Search code examples
windowscredential-providers

Custom windows credential provider crashes with Exception code: 0xc0000374

I have developed a custom credential provider. This credential provider uses 1) camera 2) facial sdk to match the user. Once the user is matched account name is populated and CredentialsChanged signal is triggered. I have customized samplehardwareeventcredentialprovider to achieve this functionality. This works fine with few of the machine ( all windows 10). When I tried to execute this another machine ( different brand), I get the following exception randomly and makes the screen go black , unstable login screen. All the dependencies are in place but it is not stable at all.

enter image description here

I have turned off the winbio service, disabled many of default credential providers but I face the same issue.

My Flow:

I initiate the facial identification flow in CSampleCredential::Initialize api and once it is identified, update the value for rgFieldStrings[SFI_USERNAME]

In the following method, after completing CSampleCredential::Initialize , I use CSampleProvider::OnConnectStatusChanged method to trigger login window. If everything works as expected, it launches login window with user name auto populated. The entire flow works file, but it is not stable in few machine.

HRESULT CSampleProvider::SetUsageScenario( __in CREDENTIAL_PROVIDER_USAGE_SCENARIO cpus, __in DWORD dwFlags )

Am I doing something fundamentally wrong here?

Any pointers will be helpful! Thanks

Solution

  • I generated localdump by following Steps to Catch a Simple “Crash Dump” of a Crashing Process

    By analyzing the log, it was evident that there was a heap corruption. By mistake, malloc allocation was done for the size of 4. Actually this allocation should be of size 260. When the memory is accessed beyond this size, it was triggering the random crash based on the input data.

    Original code with bug:

    uint8_t* data = (uint8_t*)malloc(sizeof(MAX_PATH));

    Fixed code:

    uint8_t* data = (uint8_t*)malloc(MAX_PATH*sizeof(uint8_t));