Merge pull request #58304 from adityamandaleeka/ancm_ca_changes_incr

Enable code analysis and address initial set of issues.

src/Servers/IIS/AspNetCoreModuleV2/AspNetCore/applicationinfo.cpp

@@ -301,7 +301,7 @@ APPLICATION_INFO::HandleShadowCopy(const ShimOptions& options, IHttpContext& pHt
         auto shadowCopyBaseDirectory = std::filesystem::directory_entry(shadowCopyPath);
         if (!shadowCopyBaseDirectory.exists())
         {
-            CreateDirectory(shadowCopyBaseDirectory.path().wstring().c_str(), NULL);
+            CreateDirectory(shadowCopyBaseDirectory.path().wstring().c_str(), nullptr);
         }
 
         for (auto& entry : std::filesystem::directory_iterator(shadowCopyPath))

src/Servers/IIS/AspNetCoreModuleV2/AspNetCore/dllmain.cpp

@@ -57,6 +57,7 @@ BOOL WINAPI DllMain(HMODULE hModule,
         // this is a bug in IIS. To try to avoid AVs, we will set a global flag
         g_fInShutdown = TRUE;
         StaticCleanup();
+        break;
     default:
         break;
     }

src/Servers/IIS/AspNetCoreModuleV2/CommonLib/Environment.cpp

@@ -168,7 +168,7 @@ void Environment::CopyToDirectoryInner(const std::filesystem::path& source, cons
     auto destinationDirEntry = std::filesystem::directory_entry(destination);
     if (!destinationDirEntry.exists())
     {
-        CreateDirectory(destination.wstring().c_str(), NULL);
+        CreateDirectory(destination.wstring().c_str(), nullptr);
     }
 
     for (auto& path : std::filesystem::directory_iterator(source))

src/Servers/IIS/AspNetCoreModuleV2/CommonLib/EventLog.cpp

@@ -36,11 +36,11 @@ EventLog::LogEventNoTrace(
         dwEventInfoType,
         0,        // wCategory
         dwEventId,
-        NULL,     // lpUserSid
+        nullptr,     // lpUserSid
         static_cast<WORD>(eventLogDataStrings.size()), // wNumStrings
         0,        // dwDataSize,
         eventLogDataStrings.data(),
-        NULL      // lpRawData
+        nullptr      // lpRawData
     );
 }
 

src/Servers/IIS/AspNetCoreModuleV2/CommonLib/GlobalVersionUtility.cpp

@@ -13,17 +13,17 @@ namespace fs = std::filesystem;
 std::wstring
 GlobalVersionUtility::GetGlobalRequestHandlerPath(PCWSTR pwzAspNetCoreFolderPath, PCWSTR pwzHandlerVersion, PCWSTR pwzHandlerName)
 {
-    if (pwzAspNetCoreFolderPath == NULL)
+    if (pwzAspNetCoreFolderPath == nullptr)
     {
         throw new std::invalid_argument("pwzAspNetCoreFolderPath is NULL");
     }
 
-    if (pwzHandlerVersion == NULL)
+    if (pwzHandlerVersion == nullptr)
     {
         throw new std::invalid_argument("pwzHandlerVersion is NULL");
     }
 
-    if (pwzHandlerName == NULL)
+    if (pwzHandlerName == nullptr)
     {
         throw new std::invalid_argument("pwzHandlerName is NULL");
     }
@@ -47,7 +47,7 @@ GlobalVersionUtility::GetGlobalRequestHandlerPath(PCWSTR pwzAspNetCoreFolderPath
 std::vector<fx_ver_t>
 GlobalVersionUtility::GetRequestHandlerVersions(PCWSTR pwzAspNetCoreFolderPath)
 {
-    if (pwzAspNetCoreFolderPath == NULL)
+    if (pwzAspNetCoreFolderPath == nullptr)
     {
         throw new std::invalid_argument("pwzAspNetCoreFolderPath is NULL");
     }
@@ -74,7 +74,7 @@ GlobalVersionUtility::GetRequestHandlerVersions(PCWSTR pwzAspNetCoreFolderPath)
 std::wstring
 GlobalVersionUtility::FindHighestGlobalVersion(PCWSTR pwzAspNetCoreFolderPath)
 {
-    if (pwzAspNetCoreFolderPath == NULL)
+    if (pwzAspNetCoreFolderPath == nullptr)
     {
         throw std::invalid_argument("pwzAspNetCoreFolderPath is NULL");
     }

src/Servers/IIS/AspNetCoreModuleV2/CommonLib/HostFxrResolver.cpp

@@ -400,8 +400,8 @@ HostFxrResolver::InvokeWhereToFindDotnet()
 {
     HRESULT             hr = S_OK;
     // Arguments to call where.exe
-    STARTUPINFOW        startupInfo = { 0 };
-    PROCESS_INFORMATION processInformation = { 0 };
+    STARTUPINFOW        startupInfo{};
+    PROCESS_INFORMATION processInformation{};
     SECURITY_ATTRIBUTES securityAttributes;
 
