I wrote a c++ dll in QT using mingw 64 bit. It has a function that takes a void * argument because the data passed in varies depending on some other fields. When I call this function passing in a pointer to a struct, the program always crashes trying to access fields. I have tried to access the data both using the same struct as a pointer, and by using base data type pointers like unsigned char *. Here is some example code:

typedef struct
{
    unsigned long Parameter;
    unsigned long Value;
} SCONFIG;

typedef struct
{
    unsigned long NumOfParams;
    SCONFIG *ConfigPtr;
} SCONFIG_LIST;

void doIoControl()
{
    SCONFIG ConfigParameter;



    SCONFIG_LIST ConfigList;

    ConfigParameter.Parameter = 0x8000;

    ConfigParameter.Value = 1;
    ConfigList.NumOfParams = 1;
    ConfigList.ConfigPtr = &ConfigParameter;
    PassThruIoctl(2, 2, &ConfigList, (void *)NULL);
}

Now the dll function definition:

Q_DECL_EXPORT long PassThruIoctl(unsigned long, unsigned long, void *, void *);

Function body:

long PassThruIoctl(unsigned long deviceId, unsigned long item, void * input, void * output){



    QFile f = QFile("PassThruIoctl.txt");
    f.open(QIODevice::WriteOnly);

    QString s = "In IO ctrl deviceid " + QString::number(deviceId) + " item " + QString::number(item) + "rn";
    f.write(s.toLocal8Bit());
    f.flush();

    unsigned char *p = (unsigned char*)input;

    s = "0x";
    for(int i=0; i<8; ++i){
        s += QString::number((int)p[i],16) + " ";
    }
    s+="rn";
    f.write(s.toLocal8Bit());
    f.flush();

    unsigned long *l = (unsigned long*)input;

    int numofparams = *l;
    s = "from dword cast number of params: " + QString::number(*l) +"rn";
    f.write(s.toLocal8Bit());
    f.flush();

    p = (unsigned char*)input;
    p+=4;

    l = (unsigned long*)p;
    long addr = *l;

    s = "read address as: " + QString::number(addr,16) +"rn";
    f.write(s.toLocal8Bit());
    f.flush();

    unsigned long *pointerToObj = (unsigned long*)addr;
    long nVal = *pointerToObj;

    s = "from long pointer, param: " +QString::number(nVal,16) +"rn";
    f.write(s.toLocal8Bit());
    f.flush();

    p = (unsigned char*)pointerToObj;
    p+=4;
    pointerToObj = (unsigned long*)p;
    nVal = *pointerToObj;
    s = "from long pointer, val: " +QString::number(nVal,16) +"rn";

    f.write(s.toLocal8Bit());
    f.flush();
}

The code here doesn’t do anything and is very hardcoded just to try to get this a working example first. The code always crashing with an access violation on the unsigned long pointerToObj = (unsigned long)addr; line. So it’s very weird that it can access some data but not all. It can’t follow the pointer inside the struct.

Also strange, I view the address of my struct passed in from the caller, and the lines to print out all the bytes and the address to my log are correct. The addresses match.

I have also tried access the data via a struct like so:

SCONFIG_LIST *cfgList = (SCONFIG_LIST*)input;
SCONFIG *cfg = cfgList->ConfigPtr;

This crashes as well.

Now for some pertinent details! This crash only occurs under one caller situation. I have a java application that calls a c++ native dll in windows, which in turn calls the dll I am having the issue with. So Java app calls native dll with function doIoControl, which then loads the PassThruIoctl function dynamically via getprocaddress, and calls it with the struct SCONFIG_LIST. For some reason I can access the NumOfParams and the value of the pointer to SCONFIG, as I output in my log the correct address. But then it crashes as soon as I try to access the data there.

When I made a QT gui app and linked this dll and called it there, it does not crash. I am trying to figure out why calling from another dll is crashing it. I thought perhaps it has something to do with the java caller and memory management, but native code is supposed to have its memory space managed by the OS, not the java heap.

I have not yet tried calling this function with dynamic points, ie

SCONFIG *ConfigParameter = new SCONFIG;
SCONFIG_LIST *ConfigList = new SCONFIG_LIST;
ConfigList->ConfigPtr = ConfigParameter;

I could try and see if that works. I have tried changing my function argument for input from void * to SCONFIG_LIST * but it gives the same result.