Skip to content

CodeQL fixes for Suspicious Pointer Math #1369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gerritsMSFT wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

CodeQL fixes for Suspicious Pointer Math #1369

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f6e61fb
CodeQL fixes for Suspicious Pointer Math
gerritsMSFT Apr 10, 2026
e796da3
Remove unused variables
gerritsMSFT Apr 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 26 additions & 10 deletions avstream/avscamera/DMFT/AvsCameraDMFT.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,20 @@ CMultipinMft::CMultipinMft()
: m_nRefCount( 0 ),
m_InputPinCount( 0 ),
m_OutputPinCount( 0 ),
m_dwWorkQueueId ( MFASYNC_CALLBACK_QUEUE_MULTITHREADED ),
m_lWorkQueuePriority ( 0 ),
m_spAttributes( nullptr ),
m_StreamingState( DeviceStreamState_Disabled ),
m_OutPins(),
m_InPins(),
m_critSec(),
m_spDeviceManagerUnk( nullptr ),
m_spSourceTransform( nullptr ),
m_SymbolicLink(nullptr)
m_eShutdownStatus( MFSHUTDOWN_INITIATED ),
m_dwWorkQueueId( MFASYNC_CALLBACK_QUEUE_MULTITHREADED ),
m_lWorkQueuePriority( 0 ),
m_punValue( 0 ),
m_spIkscontrol( nullptr ),
m_spAttributes( nullptr ),
m_outputPinMap(),
m_SymbolicLink( nullptr )

{
HRESULT hr = S_OK;
Expand Down Expand Up @@ -189,7 +198,7 @@ IFACEMETHODIMP CMultipinMft::InitializeTransform (
//
// Create one on one mapping
//
for (ULONG ulIndex = 0; ulIndex < m_InPins.size(); ulIndex++)
for (ULONG ulIndex = 0; ulIndex < (ULONG)(m_InPins.size()); ulIndex++)
{

ComPtr<CInPin> spInPin = (CInPin*)m_InPins[ulIndex].Get();
Expand Down Expand Up @@ -378,12 +387,16 @@ IFACEMETHODIMP CMultipinMft::GetInputAvailableType(
)
{
HRESULT hr = S_OK;


if (ppMediaType)
{
*ppMediaType = nullptr;
}

ComPtr<CInPin> spiPin = GetInPin( dwInputStreamID );
DMFTCHECKNULL_GOTO(ppMediaType, done, E_INVALIDARG);
DMFTCHECKNULL_GOTO( spiPin, done, MF_E_INVALIDSTREAMNUMBER );

*ppMediaType = nullptr;


hr = spiPin->GetOutputAvailableType( dwTypeIndex,ppMediaType );

Expand Down Expand Up @@ -417,12 +430,15 @@ IFACEMETHODIMP CMultipinMft::GetOutputAvailableType(
CAutoLock Lock(m_critSec);

ComPtr<COutPin> spoPin = GetOutPin( dwOutputStreamID );

if (ppMediaType)
{
*ppMediaType = nullptr;
}

DMFTCHECKNULL_GOTO( spoPin.Get(), done, MF_E_INVALIDSTREAMNUMBER );
DMFTCHECKNULL_GOTO(ppMediaType, done, E_INVALIDARG);

*ppMediaType = nullptr;

hr = spoPin->GetOutputAvailableType( dwTypeIndex, ppMediaType );

if ( FAILED( hr ) )
Expand Down
7 changes: 0 additions & 7 deletions avstream/avscamera/DMFT/AvsCameraDMFT.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,11 +226,6 @@ class CMultipinMft :

static HRESULT CreateInstance(
REFIID iid, void **ppMFT);

__inline BOOL isPhotoModePhotoSequence()
{
return m_PhotoModeIsPhotoSequence;
}

__inline DWORD GetQueueId()
{
Expand Down Expand Up @@ -305,11 +300,9 @@ class CMultipinMft :
private:
ULONG m_InputPinCount;
ULONG m_OutputPinCount;
ULONG m_CustomPinCount;
DeviceStreamState m_StreamingState;
CBasePinArray m_OutPins;
CBasePinArray m_InPins;
BOOL m_PhotoModeIsPhotoSequence; // used to store if the filter is in photo sequence or not
long m_nRefCount; // Reference count
CCritSec m_critSec; // Control lock.. taken only durign state change operations
ComPtr <IUnknown> m_spDeviceManagerUnk; // D3D Manager set, when MFT_MESSAGE_SET_D3D_MANAGER is called through ProcessMessage
Expand Down
4 changes: 3 additions & 1 deletion avstream/avscamera/DMFT/AvsCameraDMFTutils.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -734,7 +734,9 @@ HRESULT ParseMetadata_FaceDetection(
{
return E_UNEXPECTED;
}
PMETADATA_FACEDATA pFaceData = (PMETADATA_FACEDATA)(pFaceHeader + 1);
PMETADATA_FACEDATA pFaceData = reinterpret_cast<PMETADATA_FACEDATA>(
reinterpret_cast<BYTE*>(pFaceHeader) + sizeof(CAMERA_METADATA_FACEHEADER));

