Question regarding FltGetFileNameInformation()

NTFSD
1

Hi All,
I was wondering wich of these flags:
FLT_FILE_NAME_QUERY_DEFAULT,
FLT_FILE_NAME_QUERY_CACHE_ONLY,
FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY
FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP
is the correct way to use with FltGetFileNameInformation()?

Have you seen using FLT_FILE_NAME_QUERY_DEFAULT or FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP will ever cause memory leak by filter manager? Or when filter manager frees up the cache that was used by the names?

Thanks a lot
Payman

2

YOU need to call FltReleaseFileNameInforamtion after a successful FltGetxxxFileNameInformation call (there are 4 different name query calls).
Neither of these flags will cause a leak, and FltMgr will correctly cleanup the name cache on the final file close.

(I wish the rest of this API worked as nice:(

Regards, Dejan.

xxxxx@hotmail.com wrote:

Hi All,
I was wondering wich of these flags:
FLT_FILE_NAME_QUERY_DEFAULT,
FLT_FILE_NAME_QUERY_CACHE_ONLY,
FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY
FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP
is the correct way to use with FltGetFileNameInformation()?

Have you seen using FLT_FILE_NAME_QUERY_DEFAULT or FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP will ever cause memory leak by filter manager? Or when filter manager frees up the cache that was used by the names?

Thanks a lot
Payman

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

3

Dejan
Thanks for your response. You were right I had forgotten to call FltReleaseFileNameInforamtion()
Thanks again