As Neal suggests, here is some code to calculate the value the SHOULD have
been returned in the Information field from ZwQueryDirectoryFile
(incorporating Neal’s subsequent “offsetof” fix):
/*
* Get the total length of the file information in the file_data buffer
*/
static UINT32
GetTotalInformationLength(
IN FILE_INFORMATION_CLASS FileInformationClass,
IN PFILE_DIRECTORY_INFORMATION file_data) // File data for a child of that
dir
{
char* p = (char*)file_data;
/*
* Skip to the last entry in the file_data
*/
for (;
{
UINT32 info_len = ((PFILE_DIRECTORY_INFORMATION)p)->NextEntryOffset;
if ( info_len == 0 )
{
break;
}
p += ((PFILE_DIRECTORY_INFORMATION)p)->NextEntryOffset;
}
/*
* Add the length of the last entry in the file_data
*/
switch ( FileInformationClass )
{
case FileDirectoryInformation:
p += offsetof(FILE_DIRECTORY_INFORMATION,FileName) +
((PFILE_DIRECTORY_INFORMATION)p)->FileNameLength;
break;
case FileFullDirectoryInformation:
p += offsetof( FILE_FULL_DIR_INFORMATION,FileName ) +
((PFILE_FULL_DIR_INFORMATION)p)->FileNameLength;
break;
case FileBothDirectoryInformation:
p += offsetof( FILE_BOTH_DIR_INFORMATION,FileName ) +
((PFILE_BOTH_DIR_INFORMATION)p)->FileNameLength;
break;
case FileNamesInformation:
p += offsetof( FILE_NAMES_INFORMATION,FileName ) +
((PFILE_NAMES_INFORMATION)p)->FileNameLength;
break;
}
return p - (char*)file_data;
}
“Neal Christiansen” wrote in message
news:xxxxx@ntfsd…
Just to clarify this issue, there is NOT a bug in all of the file
systems where the information field is always being returned wrong. It
turns out that there was a bug in Brian’s test program. He was taking
the size of a structure not realizing that the compiler was padding that
structure to be 8 byte aligned. This is easily fixed by using the
“offsetof()” macro. This is an honest mistake that we have seen before.
As Ravi reported I did find a bug in FASTFAT that was returning the
wrong length (it was always too short) sometimes. That bug has been
fixed and will be part of the Server .NET release. I will file a
request to get this fix back ported into Service packs for already
released OS’s. You can easily work around this bug by examining the
returned data and calculating the correct length yourself. Perhaps
Brian will post his code on how to do this.
Neal Christiansen
Microsoft File System Filter Group
This posting is provided “AS IS” with no warranties, and confers no
rights.
-----Original Message-----
From: Brian Collins [mailto:xxxxx@iOra.com]
Sent: Friday, October 04, 2002 6:25 AM
To: File Systems Developers
Subject: [ntfsd] Re: Can ZwQueryDirectoryFile list only directories?
Ravi,
As the demo program I mailed to Neal demonstrates, the problem appears
on
NTFS and CDFS as well.
Brian
“Ravisankar Pudipeddi” wrote in message
news:xxxxx@ntfsd…
Neal Christiansen recently independently found this bug in FASTFAT at MS
& it has been fixed for .NET Server RC2. It was a simple computation bug
which didn’t take into account the fact that each entry was
quad-aligned.
If you found it with any other file system, do let us know. Tthe length
returned by the Information field is not used by the Win32 API
implementation, which is why it escaped detection so far: only a filter
which relied on the information could have been bitten by it, which is
exactly how Neal found it)
Thanks,
Ravi
-
This posting is provided “AS IS” with no warranties, and confers no
rights.
-----Original Message-----
From: Brian Collins [mailto:xxxxx@iOra.com]
Sent: Thursday, October 03, 2002 10:11 AM
To: File Systems Developers
Subject: [ntfsd] Re: Can ZwQueryDirectoryFile list only directories?
Strange coincidence
Only yesterday, I produced a self-contained program to illustrate that
this was a real bug, and mailed it off to MS. I have not had an
acknowledgement yet.
The returned data block is well-formed and contains all the required
data - it is simply the Status.Information that is reporting
incorrectly. So don’t rely on this length in a filter if you want to
(e.g.) use memmove to “hide” an entry.
Brian
“Nir Livni” wrote in message news:xxxxx@ntfsd…
>
> I don’t know if anyone got into this,
> But I saw that it sometimes return Status.Information value which is
smaller
> by 4 bytes that the real length of the information…
> (so the filename myfile.txt became myfile)
>
> -----Original Message-----
> From: Randy Cook [mailto:xxxxx@yahoo.com]
> Sent: Thursday, October 03, 2002 12:48 AM
> To: File Systems Developers
> Subject: [ntfsd] Can ZwQueryDirectoryFile list only directories?
>
>
> I need to enumerate the directories in a given
> directory.
>
> Is there a way to instruct ZwQueryDirectoryFile to
> only return information about directories? I’d like
> to ask for FILE_NAMES_INFORMATION since it seems that
> it would be significantly more efficient. (I’ll be
> looking at quite a few directories)
>
> Or do I need to ask for FILE_DIRECTORY_INFORMATION and
> check the FileAttributes field?
>
> (Maybe this is documented in the IFS Kit?)
>
> Thanks,
>
> =====
> Randy Cook
>
> __________________________________________________
> Do you Yahoo!?
> New DSL Internet Access from SBC & Yahoo! http://sbc.yahoo.com
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@cyber-ark.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>
—
You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com
To unsubscribe send a blank email to %%email.unsub%%