     CHAR                pzFileContents[READ_BUFFER_SIZE];
@@ -409,7 +409,7 @@ HostFxrResolver::InvokeWhereToFindDotnet()
     HandleWrapper<InvalidHandleTraits>     hStdOutWritePipe;
     HandleWrapper<InvalidHandleTraits>     hProcess;
     HandleWrapper<InvalidHandleTraits>     hThread;
-    CComBSTR            pwzDotnetName = NULL;
+    CComBSTR            pwzDotnetName = nullptr;
     DWORD               dwFilePointer;
     BOOL                fIsCurrentProcess64Bit;
     DWORD               dwExitCode;
@@ -423,7 +423,7 @@ HostFxrResolver::InvokeWhereToFindDotnet()
 
     // Set the security attributes for the read/write pipe
     securityAttributes.nLength = sizeof(securityAttributes);
-    securityAttributes.lpSecurityDescriptor = NULL;
+    securityAttributes.lpSecurityDescriptor = nullptr;
     securityAttributes.bInheritHandle = TRUE;
 
     LOG_INFO(L"Invoking where.exe to find dotnet.exe");
@@ -443,14 +443,14 @@ HostFxrResolver::InvokeWhereToFindDotnet()
     pwzDotnetName = L"\"where.exe\" dotnet.exe";
 
     // Create a process to invoke where.exe
-    FINISHED_LAST_ERROR_IF(!CreateProcessW(NULL,
+    FINISHED_LAST_ERROR_IF(!CreateProcessW(nullptr,
         pwzDotnetName,
-        NULL,
-        NULL,
+        nullptr,
+        nullptr,
         TRUE,
         CREATE_NO_WINDOW,
-        NULL,
-        NULL,
+        nullptr,
+        nullptr,
         &startupInfo,
         &processInformation
     ));
@@ -480,7 +480,7 @@ HostFxrResolver::InvokeWhereToFindDotnet()
 
     // Where succeeded.
     // Reset file pointer to the beginning of the file.
-    dwFilePointer = SetFilePointer(hStdOutReadPipe, 0, NULL, FILE_BEGIN);
+    dwFilePointer = SetFilePointer(hStdOutReadPipe, 0, nullptr, FILE_BEGIN);
     if (dwFilePointer == INVALID_SET_FILE_POINTER)
     {
         FINISHED_IF_FAILED(E_FAIL);
@@ -490,7 +490,7 @@ HostFxrResolver::InvokeWhereToFindDotnet()
     // As the call to where.exe succeeded (dotnet.exe was found), ReadFile should not hang.
     // TODO consider putting ReadFile in a separate thread with a timeout to guarantee it doesn't block.
     //
-    FINISHED_LAST_ERROR_IF (!ReadFile(hStdOutReadPipe, pzFileContents, READ_BUFFER_SIZE, &dwNumBytesRead, NULL));
+    FINISHED_LAST_ERROR_IF (!ReadFile(hStdOutReadPipe, pzFileContents, READ_BUFFER_SIZE, &dwNumBytesRead, nullptr));
 
     if (dwNumBytesRead >= READ_BUFFER_SIZE)
     {

src/Servers/IIS/AspNetCoreModuleV2/CommonLib/RegistryKey.cpp

@@ -18,7 +18,7 @@ std::optional<DWORD> RegistryKey::TryGetDWORD(HKEY section, const std::wstring&
 
 std::optional<std::wstring> RegistryKey::TryGetString(HKEY section, const std::wstring& subSectionName, const std::wstring& valueName)
 {
-    DWORD cbData;
+    DWORD cbData{};
 
     if (!CheckReturnValue(RegGetValue(section, subSectionName.c_str(), valueName.c_str(), RRF_RT_REG_SZ, nullptr, nullptr, &cbData)))
     {

src/Servers/IIS/AspNetCoreModuleV2/CommonLib/ServerErrorHandler.h

@@ -15,7 +15,7 @@ public:
         m_disableStartupPage(disableStartupPage),
         m_statusCode(statusCode),
         m_subStatusCode(subStatusCode),
-        m_statusText(std::move(statusText)),
+        m_statusText(statusText),
         m_ExceptionInfoContent(responseContent)
     {
     }

src/Servers/IIS/AspNetCoreModuleV2/CommonLib/StringHelpers.cpp

@@ -41,7 +41,7 @@ std::wstring to_wide_string(const std::string& source, const int length, const u
 
     std::wstring destination;
 
