RE: FltSendMessage return STATUS_BUFFER_OVERFLOW due to an alignment iss

Neal,

The problem is that I always call FilterReplyMessage with sizeof(REPLY).

The scanner sample is OK, because it use #pragma pack(1), so:

typedef struct _SCANNER_REPLY_MESSAGE {

FILTER_REPLY_HEADER ReplyHeader;
SCANNER_REPLY Reply;

} SCANNER_REPLY_MESSAGE, *PSCANNER_REPLY_MESSAGE;

sizeof(FILTER_REPLY_HEADER) = 12
sizeof(SCANNER_REPLY) = 1
sizeof(SCANNER_REPLY_MESSAGE) = 13

Therefore sizeof(SCANNER_REPLY_MESSAGE) == sizeof(FILTER_REPLY_HEADER) +
sizeof(SCANNER_REPLY).

And the call to FilterReplyMessage is:

FilterReplyMessage( Context->Port,
(PFILTER_REPLY_HEADER) &replyMessage,
sizeof( replyMessage ) ); // size is 13.

Then I suppose Filter Manager checks whether (13 -
sizeof(FILTER_REPLY_HEADER)) == sizeof(SCANNER_REPLY). That is TRUE.

If you delete the #pragma pack directive, the alignment mode for members of
structures following the directives is not modified, and then:

sizeof(FILTER_REPLY_HEADER) = 16
sizeof(SCANNER_REPLY) = 1
sizeof(SCANNER_REPLY_MESSAGE) = 24 (16 + 8 (->1 rounded to the alignment of
FILTER_REPLY_HEADER))

Then sizeof(SCANNER_REPLY_MESSAGE) != sizeof(FILTER_REPLY_HEADER) +
sizeof(SCANNER_REPLY).

I only wanted to indicate that proper alignment is needed. #pragma pack(1),
decreasing all member alignment, or __declspec(align(8)), incrementing
SCANNER_REPLY alignment, are acceptable solutions for me.

Thank you,
mK


Express yourself instantly with MSN Messenger! Download today it’s FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/