title: Why I got crash when allocating buffer?
body: <p>I am developing a driver with Filter. So when I write the <code>SendNetBufferListsComplete</code> function in <code>filter.cpp</code> I got a crash (bluescreen). WinDbug pointed to some buffer allocation. The code is here:</p>
  
  <p><strong>Edited:</strong></p>
  
  <pre><code>sendNetBufferListsComplete(
      IN PNET_BUFFER_LIST NetBufferLists,
      IN ULONG SendCompleteFlags) {
  
      PNET_BUFFER_LIST pNetBufferList = NetBufferLists;
      PNET_BUFFER_LIST pNextNetBufferList = NULL;
  
      while (pNetBufferList) 
      {
          pNextNetBufferList = NET_BUFFER_LIST_NEXT_NBL(pNetBufferList);
          NET_BUFFER_LIST_NEXT_NBL(pNetBufferList) = NULL;
          PNET_BUFFER_LIST pParentNetBufferList = pNetBufferList-&gt;ParentNetBufferList;
  
          if (pParentNetBufferList != NULL)
          {
              NDIS_STATUS status = NET_BUFFER_LIST_STATUS(pNetBufferList);
              NdisFreeNetBufferList(pNetBufferList);
  
              if (NdisInterlockedDecrement(&amp;pParentNetBufferList-&gt;ChildRefCount) == 0) {
                  NET_BUFFER_LIST_STATUS(pParentNetBufferList) = status;
                  NdisFSendNetBufferListsComplete(m_hFilter, pParentNetBufferList, SendCompleteFlags);
              }
          }
          else
          {
              if(pNetBufferList != NULL) 
              {
                  **---windbug pointed here---****
  
                  PVOID pBuffer = *(PVOID*) NET_BUFFER_LIST_CONTEXT_DATA_START(pNetBufferList);
  
                  PMDL pMdl = NET_BUFFER_FIRST_MDL(NET_BUFFER_LIST_FIRST_NB(pNetBufferList));
  
                  if(pMdl)
                      NdisFreeMdl(pMdl);
  
                  if(pBuffer)
                      delete[] (UCHAR*) pBuffer;
  
                  NdisFreeNetBufferList(pNetBufferList);                
              }
          }
  
          NdisInterlockedDecrement(&amp;m_nSendNetBufferListCount);
          pNetBufferList = pNextNetBufferList;
      }
  </code></pre>
  
  <p>What is the actual problem? Is it overflow? Or NULL check problems? </p>
  
  <p>In <code>ndish.h</code></p>
  
  <pre><code>#define NET_BUFFER_LIST_CONTEXT_DATA_START(_NBL)    ((PUCHAR)(((_NBL)-&gt;Context)+1)+(_NBL)-&gt;Context-&gt;Offset)
  </code></pre>
  
  <p>like this . and in Wdm.h</p>
  
  <pre><code>//
  // I/O system definitions.
  //
  // Define a Memory Descriptor List (MDL)
  //
  // An MDL describes pages in a virtual buffer in terms of physical pages.  The
  // pages associated with the buffer are described in an array that is allocated
  // just after the MDL header structure itself.
  //
  typedef
      _Struct_size_bytes_(_Inexpressible_(sizeof(struct _MDL) +    // 747934
         (ByteOffset + ByteCount + PAGE_SIZE-1) / PAGE_SIZE * sizeof(PFN_NUMBER)))
    struct _MDL {
      struct _MDL *Next;
      CSHORT Size;
      CSHORT MdlFlags;
  
      struct _EPROCESS *Process;
      PVOID MappedSystemVa;   /* see creators for field size annotations. */
      PVOID StartVa;   /* see creators for validity; could be address 0.  */
      ULONG ByteCount;
      ULONG ByteOffset;
  } MDL, *PMDL;
  </code></pre>