C30035

warning C30035: A call was made to a function that must be made from inside the initialization function (for example, DriverEntry() or DllInitialize()). PREfast was unable to determine if the call was made from the initialization function.

BANNED_MEM_ALLOCATION_MAYBE_BAD_CALL_SITE

The code was compiled with the POOL_NX_OPTIN macro but the initialization did not occur inside of DriverEntry() or DllInitialize(). To fix this, move the call inside of the initialization function.

Example

The following code generates this warning.

In the sources file:

C_DEFINES=$(C_DEFINES) -DPOOL_NX_OPTIN=1

NTSTATUS
DriverEntry (
    _In_ PDRIVER_OBJECT DriverObject,
    _In_ PUNICODE_STRING RegistryPath
    )
{
    NTSTATUS status;

    MakeSafeInitialization ();
…
}

void MakeSafeInitialization()
{
    ExInitializeDriverRuntime(DrvRtPoolNxOptIn);
}

The following code avoids this warning:

NTSTATUS
DriverEntry (
    _In_ PDRIVER_OBJECT DriverObject,
    _In_ PUNICODE_STRING RegistryPath
    )
{
    NTSTATUS status;

    ExInitializeDriverRuntime(DrvRtPoolNxOptIn);
…
}