Code Analysis for Drivers Warnings
This section lists and describes the warnings that the Code Analysis for Drivers reports when it detects a possible error in driver code. Note that some warnings are intended for kernel-mode code and can be ignored when analyzing user-mode drivers.
Code Analysis for Drivers reports the following types of warnings:
General Warnings (6000-6999): Potential errors in C and C++ syntax and general coding practice. For a description of these warnings, see Code Analysis for C/C++ Warnings.
Windows Specific Warnings (28600-28799): These warnings are specific to certain patterns of use in Windows, but are not specific to drivers.
Driver-Specific Warnings (28100-28199): Errors in a driver's interaction with the application, with other drivers, and with the operating system.
Annotation Errors (28200-28299 and 36000-36999): These warnings indicate that an annotation has been incorrectly coded or used in an improper context. In most cases, the presence of such a warning indicates that the annotation is not having the desired (or any) effect.
Memory Allocation Warnings (30029-30035): These are memory allocation warnings.
In this section
| Topic | Description |
|---|---|
warning C28101: The Drivers module has inferred that the current function is not the correct type of function |
|
warning C28110: Drivers must protect floating-point hardware state. See use of float |
|
warning C28111: The IRQL where the floating-point state was saved does not match the current IRQL (for this restore operation). |
|
warning: C28114: Copying a whole IRP stack entry leaves certain fields initialized that should be cleared or updated. |
|
warning C28120: The function is not permitted to be called at the current IRQ level. The current level is too low. |
|
warning C28121: The function is not permitted to be called at the current IRQ level. The current level is too high. |
|
warning C28122: The function is not permitted to be called at a low IRQ level. Prior function calls are inconsistent with this constraint. |
|
warning C28123: The function is not permitted to be called at a high IRQ level. Prior function calls are inconsistent with this constraint. |
|
warning C28124: The call to causes the IRQ Level to be set below the minimum acceptable for the function being analyzed. |
|
warning C28126: The AccessMode parameter to ObReferenceObject* should be IRP->RequestorMode |
|
warning C28127: The function being used as a routine does not exactly match the type expected. |
|
warning C28128: An access to a field has been made directly. It should be made by a routine. |
|
warning C28129: An assignment has been made to an operand, which should only be modified using bit sets and clears |
|
warning C28131: The DriverEntry routine should save a copy of the argument, not the pointer, because the I/O Manager frees the buffer |
|
warning C28132: Taking the size of pointer |
|
warning C28133: IoInitializeTimer is best called from AddDevice |
|
warning C28134: The type of a pool tag should be integral, not a string or string pointer |
|
warning C28135: If the first argument to KeWaitForSingleObject is a local variable, the Mode parameter must be KernelMode |
|
warning C28139: The argument should exactly match the type |
|
warning C28141: The argument causes the IRQ Level to be set below the current IRQL, and this function cannot be used for that purpose |
|
warning C28143: A dispatch routine that calls IoMarkIrpPending must also return STATUS_PENDING |
|
warning C28144: Within a cancel routine, at the point of exit, the IRQL in Irp->CancelIrql should be the current IRQL. |
|
warning C28145: The opaque MDL structure should not be modified by a driver |
|
warning C28146: Kernel Mode drivers should use ntstrsafe.h, not strsafe.h. Found in source file |
|
warning C28147: The use of a default pool tag (' kdD' or ' mdW') for calls to this function defeats the purpose of pool tagging |
|
warning C28150: The function causes the IRQ Level to be set above the maximum acceptable for the function being analyzed |
|
warning C28151: The value is not a legal value for an IRQL |
|
warning C28152: The return from an AddDevice-like function unexpectedly DO_DEVICE_INITIALIZING |
|
warning C28153: The value for an IRQL from annotation could not be evaluated in this context. |
|
warning C28156: The actual IRQL is inconsistent with the required IRQL |
|
warning C28157: The IRQL was never restored |
|
warning C28158: No IRQL was saved |
|
warning C28161: Exiting without acquiring the right to use floating hardware |
|
warning C28162: Exiting while holding the right to use floating-point hardware |
|
warning C28165: The function pointer of class does not match the function class |
|
warning C28166: The function does not restore the IRQL to the value that was current at function entry and is required to do so. |
|
warning C28167: The function changes the IRQL and does not restore the IRQL before it exits. It should be annotated to reflect the change or the IRQL should be restored. |
|
warning C28168: The dispatch function does not have a Dispatch_type annotation matching this dispatch table entry |
|
warning C28169: The dispatch function does not have any Dispatch_type annotations |
|
warning C28170: The function has been declared to be in a paged segment, but neither PAGED_CODE nor PAGED_CODE_LOCKED was found |
|
