GetRawInputDeviceInfo indicates a buffer size of 1 character for RIDI_DEVICENAME

Question

I'm getting ridiculous behavior from RIDI_DEVICENAME. According to the documentation,

Return value

Type: UINT

If successful, this function returns a non-negative number indicating the number of bytes copied to pData.

If pData is not large enough for the data, the function returns -1. If pData is NULL, the function returns a value of zero. In both of these cases, pcbSize is set to the minimum size required for the pData buffer.

Call GetLastError to identify any other errors.

Ignoring the obvious problem that -1 is not a representable value in the UINT return type, it seems that the function should tell me the required size of the buffer, and if I supply a buffer of this size, the function should either succeed or at least follow its own rules for failure.

However, I'm not seeing this at all. On Windows 10, the Unicode version of the function sets pcbSize to 1 when pData is null and leaves it alone otherwise, failing in all cases. The ANSI version of the function sets pcbSize to 2 when pData is null, and otherwise doubles whatever value was passed in, and still fails.

Headers used for either version of test code:

#define WIN32_EXTRA_LEAN 1

#include <iomanip>
#include <iostream>
#include <string>
#include <vector>

#include <windows.h>

ANSI test code:

std::string GetRawInputDeviceName( HANDLE hRaw )
{
    UINT numChars = 0u;
    INT validChars;

    validChars = static_cast<INT>(::GetRawInputDeviceInfoA(hRaw, RIDI_DEVICENAME, nullptr, &numChars));
    auto lasterror = ::GetLastError();
    if (lasterror != ERROR_INSUFFICIENT_BUFFER) {
        std::wcerr << L"Failed to get length of name of raw input device, retcode = " << validChars << L", last error = " << lasterror << L"\n";
        return {};
    }

    std::string name;
    name.resize(numChars);
    validChars = static_cast<INT>(::GetRawInputDeviceInfoA(hRaw, RIDI_DEVICENAME, &name[0], &numChars));
    lasterror = ::GetLastError();

    if (validChars > 0) {
        name.resize(validChars);
        return name;
    }
    else {
        std::wcerr << L"Failed to get name of raw input device, retcode = " << validChars << L", last error = " << lasterror << L"\n";
        return {};
    }
}

Unicode test code:

std::wstring GetRawInputDeviceName( HANDLE hRaw )
{
    UINT numChars = 0u;
    INT validChars;

    validChars = static_cast<INT>(::GetRawInputDeviceInfoW(hRaw, RIDI_DEVICENAME, nullptr, &numChars));
    auto lasterror = ::GetLastError();
    if (lasterror != ERROR_INSUFFICIENT_BUFFER) {
        std::wcerr << L"Failed to get length of name of raw input device, retcode = " << validChars << L", last error = " << lasterror << L"\n";
        return {};
    }

    std::wstring name;
    name.resize(numChars);
    validChars = static_cast<INT>(::GetRawInputDeviceInfoW(hRaw, RIDI_DEVICENAME, &name[0], &numChars));
    lasterror = ::GetLastError();

    if (validChars > 0) {
        name.resize(validChars);
        return name;
    }
    else {
        std::wcerr << L"Failed to get name of raw input device, retcode = " << validChars << L", last error = " << lasterror << L"\n";
        return {};
    }
}

On Windows 10 through RDP I'm getting ERROR_INSUFFICIENT_BUFFER consistently.

On Windows 8.1 running as a local user, I get ERROR_INSUFFICIENT_BUFFER if pData is null, and when I provide a buffer I get back failure ((UINT)-1) and GetLastError() returns zero.

I've also just tried proposing a likely-large-enough buffer size, and got failures as well.

What is going on, what is the right way to get the interface path name, and do I need administrative rights or to call some other APIs first? I don't seem to be having any problems calling GetRawInputDeviceList or using RIDI_DEVICEINFO mode of GetRawInputDeviceInfo... but I need the interface path in order to go further.

• Windows HID Device Name Format
• https://stackoverflow.com/a/64320052/103167

Answer 1

the GetRawInputDeviceName have several errors in declaration / implementation / documentation

by fact more correct declare return value as signed ( LONG or INT) but not UINT

exist 3 case:

1. function return negative value (or if want -1) : this is error case, and by design - last error must be set. but really it not always set (implementation error).

most common errors:

• pcbSize or pData point to invalid or read only memory location. usual error in this case ERROR_NOACCESS (translated from STATUS_ACCESS_VIOLATION)

• hDevice not valid handle - ERROR_INVALID_HANDLE is returned

• uiCommand not valid RIDI_XXX constant - ERROR_INVALID_PARAMETER

• *pcbSize is not large enough for the data - in this case *pcbSize is set to the minimum size required for the pData buffer. ERROR_INSUFFICIENT_BUFFER

  again - only in this case (-1) exist sense call GetLastError();

2. function return 0 this possible only in case when pData is NULL. *pcbSize is set to the minimum size required for the pData buffer.

