Forum

We have a CExtPopupMenuWnd. We populate with about 20 items. We occasionally see this in the purify output. We occasionally have crashes out of our IE toolbar in which this is implemented. I can’t claim these as the cause as we’re still fault isolating the issue. These do seem rather worrysome however. Thanks for any info.

From Purify:

[E] IPR: Invalid pointer read in CExtPopupMenuWnd::_DrawAnimatedState(CDC&) {20496 occurrences}
Reading 4 bytes from 0x0aed0ffc (1 byte at 0x0aed0fff illegal)
Address 0x0aed0ffc points into a committed VirtualAlloc’d block
Thread ID: 0x1718
Error location
CExtPopupMenuWnd::_DrawAnimatedState(CDC&) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:4909]
for( int pixel = 0; pixel < cx * cy; pixel++ )
{
COLORREF c0 = *dst++;
=> COLORREF c1 = *src++;
*tmp++ =
RGB(
(m_nAnimPercent*long(GetRValue(c0)) + (100L-m_nAnimPercent)*long(GetRValue(c1)) ) / 100L,
CExtPopupBaseWnd::OnPaint(void) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:4120]
CWnd::OnWndMsg(UINT,UINT,long,long *) [wincore.cpp:1824]
CWnd::WindowProc(UINT,UINT,long) [wincore.cpp:1585]
AfxCallWndProc(CWnd *,HWND__ *,UINT,UINT,long) [wincore.cpp:215]
AfxWndProc(HWND__ *,UINT,UINT,long) [wincore.cpp:367]
GetWindowLongW [C:\WINDOWS\system32\USER32.dll]
[E] IPW: Invalid pointer write in CExtPopupMenuWnd::_DrawAnimatedState(CDC&) {16 occurrences}
Writing 4 bytes to 0x0cc30ffc (1 byte at 0x0cc30fff illegal)
Address 0x0cc30ffc points into a committed VirtualAlloc’d block
Thread ID: 0x1718
Error location
CExtPopupMenuWnd::_DrawAnimatedState(CDC&) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:4915]
(m_nAnimPercent*long(GetRValue(c0)) + (100L-m_nAnimPercent)*long(GetRValue(c1)) ) / 100L,
(m_nAnimPercent*long(GetGValue(c0)) + (100L-m_nAnimPercent)*long(GetGValue(c1)) ) / 100L,
(m_nAnimPercent*long(GetBValue(c0)) + (100L-m_nAnimPercent)*long(GetBValue(c1)) ) / 100L
=> );
} // for( int pixel = 0; pixel < cx * cy; pixel++ )
pPaintDC->BitBlt(
rcClient.left, rcClient.top, cx, cy,
CExtPopupBaseWnd::OnPaint(void) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:4120]
CWnd::OnWndMsg(UINT,UINT,long,long *) [wincore.cpp:1824]
CWnd::WindowProc(UINT,UINT,long) [wincore.cpp:1585]
AfxCallWndProc(CWnd *,HWND__ *,UINT,UINT,long) [wincore.cpp:215]
AfxWndProc(HWND__ *,UINT,UINT,long) [wincore.cpp:367]
GetWindowLongW [C:\WINDOWS\system32\USER32.dll]

[E] IPR: Invalid pointer read in CExtWndShadow::_DoPixelOvershadow(int,int,int,DWORD) {636 occurrences}
Reading 4 bytes from 0x0aee0ae4 (4 bytes at 0x0aee0ae4 illegal)
Address 0x0aee0ae4 points into a committed VirtualAlloc’d block
Thread ID: 0x1718
Error location
CExtWndShadow::_DoPixelOvershadow(int,int,int,DWORD) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:1231]
m_pHelperDibSurface
+ nPosX
+ (nTotalHeight-nPosY)*nTotalWidth;
=> COLORREF clrAdj = *ptr;
if( clrShadowAdjust != ((COLORREF)(-1)) )
{
int nMakeSpecR = nMakeSpec + ::MulDiv( (100-nMakeSpec), GetBValue(clrShadowAdjust), 255 );
CExtWndShadow::_PaintHi(CExtPaintManager *,CDC&,HWND__ *,HWND__ *,tagRECT const*) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:1951]
CExtWndShadow::Paint(CExtPaintManager *,CDC&,bool,HWND__ *,HWND__ *,tagRECT const*) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:1552]
CExtWndShadow::Paint(CExtPaintManager *,CDC&,CRect const&,CRect const&,CRect const&,UINT,UINT,UINT,bool,bool,bool,HWND__ *,HWND__ *,tagRECT const*) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:1423]
CExtPopupMenuWnd::_DoPaint(CDC&,bool) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:10647]
CExtPopupBaseWnd::OnPaint(void) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:4122]
CWnd::OnWndMsg(UINT,UINT,long,long *) [wincore.cpp:1824]
CWnd::WindowProc(UINT,UINT,long) [wincore.cpp:1585]
AfxCallWndProc(CWnd *,HWND__ *,UINT,UINT,long) [wincore.cpp:215]
AfxWndProc(HWND__ *,UINT,UINT,long) [wincore.cpp:367]

