oxc0000409 (stack buffer overflow) Microsoft::Applications::Events::time_ticks_t::time_ticks_t

[Fitzpasd]

We are hitting this error frequently. Our usage of the sdk hasn't changed since I opened #203, other than to disable the network detector as per our Teams convo.

[maxgolov]

@Fitzpasd - do you have a local repro of this issue? Searching WATSON for hits including time_ticks_t - I only see your process, not any other app or service using 1DS C++ SDK. No hits in Office nor Edge, which generate considerably larger (x100+) traffic volumes.

[maxgolov]

Memory Corruption

Stack seems to be corrupted. The issue that leads to stack corruption may not necessarily be in the SDK. time_ticks_t on stack does not give much clues at this point.

Given you turned off the Network Detector --- ILogManager::DispatchEventBroadcast(evt) , appears on stack, may be called if you specify event type or event property name that does not conform to regexp here:

cpp_client_telemetry/lib/utils/Utils.cpp

Line 177 in 780205d

// Data collector uses this regex (avoided here for code size reasons):

The checks are performed here:

cpp_client_telemetry/lib/system/EventProperties.cpp

Line 261 in 1e3c612

ILogManager::DispatchEventBroadcast(evt);

And here:

cpp_client_telemetry/lib/system/EventProperties.cpp

Line 290 in 1e3c612

ILogManager::DispatchEventBroadcast(evt);

This may happen because of memory corruption from elsewhere, i.e. you expect that you pass valid property name or type, but in fact the buffer passed to SDK is already corrupted.

Note the stack trace does not make much sense, so it might be a red herring entirely.

Configuration

Since your code is running in a system service, it's worthwhile checking that you're using UTC transport. I see where you perform MAE::LogManager::Initialize call, but I don't see where you're initializing it in UTC mode. To initialize UTC mode - means using UTC background telemetry service instead of WinInet running in proc, you have to add this BEFORE you initialize:

    auto configuration = LogManager::GetLogConfiguration();
    configuration[CFG_INT_SDK_MODE] = SdkModeTypes::SdkModeTypes_UTCCommonSchema;

Currently running in direct upload mode inside a system service context (is xboxappservices.exe a system service?) -- isn't supported. WinInet.dll (our default http stack) is not supported for use in a system service context. There are known issues with that - see #322. You have to use Win 10 UTC mode for system services. That layer is sampling by default all of your events at 1-2%. But there are some further options to adjust your sampling rates at system-level. Windows Health DL can help with adjusting those sampling rates.