3. function return positive value ( > 0) this mean that this count of bytes (in case RIDI_PREPARSEDDATA or RIDI_DEVICEINFO ) or characters (in case RIDI_DEVICENAME) written to buffer

so documentation is wrong here:

pcbSize [in, out]

Pointer to a variable that contains the size, in bytes, of the data in pData.

in case RIDI_DEVICENAME in characters

so already visible very serious problems with design (type of return value - unsigned) and mixed bytes/characters. many different cases.

but then exist critical error in implementation. in begin of function handle hDevice converted to pointer.

PDEVICEINFO pDeviceInfo = HMValidateHandle(hDevice, TYPE_DEVICEINFO);

(if 0 returned - we got -1 on exit with ERROR_INVALID_HANDLE).

in DEVICEINFO exist UNICODE_STRING ustrName - this name and copied to user mode

switch (uiCommand) {
case RIDI_DEVICENAME:
    /*
     * N.b. UNICODE_STRING counts the length by the BYTE count, not by the character count.
     * Our APIs always treat the strings by the character count. Thus, for RIDI_DEVICNAME
     * only, cbOutSize holds the character count, not the byte count, in spite of its
     * name. Confusing, but cch is the way to be consistent.
     */
    cbOutSize = pDeviceInfo->ustrName.Length / sizeof(WCHAR) + 1;   // for Null terminator
    break;

   //...
}

required cbOutSize compared with cbBufferSize = *pcbSize;

and if (cbBufferSize >= cbOutSize) api begin copy operation

exist next code

            case RIDI_DEVICENAME:
                if (cbOutSize <= 2) { // !!!! error !!!!
                    retval = -1;
                    goto leave;
                }
                RtlCopyMemory(pData, pDeviceInfo->ustrName.Buffer, pDeviceInfo->ustrName.Length);
                ((WCHAR*)pData)[1] = '\\'; // convert nt prefix ( \??\ ) to win32 ( \\?\ )
                ((WCHAR*)pData)[cbOutSize - 1] = 0; // make it null terminated
                break;

cbOutSize here - is (len + 1) of device name (which we not control). so if name is zero length - always -1 is returned (error #1) but last error not set ( error #2 ) of course exist and error #3 - why is device name is 0 length ? this must not be. but in case terminal service devices - (virtual mouse/ keyboard device created on UMB bus ) - exist this result.

full code for api ( in kernel)

UINT NtUserGetRawInputDeviceInfo(
    HANDLE hDevice,
    UINT uiCommand,
    LPVOID pData,
    PUINT pcbSize)
{
    UINT cbOutSize = 0;
    UINT cbBufferSize;
    int retval = 0;

    EnterCrit(0, UserMode);
    UserAtomicCheck uac;

    try {
        ProbeForRead(pcbSize, sizeof(UINT), sizeof(DWORD));
        cbBufferSize = *pcbSize;
    } except (EXCEPTION_EXECUTE_HANDLER) {
       UserSetLastError(RtlNtStatusToDosError(GetExceptionCode()));// ERROR_NOACCESS    
       retval = -1;
       goto leave1;
    }

    EnterDeviceInfoListCrit_();

    PDEVICEINFO pDeviceInfo = HMValidateHandle(hDevice, TYPE_DEVICEINFO);

    if (pDeviceInfo == NULL) {
        UserSetLastError(ERROR_INVALID_HANDLE); 
        retval = -1;
        goto leave;
    }

    /*
     * Compute the size of the output and evaluate the uiCommand.
     */
    switch (uiCommand) {
    case RIDI_PREPARSEDDATA:
        if (pDeviceInfo->type == DEVICE_TYPE_HID) {
            cbOutSize = pDeviceInfo->hid.pHidDesc->hidCollectionInfo.DescriptorSize;
        } else {
            cbOutSize = 0;
        }
        break;
    case RIDI_DEVICENAME:
        /*
         * N.b. UNICODE_STRING counts the length by the BYTE count, not by the character count.
         * Our APIs always treat the strings by the character count. Thus, for RIDI_DEVICNAME
         * only, cbOutSize holds the character count, not the byte count, in spite of its
         * name. Confusing, but cch is the way to be consistent.
         */
        cbOutSize = pDeviceInfo->ustrName.Length / sizeof(WCHAR) + 1;   // for Null terminator
        break;

    case RIDI_DEVICEINFO:
        cbOutSize = sizeof(RID_DEVICE_INFO);
        break;