warning C28171: The function has more than one instance of PAGED_CODE or PAGED_CODE_LOCKED |
|
warning C28172: The function has PAGED_CODE or PAGED_CODE_LOCKED but is not declared to be in a paged segment |
|
warning C28173: The current function appears to incorrectly adapt to physical memory above 4 GB |
|
warning C28175: The member of struct should not be accessed by a driver |
|
warning C28176: The member of struct should not be modified by a driver |
|
warning C28177: Function is annotated with more than one function class. All but one will be ignored. |
|
warning C28260: A syntax error in the annotations was found while parsing for a property inside a function |
|
A syntax error in the annotations was found for the property in the function. |
|
warning C28268: The function class on the function does not match the function class on the typedef used here |
|
warning C28601: Avoid blocking on HWND_BROADCAST |
|
warning C28602: Avoid calling SendMessageTimeout with HWND_BROADCAST |
|
warning C28604: Avoid calling SendMessageTimeout with SMTO_ABORTIFHUNG with a timeout of 0 |
|
warning C28615: Must call _resetstkoflw in the __except() block when calling _alloca in the __try block. Don't call _resetstkoflw from inside a catch() block |
|
warning C28616: Multithreaded AV condition |
|
warning C28617: Avoid using the return value of _beginthread(). Use _beginthreadex() instead |
|
warning C28623: Unsigned cast of GetMessagePos() coordinates. Use GET_X_LPARAM/GET_Y_LPARAM instead of LOWORD/HIWORD |
|
warning C28624: No call to Release() to match incremented refcount from LResultFromObject |
|
warning C28625: Function call used to clear sensitive data will be optimized away |
|
warning C28636: Calling LocalFree on non-allocated pointer obtained from calls to GetSecurityDescriptorOwner/Group/Dacl/Sacl |
|
warning C28637: Calling the function in a global initializer is unsafe |
|
warning C28638: function delayload stub is missing a matching declaration |
|
warning C28639: Calling close handle with string |
|
warning C28640: function delayload stub should be a static function |
|
warning C28644: Return value from DPA_InsertPtr not checked |
|
warning C28645: MessageBox was called using the question mark message symbol which is no longer recommended |
|
warning C28648: PulseEvent is an unreliable function |
|
warning C28649: Automatic or Global Stack Arrays are never NULL |
|
warning C28650: The type for which !0 is being used does not treat it as failure case. Returning a status value such as !TRUE is not the same as returning a status value that indicates failure. |
|
warning C28651: Static initializer causes copy on write pages due to member function pointers |
|
warning C28652: Static initializer causes copy on write pages due to overloaded bitwise operators |
|
warning C28714: Cast between semantically different integer types |
|
warning C28715: Cast between semantically different integer types |
|
warning C28716: Compiler-inserted cast between semantically different integral types |
|
warning C28717: Invalid VARIANT type |
|
warning C28718: Unannotated buffer |
|
warning C28719: Banned API Usage |
|
warning C28720: Banned API Usage |
|
warning C28721: Deprecated performance counter architecture |
|
warning C28722: Unannotated buffer in function declaration |
|
warning C28723: Unannotated buffer in function definition that has no corresponding declaration |
|
warning C28725: Use Watson instead of this SetUnhandledExceptionFilter |
|
warning C28726: Banned API Usage |
|
warning C28727: Banned API Usage |
|
warning C28728: Banned API Usage |
|
warning C28730: Possible assignment of '\0' directly to a pointer. |
|
warning C28735: Banned Crimson API Usage |
|
warning C28736: Banned API Argument Usage |
|
warning C28740: Unannotated unsigned buffer |
|
warning C28741: Unannotated buffer in the function |
|
warning C28742: Unannotated buffer in the function |
|
warning C28750: Banned usage of lstrlen and its variants |
|
warning C28751: Banned usage of ExAllocatePool and its variants |
|
warning C28752: Banned usage of kernel32 or advapi32 API |
|
warning C28753: Relying on undefined order of evaluation of parameters |
|
warning C30029: Calling a memory allocating function that requests executable memory |
|
warning C30030: Calling a memory allocating function and passing a parameter that indicates executable memory |
|
warning C30031: Calling a memory allocating function and passing a parameter that indicates executable memory |
|
warning C30032: Calling a memory allocating function and forcing the request of executable memory through use of the POOL_NX_OPTOUT directive |
|
warning C30033: Executable allocation was detected in a driver compiled with POOL_NX_OPTIN. This driver has been determined to be loaded at run time by another driver. Please verify that the loading driver calls ExInitializeDriverRuntime(DrvRtPoolNxOptIn) in its DriverEntry. |
|
warning C30034: Passing a flag value to an allocating function that could result in executable memory being allocated. Please verify that the allocating function is not requesting a form of executable nonpaged pool. |
|
warning C30035: A call was made to a function that must be made from inside the initialization function (for example, DriverEntry() or DllInitialize()). PREfast was unable to determine if the call was made from the initialization function. |
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for