Would someone please be kind enough to explain what I'd doing wrong?
I attach a stream context to a single file during Post-Create. In
Pre-Close, I find the context with FltGetStreamContext
and pass that context to Post-Close via the CompletionContext parameter
where it's destroyed. This invokes my
Context Clean-up routine. So far, all works well.
Then, when Post-Create is called again, I once again call
FltGetStreamContext to see if a context exist; this returns
TRUE. Since a context seems too exist for the stream, I call
FltReleaseContext to decrement the ref count and try to exit with
POSTOP_FINISHED_PROCESSING. However, I get an access violation instead.
In this second Post-Op, between
GetStream and ReleaseStream, the context disappears..... I can't release
something that no longer exist......
In this test filter, I'm only tracking a single file for the moment.
Interesting side note, in the Post-Close, if I call FltDeleteContext,
all is fine, but if I call FltReleaseContext (which also results in the
fltmgr invoking ContextClean-up) the context still exist in the
next Post-Create.... What am I messing up here?
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************
Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
PROCESS_NAME: explorer.exe
FAULTING_IP:
fltmgr!DoFreeContext+8
bff47dbc 8b4604 mov eax,[esi+0x4]
EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: bff47dbc (fltmgr!DoFreeContext+0x00000008)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000004
Attempt to read from address 00000004
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000004
BUGCHECK_STR: ACCESS_VIOLATION
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from bff47d94 to bff47dbc
STACK_TEXT:
f56a8784 bff47d94 e2b09f88 f56a87d4 bff480c3 fltmgr!DoFreeContext+0x8
f56a8790 bff480c3 e2b09f88 ee1b45ba e2b09fb0 fltmgr!DoReleaseContext+0x22
f56a8798 ee1b45ba e2b09fb0 81460d7c 81460cc8 fltmgr!FltReleaseContext+0xd
f56a87b0 bff46e7e 00460d24 e2e3ee74 00000000
context!ScannerPostCreate+0xc0 [c:\context\filter\context.c @ 409]
f56a8818 bff4a4f2 81460c00 00000000 81460cc8
fltmgr!FltpPerformPostCallbacks+0x1ca
f56a8828 bff4a637 81460cc8 a53fce70 bff4a42c
fltmgr!FltpProcessIoCompletion+0xc
f56a8834 bff4a42c 813a0ee0 a53fce70 81460cc8
fltmgr!FltpPassThroughCompletion+0xa4
f56a8864 bff55e5f f56a8884 00000000 00000000
fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x26c
f56a88a0 8041dded 813a0ee0 a53fcfdc a53fce80 fltmgr!FltpCreate+0x29d
f56a88b4 804bf978 804824e0 804beeba f56a8bb8 nt!IopfCallDriver+0x35
f56a8a44 80450893 818aac30 00000000 f56a8afc nt!IopParseDevice+0xabe
f56a8abc 804d59a0 00000000 818a7300 00000040 nt!ObpLookupObjectName+0x4e7
f56a8bcc 8049f9f1 00000000 00000000 00000001 nt!ObOpenObjectByName+0xc8
f56a8ca8 8049f596 0195e350 00120089 0195e310 nt!IopCreateFile+0x407
f56a8cf0 804a6fde 0195e350 00120089 0195e310 nt!IoCreateFile+0x36
f56a8d30 80464f84 0195e350 00120089 0195e310 nt!NtCreateFile+0x2e
f56a8d30 77f88283 0195e350 00120089 0195e310 nt!KiSystemService+0xc4
0195e2d8 7ce3c5b5 0195e350 00120089 0195e310 ntdll!NtCreateFile+0xb
0195e344 7cee9988 0195e370 00000000 00000040
OLE32!CDebugChannelHook::ServerGetSize+0x30
0195e374 7cee98ae 000941f8 ffffffff 0195e3a4 OLE32!PBasicEntry::Release+0x2
0195e384 7cee8c5a 0195e3d0 00000000 00000000 OLE32!PTimeEntry::GetTime+0x24
0195e3a4 7ce85b78 0195e3d0 00000020 00000000 OLE32!CDFBasis::CDFBasis+0xb4
0195e3b8 7cf626f8 0195e8f8 00000000 00000000
OLE32!CRpcThread::WorkerLoop+0x18
0195e3e4 00000000 00000000 00000000 00000000
SHELL32!CWebViewMimeFilter::_ReadAndExpandBuffer+0x215