UINT32 cbRectSize = sizeof(FaceRectInfoBlobHeader) + (sizeof(FaceRectInfo) * (pFaceHeader->Count));
BYTE* pRectBuf = new (std::nothrow) BYTE[cbRectSize];
if (pRectBuf == NULL)
Expand Down
22 changes: 16 additions & 6 deletions avstream/avscamera/DMFT/basepin.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,11 +90,16 @@ class CBasePin:
_Out_opt_ ULONG* pBytesReturned
)
{
UNREFERENCED_PARAMETER(pBytesReturned);
UNREFERENCED_PARAMETER(ulDataLength);
UNREFERENCED_PARAMETER(pMethodData);
UNREFERENCED_PARAMETER(pMethod);
UNREFERENCED_PARAMETER(ulMethodLength);
UNREFERENCED_PARAMETER(pMethodData);
UNREFERENCED_PARAMETER(ulDataLength);

// Ensure *pBytesReturned is initialized if provided
if (pBytesReturned != nullptr)
{
*pBytesReturned = 0;
}
return S_OK;
}

Expand All @@ -106,11 +111,16 @@ class CBasePin:
_Out_opt_ ULONG* pBytesReturned
)
{
UNREFERENCED_PARAMETER(pBytesReturned);
UNREFERENCED_PARAMETER(ulDataLength);
UNREFERENCED_PARAMETER(pEventData);
UNREFERENCED_PARAMETER(pEvent);
UNREFERENCED_PARAMETER(ulEventLength);
UNREFERENCED_PARAMETER(pEventData);
UNREFERENCED_PARAMETER(ulDataLength);

// Ensure *pBytesReturned is initialized if provided
if (pBytesReturned != nullptr)
{
*pBytesReturned = 0;
}
return S_OK;
}

Expand Down
2 changes: 1 addition & 1 deletion avstream/avscamera/sys/Capture.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1462,7 +1462,7 @@ Return Value:
//
if( Pin->DeviceState == KSSTATE_STOP )
{
if( !CapPin->CaptureBitmapInfoHeader( ) )
if( !NT_SUCCESS(CapPin->CaptureBitmapInfoHeader( )) )
{
Status = STATUS_INSUFFICIENT_RESOURCES;
}
Expand Down
21 changes: 18 additions & 3 deletions avstream/avscamera/sys/Device.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,8 @@ CCaptureDevice (
, m_FilterDescriptorCount(0)
, m_Sensor(nullptr)
, m_Context(nullptr)
, m_DmaAdapterObject(nullptr)
, m_NumberOfMapRegisters(0)
{
PAGED_CODE();
}
Expand Down Expand Up @@ -85,9 +87,10 @@ CCaptureDevice::
GetFilterIndex(PKSFILTER Filter)
{
PAGED_CODE();

ULONG i;

for( i=0; i<m_FilterDescriptorCount; i++ )
for( i=0; i<(ULONG)m_FilterDescriptorCount; i++ )
{
if( Filter->Descriptor->ReferenceGuid &&
IsEqualGUID(*(m_Context[i].Descriptor->ReferenceGuid), *Filter->Descriptor->ReferenceGuid))
Expand Down Expand Up @@ -130,13 +133,19 @@ QueryForInterface(
_In_ USHORT Size,
_In_ USHORT Version,
_In_opt_ PVOID InterfaceSpecificData
)
)
{
PAGED_CODE();

PIRP pIrp;
NTSTATUS status;

// Ensure the output parameter is initialized to a known state.
if (Interface)
{
RtlZeroMemory(Interface, Size);
}

if (TopOfStack == nullptr)
{
return STATUS_INVALID_PARAMETER;
Expand Down Expand Up @@ -181,7 +190,7 @@ QueryForInterface(
KernelMode,
FALSE, // Not alertable
NULL
);
);

status = pIrp->IoStatus.Status;
}
Expand All @@ -192,6 +201,12 @@ QueryForInterface(
status = STATUS_INSUFFICIENT_RESOURCES;
}

// If the call failed, ensure Interface is zeroed to avoid returning uninitialized memory.
if (!NT_SUCCESS(status) && Interface)
{
RtlZeroMemory(Interface, Size);
}

return status;
}

Expand Down
3 changes: 2 additions & 1 deletion avstream/avscamera/sys/Device.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ class CCaptureDevice
//

// Number of Filter descriptors & filter factories.
size_t m_FilterDescriptorCount;
ULONG m_FilterDescriptorCount;