-    int nChars = MultiByteToWideChar(codePage, 0, source.data(), length, NULL, 0);
+    int nChars = MultiByteToWideChar(codePage, 0, source.data(), length, nullptr, 0);
     THROW_LAST_ERROR_IF(nChars == 0);
 
     destination.resize(nChars);

src/Servers/IIS/AspNetCoreModuleV2/CommonLib/debugutil.cpp

@@ -73,7 +73,7 @@ GetVersionInfoString()
     {
         DWORD  verHandle = 0;
         UINT   size = 0;
-        LPVOID lpBuffer = NULL;
+        LPVOID lpBuffer = nullptr;
 
         auto path = GetModuleName();
 
@@ -92,7 +92,7 @@ GetVersionInfoString()
             RETURN_IF_FAILED(E_FAIL);
         }
 
-        LPVOID pvProductName = NULL;
+        LPVOID pvProductName = nullptr;
         unsigned int iProductNameLen = 0;
         RETURN_LAST_ERROR_IF(!VerQueryValue(verData.data(), _T("\\StringFileInfo\\040904b0\\FileDescription"), &pvProductName, &iProductNameLen));
 
@@ -114,7 +114,7 @@ std::wstring
 GetModuleName()
 {
     WCHAR path[MAX_PATH];
-    LOG_LAST_ERROR_IF(!GetModuleFileName(g_hModule, path, sizeof(path)));
+    LOG_LAST_ERROR_IF(!GetModuleFileName(g_hModule, path, _countof(path)));
     return path;
 }
 
@@ -218,7 +218,7 @@ DebugInitialize(HMODULE hModule)
         cbData = sizeof(dwData);
         if ((RegQueryValueEx(hKey,
             L"DebugFlags",
-            NULL,
+            nullptr,
             &dwType,
             (LPBYTE)&dwData,
             &cbData) == NO_ERROR) &&
@@ -409,7 +409,10 @@ DebugPrintfW(
 
         hr = strCooked.SafeVsnwprintf(szFormat, args );
 
+#pragma warning(push)
+#pragma warning(disable: 26477) // va_end uses 0
         va_end( args );
+#pragma warning(pop)
 
         if (FAILED (hr))
         {
@@ -453,7 +456,10 @@ DebugPrintf(
 
         hr = strCooked.SafeVsnprintf(szFormat, args );
 
+#pragma warning(push)
+#pragma warning(disable: 26477) // va_end uses 0
         va_end( args );
+#pragma warning(pop)
 
         if (FAILED (hr))
         {

src/Servers/IIS/AspNetCoreModuleV2/CommonLib/file_utility.cpp

@@ -41,7 +41,7 @@ FILE_UTILITY::ConvertPathToFullPath(
 {
     HRESULT hr = S_OK;
     STRU strFileFullPath;
-    LPWSTR pszFullPath = NULL;
+    LPWSTR pszFullPath = nullptr;
 
     // if relative path, prefix with root path and then convert to absolute path.
     if ( PathIsRelative(pszPath) )
@@ -72,7 +72,7 @@ FILE_UTILITY::ConvertPathToFullPath(
 
     if(_wfullpath( pszFullPath,
                    strFileFullPath.QueryStr(),
-                   strFileFullPath.QueryCCH() + 1 ) == NULL )
+                   strFileFullPath.QueryCCH() + 1 ) == nullptr )
     {
         hr = HRESULT_FROM_WIN32( ERROR_INVALID_PARAMETER );
         goto Finished;
@@ -87,10 +87,10 @@ FILE_UTILITY::ConvertPathToFullPath(
 
 Finished:
 
-    if ( pszFullPath != NULL )
+    if ( pszFullPath != nullptr )
     {
         delete[] pszFullPath;
-        pszFullPath = NULL;
+        pszFullPath = nullptr;
     }
 
     return hr;

src/Servers/IIS/AspNetCoreModuleV2/CommonLib/sttimer.h

@@ -13,7 +13,7 @@ class STTIMER
 public:
 
     STTIMER()
-        : _pTimer( NULL )
+        : _pTimer( nullptr )
     {
         fInCanel = FALSE;
     }
@@ -25,7 +25,7 @@ public:
         {
             CancelTimer();
             CloseThreadpoolTimer( _pTimer );
-            _pTimer = NULL;
+            _pTimer = nullptr;
         }
     }
 