    default:
        UserSetLastError(ERROR_INVALID_PARAMETER);  
        retval = -1;
        goto leave;
    }

    if (pData == NULL) {
        /*
         * The app wants to get the required size.
         */
        try {
            ProbeForWrite(pcbSize, sizeof(UINT), sizeof(DWORD));
            *pcbSize = cbOutSize;
        } except (EXCEPTION_EXECUTE_HANDLER) {
            UserSetLastError(RtlNtStatusToDosError(GetExceptionCode()));// ERROR_NOACCESS   
            retval = -1;
            goto leave;
        }
        retval = 0;
    } else {
        if (cbBufferSize >= cbOutSize) {
            try {
                ProbeForWrite(pData, cbBufferSize, sizeof(DWORD));
                switch (uiCommand) {
                case RIDI_PREPARSEDDATA:
                    if (pDeviceInfo->type == DEVICE_TYPE_HID) {
                        RtlCopyMemory(pData, pDeviceInfo->hid.pHidDesc->pPreparsedData, cbOutSize);
                    }
                    break;

                case RIDI_DEVICENAME:
                    if (cbOutSize <= 2) { // !!!!
                        retval = -1;
                        goto leave;
                    }
                    RtlCopyMemory(pData, pDeviceInfo->ustrName.Buffer, pDeviceInfo->ustrName.Length);
                    ((WCHAR*)pData)[1] = '\\'; // make it null terminated
                    ((WCHAR*)pData)[cbOutSize - 1] = 0; // make it null terminated
                    break;

                case RIDI_DEVICEINFO:
                    {
                        PRID_DEVICE_INFO prdi = (PRID_DEVICE_INFO)pData;

                        ProbeForRead(prdi, sizeof(UINT), sizeof(DWORD));
                        if (prdi->cbSize != cbOutSize) {
                            MSGERRORCLEANUP(ERROR_INVALID_PARAMETER);
                        }
                        ProbeForWrite(prdi, sizeof(RID_DEVICE_INFO), sizeof(DWORD));
                        RtlZeroMemory(prdi, sizeof(RID_DEVICE_INFO));
                        prdi->cbSize = cbOutSize;

                        switch (pDeviceInfo->type) {
                        case DEVICE_TYPE_HID:
                            prdi->dwType = RIM_TYPEHID;
                            prdi->hid.dwVendorId = pDeviceInfo->hid.pHidDesc->hidCollectionInfo.VendorID;
                            prdi->hid.dwProductId = pDeviceInfo->hid.pHidDesc->hidCollectionInfo.ProductID;
                            prdi->hid.dwVersionNumber = pDeviceInfo->hid.pHidDesc->hidCollectionInfo.VersionNumber;
                            prdi->hid.usUsagePage = pDeviceInfo->hid.pHidDesc->hidpCaps.UsagePage;
                            prdi->hid.usUsage = pDeviceInfo->hid.pHidDesc->hidpCaps.Usage;
                            break;

                        case DEVICE_TYPE_MOUSE:
                            prdi->dwType = RIM_TYPEMOUSE;
                            prdi->mouse.dwId = pDeviceInfo->mouse.Attr.MouseIdentifier;
                            prdi->mouse.dwNumberOfButtons = pDeviceInfo->mouse.Attr.NumberOfButtons;
                            prdi->mouse.dwSampleRate = pDeviceInfo->mouse.Attr.SampleRate;
                            break;

                        case DEVICE_TYPE_KEYBOARD:
                            prdi->dwType = RIM_TYPEKEYBOARD;
                            prdi->keyboard.dwType = GET_KEYBOARD_DEVINFO_TYPE(pDeviceInfo);
                            prdi->keyboard.dwSubType = GET_KEYBOARD_DEVINFO_SUBTYPE(pDeviceInfo);
                            prdi->keyboard.dwKeyboardMode = pDeviceInfo->keyboard.Attr.KeyboardMode;
                            prdi->keyboard.dwNumberOfFunctionKeys = pDeviceInfo->keyboard.Attr.NumberOfFunctionKeys;
                            prdi->keyboard.dwNumberOfIndicators = pDeviceInfo->keyboard.Attr.NumberOfIndicators;
                            prdi->keyboard.dwNumberOfKeysTotal = pDeviceInfo->keyboard.Attr.NumberOfKeysTotal;
                            break;
                        }
                    }
                    break;