// Pointer to an array of filter descriptor pointers.
// Typically it's one sensor for each filter factory.
Expand Down Expand Up @@ -407,6 +407,7 @@ class CCaptureDevice
static IO_COMPLETION_ROUTINE IrpSynchronousCompletion;

virtual
_Must_inspect_result_
NTSTATUS
QueryForInterface(
_In_ PDEVICE_OBJECT TopOfStack,
Expand Down
6 changes: 3 additions & 3 deletions avstream/avscamera/sys/PreviewHwSim.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -209,8 +209,8 @@ Return Value:

if (0 != (pStreamHeader->OptionsFlags & KSSTREAM_HEADER_OPTIONSF_METADATA))
{
PKS_FRAME_INFO pFrameInfo = (PKS_FRAME_INFO)(pStreamHeader + 1);
PKSSTREAM_METADATA_INFO pMetadata = (PKSSTREAM_METADATA_INFO) (pFrameInfo + 1);
PKS_FRAME_INFO pFrameInfo = (PKS_FRAME_INFO)((PUCHAR)pStreamHeader + sizeof(KSSTREAM_HEADER));
PKSSTREAM_METADATA_INFO pMetadata = (PKSSTREAM_METADATA_INFO)((PUCHAR)pFrameInfo + sizeof(KS_FRAME_INFO));
ULONG BytesLeft = pMetadata->BufferSize - pMetadata->UsedSize;

if(m_PhotoConfirmationEntry.isRequired())
Expand Down Expand Up @@ -325,7 +325,7 @@ Return Value:
}
else if ((State.Flags & KSCAMERA_EXTENDEDPROP_IRTORCHMODE_ALTERNATING_FRAME_ILLUMINATION))
{
m_Illuminated = !m_Illuminated;
m_Illuminated = ~m_Illuminated;
if (m_Illuminated)
{
pPreviewIllumination->Flags = KSCAMERA_METADATA_FRAMEILLUMINATION_FLAG_ON;
Expand Down
27 changes: 21 additions & 6 deletions avstream/avscamera/sys/Roi.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ Return Value:

// We assume the controls have been validated first.
PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL pIspCtrl =
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL> (this+1);
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL>(reinterpret_cast<PBYTE>(this) + sizeof(CRoiProperty));

// Loop thru the controls.
for( ULONG i=0; i<m_Hdr.ControlCount; i++ )
Expand All @@ -155,6 +155,11 @@ Return Value:

// Advance to the next control.
pIspCtrl = NextCtrl( pIspCtrl );
if(pIspCtrl == nullptr)
{
NT_ASSERTMSG("NextCtrl( pCtrl ) returned 0! Should never happen!", FALSE);
return nullptr;
}
}

return nullptr;
Expand Down Expand Up @@ -192,13 +197,18 @@ Return Value:
{
// We assume the controls have been validated first.
PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL pIspCtrl =
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL> (this+1);
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL>(reinterpret_cast<PBYTE>(this) + sizeof(CRoiProperty));

// Loop thru all the controls.
for( ULONG i=0; i<m_Hdr.ControlCount; i++ )
{
// Advance to the next control.
pIspCtrl = NextCtrl( pIspCtrl );
if (pIspCtrl == nullptr)
{
NT_ASSERTMSG("NextCtrl( pCtrl ) returned 0! Should never happen!", FALSE);
return nullptr;
}
}

ULONG SizeToCopy = ::GetSize(pCtrl);
Expand Down Expand Up @@ -277,14 +287,14 @@ Return Value:
}

PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL pIspCtrl =
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL> (this+1);
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL>(reinterpret_cast<BYTE*>(this) + sizeof(*this));

// Loop thru the controls.
for( ULONG i=0; i<m_Hdr.ControlCount; i++ )
{
// Make sure there is room to inspect this control
if( Size < ByteDiffPtrs( this, pIspCtrl+1 ) ||
m_Hdr.Size < ByteDiffPtrs( &m_Hdr, pIspCtrl+1 ) )
if( Size < ByteDiffPtrs( this, reinterpret_cast<PBYTE>(pIspCtrl) + sizeof(*pIspCtrl) ) ||
m_Hdr.Size < ByteDiffPtrs( &m_Hdr, reinterpret_cast<PBYTE>(pIspCtrl) + sizeof(*pIspCtrl) ) )
{
//NT_ASSERT(FALSE);
DBG_TRACE( "Failed(1): Size=%d, should be at least %Iu", Size, ByteDiffPtrs( this, pIspCtrl+1 ) );
Expand Down Expand Up @@ -324,7 +334,7 @@ Return Value:
// Index into to the control's ROI list. Get the equivilent of "pIspCtrl->RoiInfo[j]"
PKSCAMERA_EXTENDEDPROP_ROI_INFO pRoiInfo =
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_INFO>
(((PBYTE) (pIspCtrl+1)) + (j * GetSizeOfRoiInfo(pIspCtrl->ControlId) ));
((reinterpret_cast<PBYTE>(pIspCtrl) + sizeof(*pIspCtrl)) + (j * GetSizeOfRoiInfo(pIspCtrl->ControlId) ));

// Validate the cooridinates
if( pRoiInfo->Region.top < (LONG) TO_Q31(0) ||
Expand Down Expand Up @@ -500,6 +510,11 @@ Log()

// Advance to the next control.
pIspCtrl = reinterpret_cast<CRoiIspControl *>( NextCtrl( pIspCtrl ) ) ;
if (pIspCtrl == nullptr)
{
NT_ASSERTMSG("NextCtrl( pCtrl ) returned 0! Should never happen!", FALSE);
return;
}
}
}

Expand Down
Loading
Loading