@@ -39,7 +39,7 @@ public:
     {
         _pTimer = CreateThreadpoolTimer( pfnCallback,
                                          pContext,
-                                         NULL );
+                                         nullptr );
 
         if ( !_pTimer )
         {
@@ -74,9 +74,9 @@ public:
             // re-enabled by setting non-zero initial wait or
             // period values.
             //
-            if (_pTimer != NULL)
+            if (_pTimer != nullptr)
             {
-                SetThreadpoolTimer(_pTimer, NULL, 0, 0);
+                SetThreadpoolTimer(_pTimer, nullptr, 0, 0);
             }
 
             return;
@@ -106,7 +106,7 @@ public:
         // Wait until any callbacks queued prior to disabling
         // have completed.
         //
-        if (_pTimer != NULL)
+        if (_pTimer != nullptr)
         {
             WaitForThreadpoolTimerCallbacks(_pTimer, TRUE);
         }
@@ -124,13 +124,13 @@ public:
     )
     {
         STRU*                   pstruLogFilePath = (STRU*)Context;
-        HANDLE                  hStdoutHandle = NULL;
+        HANDLE                  hStdoutHandle = nullptr;
         SECURITY_ATTRIBUTES     saAttr = { 0 };
         HRESULT                 hr = S_OK;
 
         saAttr.nLength = sizeof(SECURITY_ATTRIBUTES);
         saAttr.bInheritHandle = TRUE;
-        saAttr.lpSecurityDescriptor = NULL;
+        saAttr.lpSecurityDescriptor = nullptr;
 
         hStdoutHandle = CreateFileW(pstruLogFilePath->QueryStr(),
                                     FILE_READ_DATA,
@@ -138,7 +138,7 @@ public:
                                     &saAttr,
                                     OPEN_ALWAYS,
                                     FILE_ATTRIBUTE_NORMAL,
-                                    NULL);
+                                    nullptr);
         if (hStdoutHandle == INVALID_HANDLE_VALUE)
         {
             hr = HRESULT_FROM_WIN32(GetLastError());

src/Servers/IIS/AspNetCoreModuleV2/CommonLibTests/CommonLibTests.vcxproj

@@ -9,7 +9,7 @@
     <ProjectGuid>{1eac8125-1765-4e2d-8cbe-56dc98a1c8c1}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <ConfigurationType>Application</ConfigurationType>
-    <PlatformToolset>$(PlatformToolsetVersion)</PlatformToolset>
+    <PlatformToolset>v$(PlatformToolsetVersion)</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
     <IsTestProject>true</IsTestProject>
     <DisableArcadeTestFramework>true</DisableArcadeTestFramework>

