{"id":16463,"date":"2009-10-07T10:00:00","date_gmt":"2009-10-07T10:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2009\/10\/07\/the-ways-people-mess-up-iunknownqueryinterface-episode-3\/"},"modified":"2009-10-07T10:00:00","modified_gmt":"2009-10-07T10:00:00","slug":"the-ways-people-mess-up-iunknownqueryinterface-episode-3","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20091007-00\/?p=16463","title":{"rendered":"The ways people mess up IUnknown::QueryInterface, episode 3"},"content":{"rendered":"

\nToday we’ll\ncombine information you already know,\nsome of which I covered in\n\nThe ways people mess up IUnknown::QueryInterface<\/a>\nwith additional clues from\n\nThe layout of a COM object<\/a>.\nThere’s still not enough information for you to solve the problem\nentirely on your own,\nbut maybe you can demonstrate your nascent\npsychic debugging powers and solve the problem.\n<\/p>\n

\nA customer contacted the shell team because their shell extension\nwas causing the shell to crash.\nPerhaps they were doing something wrong, but they couldn’t see what.\nThe crash looked like this:\n<\/p>\n

\neax=cccccccc ebx=02b31798 ecx=0008db64 edx=02b26348 esi=001ea7fc edi=02b26348\neip=76381427 esp=0008db28 ebp=0008db30 iopl=0         nv up ei pl nz na pe nc\ncs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206\n76381427 8b08            mov     ecx,dword ptr [eax]  ds:0023:cccccccc=????????\n<\/pre>\n
\nYour next hint is that the crash takes place while the shell\nis trying to invoke a COM method.\n<\/p>\n
\nWhat you should recognize is that this is either at the fetch\nof a COM object’s vtable or at the fetch of the pointer to\nthe IUnknown::QueryInterface<\/code> method\n(which is the first function in the vtable of any COM object).\n<\/p>\n
\nEither way, we obviously have a bad COM object pointer.\nThe next hint is that the pointer was the result of a call\nto IUnknown::QueryInterface<\/code>:\n<\/p>\n
\nISomeInterface* psi;\npunkObj->QueryInterface(IID_ISomeInterface, (void**)&psi);\n...\n<\/pre>\n
\nIf you prefer to speak ATL, it would be something like\n<\/p>\n
\nCComQIPtr<ISomeInterface> spsi(punkObj);\n...\n<\/pre>\n
\nEither way, the problem is that the punkObj<\/code>\nresponded to IUnknown::QueryInterface<\/code>\nby putting the special debugging value 0xCCCCCCCC<\/code>\ninto the output pointer rather than following the rules for\nIUnknown::QueryInterface<\/code> which require you either\nto succeed and produce a valid object pointer\nor to fail and set the output pointer to NULL<\/code>.\n<\/p>\n
\nThe object in question came from the customer’s shell extension.\nAfter we pointed out to the customer that their\nIUnknown::QueryInterface<\/code> implementation did not adhere\nto the interface contract,\nall further communication ceased.\nWe never did get any acknowledgement or even a word of thanks.\nMaybe they were too embarrassed.<\/p>\n","protected":false},"excerpt":{"rendered":"
Today we’ll combine information you already know, some of which I covered in The ways people mess up IUnknown::QueryInterface with additional clues from The layout of a COM object. There’s still not enough information for you to solve the problem entirely on your own, but maybe you can demonstrate your nascent psychic debugging powers and […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-16463","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
Today we’ll combine information you already know, some of which I covered in The ways people mess up IUnknown::QueryInterface with additional clues from The layout of a COM object. There’s still not enough information for you to solve the problem entirely on your own, but maybe you can demonstrate your nascent psychic debugging powers and […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/16463","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=16463"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/16463\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=16463"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=16463"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=16463"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}