PSA: FsRtlIsNameInExpression Can Raise an Exception

Well, THIS one was a surprise…After triggering a memory leak in a driver, the system surprisingly crashed due to a call to FsRtlIsNameInExpression:

As best we could tell we were passing valid input to FsRtlIsNameInExpression, so what’s up?

The answer lies in the exception code: STATUS_NO_MEMORY (0xC0000017). A quick scan of the disassembly shows that yes indeed, FsRtlIsNameInExpression will raise an exception if:

1. The IgnoreCase argument is TRUE
2. The UpcaseTable argument is NULL
3. RtlUpcaseUnicodeString returns a failure status

It’s possible that there are other cases where it raises an exception, but one case is sufficient to require all calls being wrapped in a __try/__except.

Sadly, we at OSR have used this function for over a decade and never wrapped it in a __try/__except. We even missed it back in 2003 when we tried to document which driver functions raise exceptions. To be fair, the documentation does not indicate that it can raise an exception and the prototype is not properly SAL’d to indicate that an exception is possible.

Hence the PSA: check your calls to FsRtlIsNameInExpression. If you pass TRUE to IgnoreCase and a NULL UpcaseTable you need to wrap your call in a __try/__except to avoid a low memory bugcheck.