urgent doubt about ZwQueryDirectoryFile allocating buffer on its own

NTFSD
1

Hi,
i stumbled in this thing today while debugging my fs filter. Sometimes i
need to use ZwQueryDirectoryFile, the routine works well, i use it to
enumerate files in a directory, one by one (ReturnSingleEntry for first,
then subsequent calls to ZwQueryDirectoryFile).
Now, today while browsing the ifs ddk doc for other stuff, my eyes
focused on this (in the ZwQueryDirectoryFile doc):

FileInformation
Pointer to a buffer that receives the desired information about the
file. The structure of the information returned in the buffer is defined
by the FileInformationClass parameter.
***** The caller is responsible for freeing this buffer with ExFreePool
when it is no longer needed *****.

Length
Size, in bytes, of the buffer pointed to by FileInformation. The caller
should set this parameter according to the given FileInformationClass.

Now, i always used the function by allocating the buffer myself with
exallocatepool, then freeing. Never noticed that DDK doc said
otherwise… So i bet i got giant memory leaks ? Or the function is so
smart to detect (by Length) the buffer is already allocated ?

So this means ZwQueryDirectoryFile works even if i pass NULL as
FileInformationBuffer ? So what’s the point to have a Length param ?

So someone can shed some light on this, so i’ll be able repair the leaks
before some angry customer notice that ?

Thanks,
valerio

2

The way I read this is that the caller (you) needs to
free the buffer. ZwQueryDirectoryFile will not free
the buffer.

I guess what you are confused about is that it doesn’t
say that it is also a caller allocated buffer?

I think that you are doing this correctly.

— valerino wrote:

> Hi,
> i stumbled in this thing today while debugging my fs
> filter. Sometimes i
> need to use ZwQueryDirectoryFile, the routine works
> well, i use it to
> enumerate files in a directory, one by one
> (ReturnSingleEntry for first,
> then subsequent calls to ZwQueryDirectoryFile).
> Now, today while browsing the ifs ddk doc for other
> stuff, my eyes
> focused on this (in the ZwQueryDirectoryFile doc):
>
> FileInformation
> Pointer to a buffer that receives the desired
> information about the
> file. The structure of the information returned in
> the buffer is defined
> by the FileInformationClass parameter.
> The caller is responsible for freeing this
> buffer with ExFreePool
> when it is no longer needed.
>
> Length
> Size, in bytes, of the buffer pointed to by
> FileInformation. The caller
> should set this parameter according to the given
> FileInformationClass.
>
> Now, i always used the function by allocating the
> buffer myself with
> exallocatepool, then freeing. Never noticed that DDK
> doc said
> otherwise… So i bet i got giant memory leaks ? Or
> the function is so
> smart to detect (by Length) the buffer is already
> allocated ?
>
> So this means ZwQueryDirectoryFile works even if i
> pass NULL as
> FileInformationBuffer ? So what’s the point to have
> a Length param ?
>
> So someone can shed some light on this, so i’ll be
> able repair the leaks
> before some angry customer notice that ?
>
> Thanks,
> valerio
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - 100MB free storage!
http://promotions.yahoo.com/new_mail

3

well,
i read it :
i (the function) allocate the buffer, so you (the caller) must free it.
That’s the way all other functions in the ddk which specify this
behaviour works. But i’m really confused about that, since how the
function works, and the parameters description, would make one think the
opposite (caller allocates,caller free).

Thanks for the reply anyway,
i’m about 98% sure i’m doing it right since every other usage of that
function i’ve seen is done that way … but better asking :slight_smile:

Valerio

Randy Cook wrote:

The way I read this is that the caller (you) needs to
free the buffer. ZwQueryDirectoryFile will not free
the buffer.

I guess what you are confused about is that it doesn’t
say that it is also a caller allocated buffer?

I think that you are doing this correctly.

— valerino wrote:
>
>
>>Hi,
>>i stumbled in this thing today while debugging my fs
>>filter. Sometimes i
>>need to use ZwQueryDirectoryFile, the routine works
>>well, i use it to
>>enumerate files in a directory, one by one
>>(ReturnSingleEntry for first,
>>then subsequent calls to ZwQueryDirectoryFile).
>>Now, today while browsing the ifs ddk doc for other
>>stuff, my eyes
>>focused on this (in the ZwQueryDirectoryFile doc):
>>
>>FileInformation
>>Pointer to a buffer that receives the desired
>>information about the
>>file. The structure of the information returned in
>>the buffer is defined
>>by the FileInformationClass parameter.
>> The caller is responsible for freeing this
>>buffer with ExFreePool
>>when it is no longer needed.
>>
>>Length
>>Size, in bytes, of the buffer pointed to by
>>FileInformation. The caller
>>should set this parameter according to the given
>>FileInformationClass.
>>
>>Now, i always used the function by allocating the
>>buffer myself with
>>exallocatepool, then freeing. Never noticed that DDK
>>doc said
>>otherwise… So i bet i got giant memory leaks ? Or
>>the function is so
>>smart to detect (by Length) the buffer is already
>>allocated ?
>>
>>So this means ZwQueryDirectoryFile works even if i
>>pass NULL as
>>FileInformationBuffer ? So what’s the point to have
>>a Length param ?
>>
>>So someone can shed some light on this, so i’ll be
>>able repair the leaks
>>before some angry customer notice that ?
>>
>>Thanks,
>>valerio
>>
>>—
>>Questions? First check the IFS FAQ at
>>https://www.osronline.com/article.cfm?id=17
>>
>>You are currently subscribed to ntfsd as:
>>xxxxx@yahoo.com
>>To unsubscribe send a blank email to
>>xxxxx@lists.osr.com
>>
>
>
>
>
>
>
> __________________________________
> Do you Yahoo!?
> New and Improved Yahoo! Mail - 100MB free storage!
> http://promotions.yahoo.com/new_mail
>
>