src/Servers/IIS/AspNetCoreModuleV2/DefaultRules.ruleset

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<RuleSet Name="DefaultRules" ToolsVersion="15.0">
+<RuleSet Name="DefaultRules" ToolsVersion="17.0">
   <Include Path="allrules.ruleset" Action="Default" />
   <Rules AnalyzerId="Microsoft.Analyzers.NativeCodeAnalysis" RuleNamespace="Microsoft.Rules.Native">
     <Rule Id="C26100" Action="Error" />
@@ -12,14 +12,14 @@
     <Rule Id="C26116" Action="Error" />
     <Rule Id="C26117" Action="Error" />
     <Rule Id="C26130" Action="Error" />
-    <Rule Id="C26135" Action="Error" />
+    <Rule Id="C26135" Action="None" /> <!-- Missing annotation <annotation> at function '<func>' -->
     <Rule Id="C26140" Action="Error" />
-    <Rule Id="C26160" Action="Error" />
+    <Rule Id="C26160" Action="None" /> <!-- Caller possibly failing to hold lock '<lock>' before calling function '<func>'. -->
     <Rule Id="C26165" Action="Error" />
     <Rule Id="C26166" Action="Error" />
     <Rule Id="C26167" Action="Error" />
-    <Rule Id="C26400" Action="Error" />
-    <Rule Id="C26401" Action="Error" />
+    <Rule Id="C26400" Action="None" /> <!-- Do not assign the result of an allocation or a function call with an owner<T> return value to a raw pointer -->
+    <Rule Id="C26401" Action="None" /> <!-- Do not delete a raw pointer that is not an owner<T> -->
     <Rule Id="C26402" Action="Error" />
     <Rule Id="C26403" Action="Error" />
     <Rule Id="C26404" Action="Error" />
@@ -27,73 +27,82 @@
     <Rule Id="C26406" Action="Error" />
     <Rule Id="C26407" Action="Error" />
     <Rule Id="C26408" Action="Error" />
-    <Rule Id="C26409" Action="Error" />
+    <Rule Id="C26409" Action="None" /> <!-- Avoid calling new and delete explicitly, use std::make_unique<T> instead -->
     <Rule Id="C26410" Action="Error" />
     <Rule Id="C26411" Action="Error" />
-    <Rule Id="C26414" Action="Error" />
-    <Rule Id="C26415" Action="Error" />
+    <Rule Id="C26414" Action="None" /> <!-- Move, copy, reassign or reset a local smart pointer. -->
+    <Rule Id="C26415" Action="None" /> <!-- Smart pointer parameter is used only to access contained pointer. Use T* or T& instead. -->
     <Rule Id="C26416" Action="Error" />
     <Rule Id="C26417" Action="Error" />
-    <Rule Id="C26418" Action="Error" />
+    <Rule Id="C26418" Action="None" /> <!-- Shared pointer parameter is not copied or moved. Use T* or T& instead. -->
     <Rule Id="C26426" Action="Error" />
     <Rule Id="C26427" Action="Error" />
-    <Rule Id="C26429" Action="None" />
-    <Rule Id="C26430" Action="Error" />
+    <Rule Id="C26429" Action="None" /> <!-- Symbol is never tested for nullness, it can be marked as gsl::not_null. -->
+    <Rule Id="C26430" Action="None" /> <!-- Symbol '<var>' is not tested for nullness on all paths  -->
     <Rule Id="C26431" Action="Error" />
-    <Rule Id="C26432" Action="None" />
-    <Rule Id="C26433" Action="Error" />
-    <Rule Id="C26434" Action="Error" />
+    <Rule Id="C26432" Action="None" /> <!-- If you define or delete any default operation in the type 'type-name', define or delete them all -->
+    <Rule Id="C26433" Action="None" /> <!-- Function should be marked with override -->
+    <Rule Id="C26434" Action="None" /> <!-- Function 'derived::function' hides a non-virtual function 'base::function' -->
     <Rule Id="C26435" Action="Error" />
-    <Rule Id="C26436" Action="Error" />
+    <Rule Id="C26436" Action="None" /> <!-- The type 'symbol' with a virtual function needs either public virtual or protected non-virtual destructor -->
     <Rule Id="C26437" Action="Error" />
-    <Rule Id="C26438" Action="Error" />
+    <Rule Id="C26438" Action="None" /> <!-- Avoid goto -->
     <Rule Id="C26439" Action="Error" />
-    <Rule Id="C26440" Action="Error" />
+    <Rule Id="C26440" Action="None" /> <!-- Function can be declared 'noexcept'. -->
     <Rule Id="C26441" Action="Error" />
     <Rule Id="C26443" Action="Error" />
     <Rule Id="C26444" Action="Error" />
     <Rule Id="C26445" Action="Error" />
-    <Rule Id="C26446" Action="None" />
-    <Rule Id="C26447" Action="Error" />
-    <Rule Id="C26448" Action="None" />
+    <Rule Id="C26446" Action="None" /> <!-- Prefer to use gsl::at() instead of unchecked subscript operator -->
