WriteFileEx - CompletionRoutine: Is this a bug in Windows 7 - 64 Bit?

Question

It seems that I recently discovered a big fat bug in Windows 7 ultimate 64 Bit. The weird thing is that I cannot find anything in Google or MSDN about it. It seems impossible that I am the first to discover a bug in an API so important as WriteFileEx in an operating system that is on the market since a long time ?!?!?!?

But my code is too simple to be wrong.

Apart from that my code works perfectly on: Windows XP prof 32 Bit, Windows Vista ultimate 32 Bit, Windows 7 ultimate 32 Bit, and it even works on Windows 7 ultimate 64 Bit if compiled as 64 Bit.

The only failure happens on a Windows 7 - 64 Bit if compiled as 32 Bit.

What happens is that the file is written correctly to disk, the completion routine is called, but the completion routine reports that zero bytes have been written and the most weird thing is that the OVERLAPPED structure has the wrong address and invalid content!!

Can anybody please confirm that this is a bug ?

void WINAPI CompletionRoutine(DWORD u32_ErrorCode, DWORD u32_BytesTransfered,
                              OVERLAPPED* pk_Overlapped)
{
    printf("CompletionRoutine: Transferred: %d Bytes, AddrOverlapped: 0x%X\n", 
           u32_BytesTransfered, (DWORD_PTR)pk_Overlapped);
}

int _tmain(int argc, TCHAR* argv[], TCHAR* envp[])
{
    printf("Compiled as: %d Bit\n", sizeof(DWORD_PTR) == 8 ? 64 : 32);

    HANDLE h_File = CreateFileW(L"E:\\Temp\\Test.txt", GENERIC_WRITE, 
                                FILE_SHARE_READ|FILE_SHARE_WRITE, 0, 
                                CREATE_ALWAYS, 0, 0);

    OVERLAPPED k_Over = {0};
    printf("Before WriteFileEx AddrOverlapped: 0x%X\n", (DWORD_PTR)&k_Over);

    WriteFileEx(h_File, "ABCDEF", 6, &k_Over, CompletionRoutine);

    printf("Before SleepEx\n");

    SleepEx(1000, TRUE);

    printf("Exit\n");
    return 0;
}

Here the results:

Answer 1

You are not doing any error checking, or ensuring the OVERLAPPED structure stays alive until the completion routine is actually called (it could take more than 1 second).

Try something more like this instead:

void WINAPI CompletionRoutine(DWORD u32_ErrorCode, DWORD u32_BytesTransfered, LPOVERLAPPED pk_Overlapped)
{
    if (u32_ErrorCode != 0)
        printf("CompletionRoutine: Unable to write to file! Error: %u, AddrOverlapped: %p\n", u32_ErrorCode, pk_Overlapped);
    else
        printf("CompletionRoutine: Transferred: %u Bytes, AddrOverlapped: %p\n", u32_BytesTransfered, pk_Overlapped);

    SetEvent(pk_Overlapped->hEvent);
}

int _tmain(int argc, TCHAR* argv[], TCHAR* envp[])
{
    printf("Compiled as: %d Bit\n", sizeof(DWORD_PTR) == 8 ? 64 : 32);

    printf("Creating file\n");

    const LPWSTR fileName = L"E:\\Temp\\Test.txt";

    HANDLE h_File = CreateFileW(fileName, GENERIC_WRITE, FILE_SHARE_READ|FILE_SHARE_WRITE, 0, CREATE_ALWAYS, FILE_FLAG_OVERLAPPED, 0);
    if (h_File == INVALID_HANDLE_VALUE)
    {
        printf("Unable to create file! Error: %u\n", GetLastError());
        return 0;
    }

    HANDLE h_Event = CreateEvent(NULL, TRUE, FALSE, NULL);
    if (h_Event == NULL)
    {
        printf("Unable to create wait event! Error: %u\n", GetLastError());
        CloseHandle(h_File);
        DeleteFile(fileName);
        return 0;
    }

    OVERLAPPED k_Over = {0};
    k_Over.hEvent = h_Event;

    printf("Writing to file (AddrOverlapped: %p)\n", &k_Over);

    if (!WriteFileEx(h_File, "ABCDEF", 6, &k_Over, &CompletionRoutine))
    {
        printf("Unable to write to file! Error: %u\n", GetLastError());
        CloseHandle(h_File);
        DeleteFile(fileName);
        return 0;
    }

    printf("Waiting for write to complete\n");

    DWORD dwResult;
    do
    {
        dwResult = WaitForSingleObjectEx(k_Over.hEvent, 5000, TRUE);

        if (dwResult == WAIT_OBJECT_0)
        {
            printf("Write Completed\n");
            break;
        }

        if (dwResult != WAIT_IO_COMPLETION)
        {
            if (dwResult == WAIT_TIMEOUT)
                printf("Timeout waiting for write to complete!\n");
            else
                printf("Unable to wait for write to complete!\n");

            CancelIo(h_File);
            break;
        }
    }
    while (true);

    printf("Finished waiting\n");

    CloseHandle(h_File);
    CloseHandle(h_Event);

    printf("Exit\n");
    return 0;
}

Answer 2

Solved:

FILE_FLAG_OVERLAPPED is missing.

I still think it is definitely a severe bug that a completely crippled pointer is passed to a callback routine and the callback tells that it has written 0 bytes although it has in deed written 6 bytes!

And as I showed: Not all operating systems have this bug.

A correct behaviour would be to call the callback routine with the correct OVERLAPPED address as Windows XP does or return an ERROR_INVALID_PARAMETER if an OVERLAPPED structure is used with a file handle that was not opened with FILE_FLAG_OVERLAPPED.

What I discovered is very ugly because if you develop and test your application on XP, Vista, Win7 32 Bit you will never discover that there is a flag missing. And then you deliver your app to the end users who uses Win 7 - 64 bit and they tell you that your program does not work.

A correctly programmed Windows API must return an error if a wrong parameter is given but never pass a crippled pointer.

And 4 of 5 operating systems that I tested pass the correct address!