
comsvcs!STAThread::STAThreadWorker+2fa  .\stathred.cpp @ 590   
comsvcs!STAThread::STAThreadWorker+353  .\stathred.cpp @ 614   

我们目前还不确定，这个泄露是否和ravscrch替代了vbscript.dll相关？因为上述callstack中也包含了vbscript的信息。

请技术人员帮我们看一下，谢谢！（如需要完整的callstack信息和原始的dump文件，可以mail联系我）
我的联系方式：juqiang@langchao.com

Heap Name  RavScrCh!DllUnregisterServer+cf49
Heap Description  This heap is used by RavScrCh
Reserved memory  767.13 MBytes
Committed memory  739.89 MBytes (96.45% of reserved) 
Uncommitted memory  27.24 MBytes (3.55% of reserved) 
Number of heap segments  11 segments
Number of uncommitted ranges  1 range(s)
Size of largest uncommitted range  27.18 MBytes
Calculated heap fragmentation  .22%





Base Address Reserved Size Committed Size Uncommitted Size Number of uncommitted ranges Largest uncommitted block Calculated heap fragmentation
0x02270640 64.00 KBytes 64.00 KBytes Bytes 0 Bytes .00%
0x029c0000 1,024.00 KBytes 1,024.00 KBytes Bytes 0 Bytes .00%
0x046d0000 2,048.00 KBytes 2,048.00 KBytes Bytes 0 Bytes .00%
0x04a60000 4,096.00 KBytes 4,096.00 KBytes Bytes 0 Bytes .00%
0x05750000 8,192.00 KBytes 8,192.00 KBytes Bytes 0 Bytes .00%
0x06190000 16.00 MBytes 16.00 MBytes Bytes 0 Bytes .00%

0x07f20000 32.00 MBytes 32.00 MBytes Bytes 0 Bytes .00%
0x0a9c0000 64.00 MBytes 64.00 MBytes Bytes 0 Bytes .00%
0x11270000 128.00 MBytes 128.00 MBytes Bytes 0 Bytes .00%
0x1f9c0000 256.00 MBytes 256.00 MBytes Bytes 0 Bytes .00%
0x328c0000 256.00 MBytes 228.82 MBytes 27.18 MBytes 1 27.18 MBytes .00%

此问题现在有补丁否？