c - RtlCopyMemory PUNICODE_STRING到WCHAR segfaults

我在内核驱动程序中将PUNICODE_字符串转换为常量WCHAR[]，试图避免溢出。我的方法99%的时间都在工作，但有时我会从第一个rtlcopymory得到分段错误，调试器最有用的输出如下：

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffc0016c0dd000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800adea85bd, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

我的方法有什么问题（例如，见下文）？

typedef struct _MYRESULT {
 WCHAR Result[512];
} MYRESULT;

void myFunction(
_Inout_ MYRESULT *result,
_In_ PUNICODE_STRING s
)
{
 if (s->Length < 511) {
  // It is usually this RtlCopyMemory that crashes the kernel
  RtlCopyMemory(result->Result, s->Buffer, sizeof(WCHAR)*s->Length);
  // NULL terminate
  result->Result[(sizeof)WCHAR)*s->Length)] = 0;
 } else {
  RtlCopyMemory(result->Result, s->Buffer, sizeof(WCHAR)*512);
  // NULL terminate
  result->Result[511] = 0;
 }
}

最佳答案

代码复制了太多数据。
来自MSDN on UNICODE_STRING（由我强调）：
长度
指定缓冲区成员指向的字符串的长度（字节），不包括终止的空字符（如果有）。
从RtlCopyMemory()调用中删除sizeof(WCHAR)。

void myFunction(
_Inout_ MYRESULT *result,
_In_ PUNICODE_STRING s
)

{
  if (s->Length < (511 * sizeof * result)) {
     // It is usually this RtlCopyMemory that crashes the kernel
     RtlCopyMemory(result->Result, s->Buffer, s->Length);
     // NULL terminate
     result->Result[(sizeof)WCHAR)*s->Length)] = 0;
   } else {
     RtlCopyMemory(result->Result, s->Buffer, 512);
      // NULL terminate
     result->Result[511 * sizeof * result] = 0;
   }
}

或不易出错（也遵循DRY principle）：

#define RESULT_MAXIMUMLENGTH (511) /* This needs to stay smaller
                                      then USHORT_MAX / sizeof * MYRESULT.Result. */

typedef struct _MYRESULT {
  WCHAR Result[RESULT_MAXIMUMLENGTH + 1];
} MYRESULT;

void myFunction(
_Inout_ MYRESULT *result,
_In_ PUNICODE_STRING s
)
{
  USHORT len = (s->Length < (RESULT_MAXIMUMLENGTH * sizeof * result))
    ? s->Length
    : RESULT_MAXIMUMLENGTH * sizeof * result;

  RtlCopyMemory(result->Result, s->Buffer, len);
  result->Result[len] = 0;
}

经验教训：RTFM有帮助。

关于c - RtlCopyMemory PUNICODE_STRING到WCHAR segfaults，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/29329908/