I’ve just come across an instance where the ParentDir member of a
FileNameInfo struct is invalid. It’s reproducible across a wide range of
OS’s including Windows 10.
My code builds up a parent directory string using ‘Volume.Length +
ParentDir.Length’, however I was seeing occasional bugchecks and upon
investigation the ParentDir is invalid.
FltParseFileNameInformation succeeds and NamesParsed contains
FLTFL_FILE_NAME_PARSED_PARENT_DIR, so my code assumes it’s good to use, but
‘ParentDir.Length’ reads 0xFFDA, which obviously leads to me building up a
string which is outside the buffer bounds.
I can work around this by using ‘Name.Length - FinalComponent.Length’, but
I’s like to understand why ParentDir is invalid.
The docs don’t say anything about the ParentDir being invalid for remote
files, but if so you’d expect it to be null and not incorrectly parsed.
1: kd> dt _FLT_FILE_NAME_INFORMATION 0xfffff8a0`0135e8e0
fltmgr!_FLT_FILE_NAME_INFORMATION
+0x000 Size : 0x78
+0x002 NamesParsed : 0xf
+0x004 Format : 2
+0x008 Name : _UNICODE_STRING
“\Device\Mup;MailslotRedirector”
+0x018 Volume : _UNICODE_STRING “\Device\Mup”
+0x028 Share : _UNICODE_STRING “;MailslotRedirector”
+0x038 Extension : _UNICODE_STRING “”
+0x048 Stream : _UNICODE_STRING “”
+0x058 FinalComponent : _UNICODE_STRING “;MailslotRedirector”
+0x068 ParentDir : _UNICODE_STRING “????”
1: kd> dt _FLT_FILE_NAME_INFORMATION 0xfffff8a00135e8e0 ParentDir. fltmgr!_FLT_FILE_NAME_INFORMATION +0x068 ParentDir : "\????" +0x000 Length : 0xffda +0x002 MaximumLength : 0xffda +0x008 Buffer : 0xfffff8a00135e99e “????”
Thanks,
Ged.