Microsoft VC++, vsnprintf, and Pipes (IO) Bug

>我正在使用DLL注入来启动文件管道的客户端，该文件管道与记录消息的服务器通信。问题是服务器只收到一个填充有问号 ('？'( 字符的缓冲区。

客户端/可注入 DLL：

#include <windows.h> 
#include <stdio.h> 
#include <tchar.h>
#include <strsafe.h>
#define BUFSIZE 1024*1024
HANDLE hPipe;
BOOL   fSuccess = FALSE;
DWORD  cbToWrite, cbWritten, dwMode;
const wchar_t* lpszPipename = TEXT("\\.\pipe\listen");
char write_buffer[BUFSIZE];
void init()
{
hPipe = CreateFile(
lpszPipename,   // pipe name 
GENERIC_READ |  // read and write access 
GENERIC_WRITE,
0,              // no sharing 
NULL,           // default security attributes
OPEN_EXISTING,  // opens existing pipe 
0,              // default attributes 
NULL);          // no template file 
// The pipe connected; change to message-read mode. 
dwMode = PIPE_READMODE_MESSAGE;
fSuccess = SetNamedPipeHandleState(
hPipe,    // pipe handle 
&dwMode,  // new pipe mode 
NULL,     // don't set maximum bytes 
NULL);    // don't set maximum time 
}
#pragma warning(disable:4996)
void report(const char* frmt, ...)
{
va_list args;
va_start(args, frmt);
vsnprintf(write_buffer, BUFSIZE, frmt, args);
va_end(args);
// Send a message to the pipe server. 
fSuccess = WriteFile(
hPipe,                  // pipe handle 
write_buffer,             // message 
strlen(write_buffer),              // message length 
&cbWritten,             // bytes written 
NULL);                  // not overlapped 
return;
}

服务器：

#include <windows.h> 
#include <stdio.h> 
#include <tchar.h>
#include <strsafe.h>
#define BUFSIZE 1024*1024
BOOL   fConnected = FALSE;
DWORD  dwThreadId = 0;
HANDLE hPipe = INVALID_HANDLE_VALUE, hThread = NULL;
const wchar_t* lpszPipename = TEXT("\\.\pipe\listen");
// The main loop creates an instance of the named pipe and 
// then waits for a client to connect to it. When the client 
// connects, a thread is created to handle communications 
// with that client, and this loop is free to wait for the
// next client connect request. It is an infinite loop.
for (;;)
{
_tprintf(TEXT("nPipe Server: Main thread awaiting client connection on %sn"), lpszPipename);
hPipe = CreateNamedPipe(
lpszPipename,             // pipe name 
PIPE_ACCESS_DUPLEX,       // read/write access 
PIPE_TYPE_MESSAGE |       // message type pipe 
PIPE_READMODE_MESSAGE |   // message-read mode 
PIPE_WAIT,                // blocking mode 
PIPE_UNLIMITED_INSTANCES, // max. instances  
BUFSIZE,                  // output buffer size 
BUFSIZE,                  // input buffer size 
0,                        // client time-out 
NULL);                    // default security attribute 
if (hPipe == INVALID_HANDLE_VALUE)
{
_tprintf(TEXT("CreateNamedPipe failed, GLE=%d.n"), GetLastError());
return -1;
}
// Wait for the client to connect; if it succeeds, 
// the function returns a nonzero value. If the function
// returns zero, GetLastError returns ERROR_PIPE_CONNECTED. 
fConnected = ConnectNamedPipe(hPipe, NULL) ?
TRUE : (GetLastError() == ERROR_PIPE_CONNECTED);
if (fConnected)
{
printf("Client connected, creating a processing thread.n");
// Create a thread for this client. 
hThread = CreateThread(
NULL,              // no security attribute 
0,                 // default stack size 
InstanceThread,    // thread proc
(LPVOID)hPipe,    // thread parameter 
0,                 // not suspended 
&dwThreadId);      // returns thread ID 
if (hThread == NULL)
{
_tprintf(TEXT("CreateThread failed, GLE=%d.n"), GetLastError());
return -1;
}
else CloseHandle(hThread);
}
else
// The client could not connect, so close the pipe. 
CloseHandle(hPipe);
}
DWORD WINAPI InstanceThread(LPVOID lpvParam)
// This routine is a thread processing function to read from and reply to a client
// via the open pipe connection passed from the main loop. Note this allows
// the main loop to continue executing, potentially creating more threads of
// of this procedure to run concurrently, depending on the number of incoming
// client connections.
{
HANDLE hHeap = GetProcessHeap();
TCHAR* pchRequest = (TCHAR*)HeapAlloc(hHeap, 0, BUFSIZE * sizeof(TCHAR));
TCHAR* pchReply = (TCHAR*)HeapAlloc(hHeap, 0, BUFSIZE * sizeof(TCHAR));
DWORD cbBytesRead = 0, cbReplyBytes = 0, cbWritten = 0;
BOOL fSuccess = FALSE;
HANDLE hPipe = NULL;
// Print verbose messages. In production code, this should be for debugging only.
printf("InstanceThread created, receiving and processing messages.n");
// The thread's parameter is a handle to a pipe object instance. 
hPipe = (HANDLE)lpvParam;
// Loop until done reading
while (1)
{
// Read client requests from the pipe. This simplistic code only allows messages
// up to BUFSIZE characters in length.
fSuccess = ReadFile(
hPipe,        // handle to pipe 
pchRequest,    // buffer to receive data 
BUFSIZE,    // size of buffer 
&cbBytesRead, // number of bytes read 
NULL);        // not overlapped I/O 
// Process the incoming message.
_tprintf(TEXT("Client Request String:"%s"n"), pchRequest);
}
FlushFileBuffers(hPipe);
DisconnectNamedPipe(hPipe);
CloseHandle(hPipe);
HeapFree(hHeap, 0, pchRequest);
HeapFree(hHeap, 0, pchReply);
printf("InstanceThread exitting.n");
return 1;
}

附言如果有一些可能使用带有可注入 DLL 的调试器，请告诉我！