+    <Rule Id="C26447" Action="None" /> <!-- The function is declared noexcept but calls function function_name that may throw exceptions -->
+    <Rule Id="C26448" Action="None" /> <!-- Consider using gsl::finally if final action is intended -->
     <Rule Id="C26449" Action="Error" />
     <Rule Id="C26450" Action="Error" />
-    <Rule Id="C26451" Action="Error" />
+    <Rule Id="C26451" Action="None" /> <!-- Arithmetic overflow: Using operator '+' on a 4 byte value and then casting the result to a 8 byte value. Cast the value to the wider type before calling operator '+' to avoid overflow -->
     <Rule Id="C26452" Action="Error" />
     <Rule Id="C26453" Action="Error" />
     <Rule Id="C26454" Action="Error" />
+    <Rule Id="C26455" Action="None" /> <!-- Default constructor should not throw. Declare it 'noexcept' -->
+    <Rule Id="C26457" Action="None" /> <!--  (void) should not be used to ignore return values, use 'std::ignore =' instead -->
     <Rule Id="C26459" Action="Error" />
-    <Rule Id="C26460" Action="Error" />
-    <Rule Id="C26461" Action="Error" />
-    <Rule Id="C26462" Action="Error" />
+    <Rule Id="C26460" Action="None" /> <!-- The reference argument 'argument' for function 'function' can be marked as const -->
+    <Rule Id="C26461" Action="None" /> <!-- The pointer argument 'argument' for function 'function' can be marked as a pointer to const -->
+    <Rule Id="C26462" Action="None" /> <!--  The value pointed to by '<var>' is assigned only once, mark it as a pointer to const -->
     <Rule Id="C26463" Action="Error" />
     <Rule Id="C26464" Action="Error" />
     <Rule Id="C26465" Action="Error" />
     <Rule Id="C26466" Action="Error" />
-    <Rule Id="C26471" Action="Error" />
-    <Rule Id="C26472" Action="None" />
-    <Rule Id="C26473" Action="Error" />
+    <Rule Id="C26467" Action="None" /> <!-- Converting from floating point to unsigned integral types results in non-portable code if the double/float has a negative value. -->
+    <Rule Id="C26471" Action="None" /> <!-- Don't use reinterpret_cast. A cast from void* can use static_cast -->
+    <Rule Id="C26472" Action="None" /> <!-- Don't use a static_cast for arithmetic conversions. Use brace initialization, gsl::narrow_cast, or gsl::narrow. -->
+    <Rule Id="C26473" Action="None" /> <!-- Don't cast between pointer types where the source type and the target type are the same -->
     <Rule Id="C26474" Action="Error" />
     <Rule Id="C26475" Action="Error" />
-    <Rule Id="C26476" Action="Error" />
+    <Rule Id="C26476" Action="None" /> <!-- Expression/symbol 'name' uses a naked union 'union' with multiple type pointers: Use variant instead -->
     <Rule Id="C26477" Action="Error" />
-    <Rule Id="C26481" Action="Error" />
-    <Rule Id="C26482" Action="Error" />
+    <Rule Id="C26478" Action="Error" />
+    <Rule Id="C26481" Action="None" /> <!-- Don't use pointer arithmetic. Use span instead -->
+    <Rule Id="C26482" Action="None" /> <!-- Only index into arrays using constant expressions. -->
     <Rule Id="C26483" Action="Error" />
-    <Rule Id="C26485" Action="Error" />
-    <Rule Id="C26486" Action="None" />
-    <Rule Id="C26487" Action="Error" />
-    <Rule Id="C26489" Action="None" />
-    <Rule Id="C26490" Action="Error" />
+    <Rule Id="C26485" Action="None" /> <!-- Expression 'array-name': No array to pointer decay -->
+    <Rule Id="C26486" Action="None" /> <!-- Don't pass a pointer that may be invalid (dangling) as a parameter to a function. -->
+    <Rule Id="C26487" Action="None" /> <!-- Don't allow a function to return an invalid pointer, either through a formal return statement or through output parameters. -->
+    <Rule Id="C26489" Action="None" /> <!-- Don't dereference a pointer that may be invalid. -->
+    <Rule Id="C26490" Action="None" /> <!-- Don't use reinterpret_cast. -->
     <Rule Id="C26491" Action="Error" />
-    <Rule Id="C26492" Action="Error" />
-    <Rule Id="C26493" Action="Error" />
-    <Rule Id="C26494" Action="Error" />
-    <Rule Id="C26495" Action="Error" />
-    <Rule Id="C26496" Action="Error" />
+    <Rule Id="C26492" Action="None" /> <!-- Don't use const_cast to cast away const. -->
+    <Rule Id="C26493" Action="None" /> <!-- Don't use C-style casts. -->