4

This description is poorly written. You allocate the buffer, and you free
it.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“valerino” wrote in message news:xxxxx@ntfsd…
> well,
> i read it :
> i (the function) allocate the buffer, so you (the caller) must free it.
> That’s the way all other functions in the ddk which specify this
> behaviour works. But i’m really confused about that, since how the
> function works, and the parameters description, would make one think the
> opposite (caller allocates,caller free).
>
> Thanks for the reply anyway,
> i’m about 98% sure i’m doing it right since every other usage of that
> function i’ve seen is done that way … but better asking :slight_smile:
>
> Valerio
>
> Randy Cook wrote:
> > The way I read this is that the caller (you) needs to
> > free the buffer. ZwQueryDirectoryFile will not free
> > the buffer.
> >
> > I guess what you are confused about is that it doesn’t
> > say that it is also a caller allocated buffer?
> >
> > I think that you are doing this correctly.
> >
> > — valerino wrote:
> >
> >
> >>Hi,
> >>i stumbled in this thing today while debugging my fs
> >>filter. Sometimes i
> >>need to use ZwQueryDirectoryFile, the routine works
> >>well, i use it to
> >>enumerate files in a directory, one by one
> >>(ReturnSingleEntry for first,
> >>then subsequent calls to ZwQueryDirectoryFile).
> >>Now, today while browsing the ifs ddk doc for other
> >>stuff, my eyes
> >>focused on this (in the ZwQueryDirectoryFile doc):
> >>
> >>FileInformation
> >>Pointer to a buffer that receives the desired
> >>information about the
> >>file. The structure of the information returned in
> >>the buffer is defined
> >>by the FileInformationClass parameter.
> >> The caller is responsible for freeing this
> >>buffer with ExFreePool
> >>when it is no longer needed.
> >>
> >>Length
> >>Size, in bytes, of the buffer pointed to by
> >>FileInformation. The caller
> >>should set this parameter according to the given
> >>FileInformationClass.
> >>
> >>Now, i always used the function by allocating the
> >>buffer myself with
> >>exallocatepool, then freeing. Never noticed that DDK
> >>doc said
> >>otherwise… So i bet i got giant memory leaks ? Or
> >>the function is so
> >>smart to detect (by Length) the buffer is already
> >>allocated ?
> >>
> >>So this means ZwQueryDirectoryFile works even if i
> >>pass NULL as
> >>FileInformationBuffer ? So what’s the point to have
> >>a Length param ?
> >>
> >>So someone can shed some light on this, so i’ll be
> >>able repair the leaks
> >>before some angry customer notice that ?
> >>
> >>Thanks,
> >>valerio
> >>
> >>—
> >>Questions? First check the IFS FAQ at
> >>https://www.osronline.com/article.cfm?id=17
> >>
> >>You are currently subscribed to ntfsd as:
> >>xxxxx@yahoo.com
> >>To unsubscribe send a blank email to
> >>xxxxx@lists.osr.com
> >>
> >
> >
> >
> >
> >
> >
> > __________________________________
> > Do you Yahoo!?
> > New and Improved Yahoo! Mail - 100MB free storage!
> > http://promotions.yahoo.com/new_mail
> >
> >
>

5

Don Burn wrote:

This description is poorly written. You allocate the buffer, and you free
it.

thanks Don. I bet this is something good for the FAQ, as the always
asked stuff about IoBuildDeviceIoContolRequest/IoFreeIrp stuff :slight_smile:

regards,
Valerio

6

Valerio,

Thank you for pointing this out. I have filed a documentation bug to
get this confusing statement removed.

You are using the API correctly.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of valerino
Sent: Tuesday, September 28, 2004 11:00 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] urgent doubt about ZwQueryDirectoryFile allocating
buffer on its own

Don Burn wrote:

This description is poorly written. You allocate the buffer, and you
free
it.

thanks Don. I bet this is something good for the FAQ, as the always
asked stuff about IoBuildDeviceIoContolRequest/IoFreeIrp stuff :slight_smile:

regards,
Valerio

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com