                default:
                    __assume(false);
                }
            } except (EXCEPTION_EXECUTE_HANDLER) {
                UserSetLastError(RtlNtStatusToDosError(GetExceptionCode()));// ERROR_NOACCESS   
                retval = -1;
                goto leave;
            }
            retval = cbOutSize;
        } else {
            /*
             * The buffer size is too small.
             * Returns error, storing the required size in *pcbSize.
             */
            retval = -1;
            try {
                ProbeForWrite(pcbSize, sizeof(UINT), sizeof(DWORD));
                *pcbSize = cbOutSize;
                UserSetLastError(ERROR_INSUFFICIENT_BUFFER);
            } except (EXCEPTION_EXECUTE_HANDLER) {
                UserSetLastError(RtlNtStatusToDosError(GetExceptionCode()));// ERROR_NOACCESS   
                retval = -1;
                goto leave;
            }
        }
    }

leave:
    LeaveDeviceInfoListCrit_();
leave1:
    UserSessionSwitchLeaveCrit();

    return retval;
}

then GetRawInputDeviceInfoA add additional errors compare GetRawInputDeviceInfoW - the value from *pcbSize by some reason multiple on 2. but again - this error in all case. note that DeviceName (formatted from strings returned from driver on IRP_MN_QUERY_ID have very strict restrictions:

If a driver returns an ID with an illegal character, the system will bug check. Characters with the following values are illegal in an ID for this IRP:

• Less than or equal to 0x20 (' ')
• Greater than 0x7F
• Equal to 0x2C (',')

so even after covert unicode to ansi - length of device name will be the same ( all symbols < 0x80 ). so not need *2 buffer size for Ansi version.

---

then i already view error in your code - you call ::GetLastError(); unconditionally after GetRawInputDeviceInfoW - but returned value have sense only in case api return -1

explain for observed behavior:

for local devices api in general work correct (if no mistakes in our code) for terminal service devices - was 0 length ustrName. as result if we pass NULL in pData - return value will be

pDeviceInfo->ustrName.Length / sizeof(WCHAR) + 1;

because pDeviceInfo->ustrName.Length == 0 - 1 will be returned inside *pcbSize in case A version - -by mistake - 2*1==2 will be returned. but when e pass not NULL in pData - we trap in this

            if (cbOutSize <= 2) { // !!!! error !!!!
                retval = -1;
                goto leave;
            }

so you can pass any by size buffer, anyway, because (cbOutSize <= 2) - -1 will be returned and last error not set

---

possible solution - at first - never use ansi version - GetRawInputDeviceInfoA

use this wrapper function.

ULONG GetRawInputDeviceInfoExW(_In_opt_ HANDLE hDevice, 
                               _In_ UINT uiCommand, 
                               _Inout_updates_bytes_to_opt_(*pcbSize, *pcbSize) LPVOID pData, 
                               _Inout_ PUINT pcbSize)
{
    switch (int i = GetRawInputDeviceInfoW(hDevice, uiCommand, pData, pcbSize))
    {
    case 0:
        return ERROR_INSUFFICIENT_BUFFER;
    case 1:
        return ERROR_INVALID_NAME;
    default:
        if (0 > i)
        {
            return GetLastError();
        }
        *pcbSize = i;

        return NOERROR;
    }
}

example of usage: (/RTCs must be disabled )

void Demo()
{
    PRAWINPUTDEVICELIST pRawInputDeviceList = 0;
    UINT uiNumDevices = 0; 
    UINT cch, cchAllocated = 0;
    union {
        PVOID buf;
        PWSTR name;
    };

    buf = 0;

    while (0 <= (int)GetRawInputDeviceList(pRawInputDeviceList, &uiNumDevices, sizeof(RAWINPUTDEVICELIST)))
    {
        if (pRawInputDeviceList)
        {
            do 
            {
                HANDLE hDevice = pRawInputDeviceList->hDevice;

                ULONG dwError;
                while (ERROR_INSUFFICIENT_BUFFER == (dwError = 
                    GetRawInputDeviceInfoExW(hDevice, RIDI_DEVICENAME, name, &(cch = cchAllocated))))
                {
                    if (cch > cchAllocated)
                    {
                        cchAllocated = RtlPointerToOffset(buf = alloca((cch - cchAllocated) * sizeof(WCHAR)), 
                            pRawInputDeviceList) / sizeof(WCHAR);
                    }
                    else
                    {
                        __debugbreak();
                    }
                }

                if (dwError == NOERROR)
                {
                    DbgPrint("[%p, %x %S]\n", hDevice, pRawInputDeviceList->dwType, name);
                }
                else
                {
                    DbgPrint("error = %u\n", dwError);
                }

            } while (pRawInputDeviceList++, --uiNumDevices);

            break;
        }
        pRawInputDeviceList = (PRAWINPUTDEVICELIST)alloca(uiNumDevices * sizeof(RAWINPUTDEVICELIST));
    }
}