https://git.reactos.org/?p=reactos.git;a=commitdiff;h=04e92516123dd094bcfa3…
commit 04e92516123dd094bcfa3fd14b4d0d59c8e4eaf0
Author:     Jérôme Gardou <jerome.gardou(a)reactos.org>
AuthorDate: Mon May 10 19:09:53 2021 +0200
Commit:     Jérôme Gardou <jerome.gardou(a)reactos.org>
CommitDate: Mon May 10 19:11:21 2021 +0200
    [NTOS:PS] Use KD routine to safely read memory from thread stack
    Should fix a crash when hitting TAB+(Whatever I typed that triggerred this)
---
 ntoskrnl/ps/debug.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/ntoskrnl/ps/debug.c b/ntoskrnl/ps/debug.c
index b7ea2db32eb..0a2f3e05517 100644
--- a/ntoskrnl/ps/debug.c
+++ b/ntoskrnl/ps/debug.c
@@ -70,9 +70,24 @@ PspDumpThreads(BOOLEAN IncludeSystem)
                     /* Walk it */
                     while(Ebp != 0 && Ebp >=
(PULONG)Thread->Tcb.StackLimit)
                     {
-                        /* Print what's on the stack */
-                        DbgPrint("%.8X %.8X%s", Ebp[0], Ebp[1], (i % 8) == 7 ?
"\n" : "  ");
-                        Ebp = (PULONG)Ebp[0];
+                        ULONG EbpContent[2];
+                        ULONG MemoryCopied;
+                        NTSTATUS Status;
+
+                        /* Get stack frame content */
+                        Status = KdpCopyMemoryChunks((ULONG64)(ULONG_PTR)Ebp,
+                                                     EbpContent,
+                                                     sizeof(EbpContent),
+                                                     sizeof(EbpContent),
+                                                     MMDBG_COPY_UNSAFE,
+                                                     &MemoryCopied);
+                        if (!NT_SUCCESS(Status) || (MemoryCopied <
sizeof(EbpContent)))
+                        {
+                            break;
+                        }
+
+                        DbgPrint("%.8X %.8X%s", EbpContent[0], EbpContent[1],
(i % 8) == 7 ? "\n" : "  ");
+                        Ebp = (PULONG)EbpContent[0];
                         i++;
                     }