This is in reference to ProfUIS 253

Some additions of an invalid write, generally in the same area of code for the DoPixelOvershadow:

[E] IPW: Invalid pointer write in CExtWndShadow::_DoPixelOvershadow(int,int,int,DWORD) {636 occurrences}
Writing 4 bytes to 0x0aee0ae4 (4 bytes at 0x0aee0ae4 illegal)
Address 0x0aee0ae4 points into a committed VirtualAlloc’d block
Thread ID: 0x1718
Error location
CExtWndShadow::_DoPixelOvershadow(int,int,int,DWORD) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:1259]
(( nMakeSpec * int(GetBValue(clrAdj)) ) / 100)
);
} // else from if( clrShadowAdjust != ((COLORREF)(-1)) )
=> *ptr = clrAdj;
}

bool CExtWndShadow::HavePhotos() const
CExtWndShadow::_PaintHi(CExtPaintManager *,CDC&,HWND__ *,HWND__ *,tagRECT const*) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:1951]
CExtWndShadow::Paint(CExtPaintManager *,CDC&,bool,HWND__ *,HWND__ *,tagRECT const*) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:1552]
CExtWndShadow::Paint(CExtPaintManager *,CDC&,CRect const&,CRect const&,CRect const&,UINT,UINT,UINT,bool,bool,bool,HWND__ *,HWND__ *,tagRECT const*) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:1423]
CExtPopupMenuWnd::_DoPaint(CDC&,bool) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:10647]
CExtPopupBaseWnd::OnPaint(void) [C:\Program Files\FOSS Software Inc\Prof-UIS\Src\ExtPopupMenuWnd.cpp:4122]
CWnd::OnWndMsg(UINT,UINT,long,long *) [wincore.cpp:1824]
CWnd::WindowProc(UINT,UINT,long) [wincore.cpp:1585]
AfxCallWndProc(CWnd *,HWND__ *,UINT,UINT,long) [wincore.cpp:215]
AfxWndProc(HWND__ *,UINT,UINT,long) [wincore.cpp:367]

The Purify has reported about a memory location which is part of a device independent bitmap (DIB) surface created with the CreateDIBSection() API. The CExtPopupMenuWnd::_DrawAnimatedState() method operates with three DIB surfaces: captured from the screen, rendered by a popup menu and resulting surface which contains pixels corresponding to the current menu animation state. The method simply gets COLORREF pixels from the first and second DIB surfaces and computes the resulting pixel color to be written into the resulting DIB surface. The CExtWndShadow::_DoPixelOvershadow() method works with a DIB surface that contains only pixels captured from the screen. The method makes pixels darker and generates a menu shadow. These methods were implemented in Prof-UIS more than two years ago, we have reviewed and debugged them hundreds times and nobody reported crashes related to these methods on any Windows OS. We think this is the case when Purify (as well as Numega Bounds Checker/DevPartner) may simply produce false results.

Besides Prof-UIS 2.60 and later versions feature two versions of menu shadows. The first, older version mentioned above is implemented as part of the menu window and currently used on old Windows OS versions only. The second, which is implemented as a standalone layered window, is used on Windows 2000 or later OS versions and makes any dynamic underlying contents visible.

We have some experience with debugging code using Rational’s Purify and Numega’s DevPartner software and must say that many memory access warnings produced by these tools actually have little to do with real problems. For instance, DevPartner contains a set of suppression files for many of DLL modules included into Windows distribution. Each suppression file is a database of errors which should not be ignored.