The Errors That PREfast for Drivers Detects

PREfast can detect potential errors in your code as soon as the code can be compiled. It can detect several types of errors, including errors in the following categories:

• Memory: Potential memory leaks, dereferenced NULL pointers, access to uninitialized memory, excessive use of the kernel-mode stack, and improper use of pool tags.

• Resources: Failure to release resources such as locks, resources that should be held when calling some functions, and resources that should not be held when calling other functions.

• Function use: Potentially incorrect use of certain functions, function arguments that appear incorrect, possible argument type mismatches for functions that do not strictly check types, possible use of certain obsolete functions, and function calls at a potentially incorrect IRQL.

• Floating point state: Failure to protect the floating-point hardware state in a driver and attempting to restore the floating-point state after saving it at a different IRQL.

• Precedence rules: Code that might not behave as the programmer intended because of the precedence rules of C programming.

• Kernel-mode coding practices: Coding practices that can cause errors, such as modifying an opaque memory descriptor list (MDL) structure, failing to examine the value of a variable set by a called function, and using C/C++ string manipulation functions rather than the safe string functions defined in Ntstrsafe.h.

• Driver-specific coding practices: Specific operations that are often a source of errors in kernel-mode drivers. For example copying a whole I/O request packet (IRP) without modifying members and saving a pointer to a string or structure argument instead of copying an argument in a DriverEntry routine.

 

 

Send comments about this topic to Microsoft

Build date: 5/3/2011