+    <Rule Id="C26494" Action="None" /> <!-- Variable 'variable' is uninitialized. Always initialize an object. -->
+    <Rule Id="C26495" Action="None" /> <!-- Variable 'variable' is uninitialized. Always initialize a member variable -->
+    <Rule Id="C26496" Action="None" /> <!-- The variable 'variable' is assigned only once, mark it as const. -->
     <Rule Id="C26497" Action="Error" />
     <Rule Id="C26498" Action="Error" />
-    <Rule Id="C28020" Action="Error" />
+    <Rule Id="C26814" Action="None" /> <!-- The const variable 'variable' can be computed at compile time. Consider using constexpr -->
+    <Rule Id="C26818" Action="None" /> <!-- Switch statement does not cover all cases. Consider adding a 'default' label -->
+    <Rule Id="C26819" Action="Error" />
+    <Rule Id="C26826" Action="None" /> <!-- Don't use C-style variable arguments -->
+    <Rule Id="C26859" Action="None" /> <!-- Empty optional '<var>' is unwrapped, will throw exception. -->
+    <Rule Id="C28020" Action="None" /> <!-- The expression 'expr' is not true at this call -->
     <Rule Id="C28021" Action="Error" />
     <Rule Id="C28022" Action="Error" />
     <Rule Id="C28023" Action="Error" />
@@ -142,7 +151,7 @@
     <Rule Id="C28156" Action="Error" />
     <Rule Id="C28157" Action="Error" />
     <Rule Id="C28158" Action="Error" />
-    <Rule Id="C28159" Action="Error" />
+    <Rule Id="C28159" Action="None" /> <!-- Consider using *function_name_1* instead of *function_name_2*. -->
     <Rule Id="C28160" Action="Error" />
     <Rule Id="C28161" Action="Error" />
     <Rule Id="C28162" Action="Error" />
@@ -213,9 +222,9 @@
     <Rule Id="C28245" Action="Error" />
     <Rule Id="C28246" Action="Error" />
     <Rule Id="C28250" Action="Error" />
-    <Rule Id="C28251" Action="Error" />
-    <Rule Id="C28252" Action="Error" />
-    <Rule Id="C28253" Action="Error" />
+    <Rule Id="C28251" Action="None" /> <!-- Inconsistent annotation for function: this instance has an error -->
+    <Rule Id="C28252" Action="None" /> <!-- Inconsistent annotation for '<func>': <param> has '<annotation>' on the prior instance. -->
+    <Rule Id="C28253" Action="None" /> <!-- Inconsistent annotation for '<func>': <param> has '<annotations>' on this instance -->
     <Rule Id="C28254" Action="Error" />
     <Rule Id="C28260" Action="Error" />
     <Rule Id="C28262" Action="Error" />
@@ -286,9 +295,9 @@
     <Rule Id="C6011" Action="Error" />
     <Rule Id="C6014" Action="Error" />
     <Rule Id="C6029" Action="Error" />
-    <Rule Id="C6031" Action="Error" />
+    <Rule Id="C6031" Action="None" /> <!-- Return value ignored: '<func>'. -->
     <Rule Id="C6053" Action="Error" />
-    <Rule Id="C6054" Action="Error" />
+    <Rule Id="C6054" Action="None" /> <!-- String '<var>' might not be zero-terminated. -->
     <Rule Id="C6059" Action="Error" />
     <Rule Id="C6063" Action="Error" />
     <Rule Id="C6064" Action="Error" />
@@ -319,7 +328,7 @@
     <Rule Id="C6248" Action="Error" />
     <Rule Id="C6250" Action="Error" />
     <Rule Id="C6255" Action="Error" />
-    <Rule Id="C6258" Action="Error" />
+    <Rule Id="C6258" Action="None" /> <!-- Using TerminateThread does not allow proper thread clean up. -->
     <Rule Id="C6259" Action="Error" />
     <Rule Id="C6260" Action="Error" />
     <Rule Id="C6262" Action="Error" />
@@ -383,14 +392,14 @@
     <Rule Id="C6334" Action="Error" />
     <Rule Id="C6335" Action="Error" />
     <Rule Id="C6336" Action="Error" />
-    <Rule Id="C6340" Action="Error" />
+    <Rule Id="C6340" Action="None" /> <!-- sign mismatch -->
     <Rule Id="C6381" Action="Error" />
     <Rule Id="C6383" Action="Error" />
     <Rule Id="C6384" Action="Error" />
     <Rule Id="C6385" Action="Error" />
     <Rule Id="C6386" Action="Error" />
-    <Rule Id="C6387" Action="Error" />
-    <Rule Id="C6388" Action="Error" />
+    <Rule Id="C6387" Action="None" /> <!-- '<expr>' could be '<val>':  this does not adhere to the specification for the function '<func>' -->
+    <Rule Id="C6388" Action="None" /> <!-- '<var>' might not be '<val>':  this does not adhere to the specification for the function '<func>' -->
     <Rule Id="C6400" Action="Error" />
     <Rule Id="C6401" Action="Error" />
     <Rule Id="C6411" Action="Error" />

