DirectShow Filter Crashes on QueryInterface sometimes

You want assembly crash from Olly? I get send error report dialog

In Olly here is crash in Skype module Skype:


00B9018E   85C9             TEST ECX,ECX
00B90190   0F8E 93010000    JLE Skype.00B90329
00B90196   8B6C24 18        MOV EBP,DWORD PTR SS:[ESP+18]
00B9019A   8BDA             MOV EBX,EDX
00B9019C   F7DB             NEG EBX
00B9019E   E8 6DFDFFFF      CALL Skype.00B8FF10
00B901A3   8BF0             MOV ESI,EAX
00B901A5   83EE 01          SUB ESI,1
00B901A8   0FAFF2           IMUL ESI,EDX
00B901AB   037424 14        ADD ESI,DWORD PTR SS:[ESP+14]
00B901AF   894C24 18        MOV DWORD PTR SS:[ESP+18],ECX
00B901B3   85FF             TEST EDI,EDI
00B901B5   8BCE             MOV ECX,ESI
00B901B7   8BD5             MOV EDX,EBP
00B901B9   0F86 59010000    JBE Skype.00B90318
00B901BF   90               NOP
00B901C0   0FB702           MOVZX EAX,WORD PTR DS:[EDX]   <---- CRASH IS HERE

I debugged it with writing each stat to debug log, I see after 8 times calling QueryInterface with different values, 8th call makes it crash

Well, th eexception code would be more interesting, but from

00B901C0   0FB702           MOVZX EAX,WORD PTR DS:[EDX]

I assume it's 0xc0000005 - and it seems that it is a Skype-related problem, nothing that you can do much about.

But why and how??? I see a lot of webcams make Skype crash, but all of them released an update and fixed the issue, see google for webcam crash in Skype, all of them released an update and fixed it...

What do you think?

More details on Crash:


Registers status on crash:
EAX 00000000
ECX 078DD000
EDX 05109000
EBX FFFFF600
ESP 069FFEC8
EBP 05108B80
ESI 078DCA00
EDI 00000010
EIP 00B901C0 Skype.00B901C0
C 0  ES 0023 32bit 0(FFFFFFFF)
P 0  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFA1000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00000202 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty 0.0
ST1 empty 0.0
ST2 empty 0.0
ST3 empty 1.0000000000000000000
ST4 empty 1.0000000000000000000
ST5 empty 20466.832656250000580
ST6 empty 200.00000000000000000
ST7 empty 0.0
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1


Access Violation when reading 05109000

>> Access Violation when reading 05109000

Can you check what module is loaded at this address (if any)?

As you may know that address vary on each time, now I got exception in:
05249000

In memory view, I have some garbage data from 0521000 - 05248FF0
and there is no data in 05249000 and again in next memory block I have garbage full of data from 0526000 to 0527000

I got updates...

It's not related to Skype, Flash also crashes in IE and Firefox, I tried to load my webcam in IE and Firefox with Flash, same happened, got crash there!

This time exception was in Vcam.ax which is our code, exception details:



05C25400   53               PUSH EBX
05C25401   8B5C24 08        MOV EBX,DWORD PTR SS:[ESP+8]
05C25405   55               PUSH EBP
05C25406   8B6C24 10        MOV EBP,DWORD PTR SS:[ESP+10]
05C2540A   56               PUSH ESI
05C2540B   57               PUSH EDI
05C2540C   B9 12000000      MOV ECX,12
05C25411   8BF5             MOV ESI,EBP
05C25413   8BFB             MOV EDI,EBX
05C25415   F3:A5            REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> <--- Exception here!
05C25417   8B45 40          MOV EAX,DWORD PTR SS:[EBP+40]
05C2541A   85C0             TEST EAX,EAX
05C2541C   74 33            JE SHORT Vcam.05C25451
05C2541E   50               PUSH EAX
05C2541F   FF15 B470C205    CALL DWORD PTR DS:[<&ole32.CoTaskMemAllo>; ole32.CoTaskMemAlloc
05C25425   85C0             TEST EAX,EAX
05C25427   8943 44          MOV DWORD PTR DS:[EBX+44],EAX
05C2542A   75 0F            JNZ SHORT Vcam.05C2543B



Registers status:
EAX 00000000
ECX 00000012
EDX 0000004F
EBX 02F42CA4 ASCII "vids"
ESP 00B0D4B0
EBP 00000000
ESI 00000000
EDI 02F42CA4 ASCII "vids"
EIP 05C25415 Vcam.05C25415
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 1  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFDC000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00000246 (NO,NB,E,BE,NS,PE,GE,LE)
ST0 empty 1.6460435905164033450e+2736
ST1 empty -UNORM EE88 01180000 4000027F
ST2 empty 0.0
ST3 empty 0.0
ST4 empty 0.0
ST5 empty 0.0
ST6 empty 1.0000000000000000000
ST7 empty 15.500000000000000000
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1


Access Violation when reading 00000000

What's the source code for that one?

No idea... Because entire code doesn't have call to CoTaskMemAlloc

Get the Process Explorer (http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx) and check which module is loaded at the address 0x05C25400

It is Vcam.ax, our compiled DirectShow filter from source code I said in Q

Are you linking statically to the DX libs?

Yes

I got doubt about your last question, why do you ask that?

I'm compiling using /MD which will link statically to msvcrt.lib, I have no idea about DX libs...

>>I got doubt about your last question, why do you ask that?

Since you say you never call 'CoTaskMemAlloc()', there are two options: Code that you are statically linking to does that (msvcrt.lib doesn't) or you are just experiencing that "happily-move-code-around-in-memory" thing that Skype does, and if the latter applies (most likely), we've hit a dead end.

But as I said I get same crash here:
http://oldes.multimedia.cz/swf/mx-webcam.html

It's Macromedia Flash trying to read the webcam, I get crash!

As I said I'm 100% sure it's some failure in QueryInterface on line 17 of Filters.cpp on the project.

QueryInterface is so tricky function, failing to processing requests, ALWAYS causes crash, something is wrong there and in AddRef() function in QueryInterface

Any updates JKR? Did you tried code?

I found solution in text, but I don't know what does it mean... Can you explain?


In order your code to work with Flash Player, you need to implement all neccessary methods like SetFormat/SetMediaType and since DirectShow is rather non friendly interface, you'll spend some time on it.

What's missing in SetFormat/SetMediaType etc. in that code?

yes since its an interface you need to implement all methods exposed by that interface, something similar to over-riding all methods in an abstract base class if you inherit from it.

If Flash Player doesn't require it just return the defaults from these functions....or set the defaults. Check the out type or in type populate a dummy and then code them into the method.

What type of dummy code I should insert?

I tried to return
return CSourceStream::QueryInterface(riid, ppv);

For each query, but it didn't worked...

I tried to AddRef() for each query again not worked.

I tried to return S_OK for each query again not worked.

I think I'm doing something wrong or maybe we should implement all methods properly...

What do you think?