src/Servers/IIS/AspNetCoreModuleV2/IISLib/ahutil.cpp

@@ -43,7 +43,7 @@ exit:
     if( bstrPropName )
     {
         SysFreeString( bstrPropName );
-        bstrPropName = NULL;
+        bstrPropName = nullptr;
     }
 
     return hr;
@@ -90,9 +90,9 @@ GetElementStringProperty(
 {
     HRESULT hr = S_OK;
     BSTR bstrPropName = SysAllocString( szPropName );
-    IAppHostProperty* pProperty = NULL;
+    IAppHostProperty* pProperty = nullptr;
 
-    *pbstrPropValue = NULL;
+    *pbstrPropValue = nullptr;
 
     if (!bstrPropName)
     {
@@ -140,8 +140,8 @@ GetElementStringProperty(
 {
     HRESULT hr = S_OK;
     BSTR bstrPropName = SysAllocString( szPropName );
-    IAppHostProperty* pProperty = NULL;
-    BSTR bstrPropValue = NULL;
+    IAppHostProperty* pProperty = nullptr;
+    BSTR bstrPropValue = nullptr;
 
     if (!bstrPropName)
     {
@@ -199,7 +199,7 @@ GetElementChildByName(
 )
 {
     BSTR bstrElementName = SysAllocString(pszElementName);
-    if (bstrElementName == NULL)
+    if (bstrElementName == nullptr)
     {
         return E_OUTOFMEMORY;
     }
@@ -235,13 +235,13 @@ GetElementBoolProperty(
 )
 {
     HRESULT hr = S_OK;
-    IAppHostProperty * pProperty = NULL;
+    IAppHostProperty * pProperty = nullptr;
     VARIANT            varValue;
 
     VariantInit( &varValue );
 
     BSTR bstrPropertyName = SysAllocString(pszPropertyName);
-    if ( bstrPropertyName == NULL )
+    if ( bstrPropertyName == nullptr )
     {
         hr = E_OUTOFMEMORY;
         DBGERROR_HR(hr);
@@ -275,16 +275,16 @@ exit:
 
     VariantClear( &varValue );
 
-    if ( bstrPropertyName != NULL )
+    if ( bstrPropertyName != nullptr )
     {
         SysFreeString( bstrPropertyName );
-        bstrPropertyName = NULL;
+        bstrPropertyName = nullptr;
     }
 
-    if ( pProperty != NULL )
+    if ( pProperty != nullptr )
     {
         pProperty->Release();
-        pProperty = NULL;
+        pProperty = nullptr;
     }
 
     return hr;
@@ -299,13 +299,13 @@ GetElementDWORDProperty(
 )
 {
     HRESULT            hr = S_OK;
-    IAppHostProperty * pProperty = NULL;
+    IAppHostProperty * pProperty = nullptr;
     VARIANT            varValue;
 
     VariantInit( &varValue );
 
     BSTR bstrName = SysAllocString(pwszName);
-    if ( bstrName == NULL )
+    if ( bstrName == nullptr )
     {
         hr = E_OUTOFMEMORY;
         DBGERROR_HR(hr);
@@ -338,16 +338,16 @@ error:
 
     VariantClear( &varValue );
 
-    if ( pProperty != NULL )
+    if ( pProperty != nullptr )
     {
         pProperty->Release();
-        pProperty = NULL;
+        pProperty = nullptr;
     }
 
-    if ( bstrName != NULL )
+    if ( bstrName != nullptr )
     {
         SysFreeString( bstrName );
-        bstrName = NULL;
+        bstrName = nullptr;
     }
 
     return hr;
@@ -361,13 +361,13 @@ GetElementLONGLONGProperty(
 )
 {
     HRESULT            hr = S_OK;
-    IAppHostProperty * pProperty = NULL;
+    IAppHostProperty * pProperty = nullptr;
     VARIANT            varValue;
 
     VariantInit( &varValue );
 
     BSTR bstrName = SysAllocString(pwszName);
-    if ( bstrName == NULL )
+    if ( bstrName == nullptr )
     {
         hr = E_OUTOFMEMORY;
         DBGERROR_HR(hr);
@@ -400,16 +400,16 @@ error:
 
     VariantClear( &varValue );
 
-    if ( pProperty != NULL )
+    if ( pProperty != nullptr )
     {
         pProperty->Release();
-        pProperty = NULL;
+        pProperty = nullptr;
     }
 
-    if ( bstrName != NULL )
+    if ( bstrName != nullptr )
     {
         SysFreeString( bstrName );
-        bstrName = NULL;
+        bstrName = nullptr;
     }
 
     return hr;
@@ -423,13 +423,13 @@ GetElementRawTimeSpanProperty(
 )
 {
     HRESULT hr = S_OK;
-    IAppHostProperty * pProperty = NULL;
+    IAppHostProperty * pProperty = nullptr;
     VARIANT            varValue;
 
     VariantInit( &varValue );
 
     BSTR bstrPropertyName = SysAllocString(pszPropertyName);
-    if ( bstrPropertyName == NULL )
+    if ( bstrPropertyName == nullptr )
     {
         hr = HRESULT_FROM_WIN32( ERROR_NOT_ENOUGH_MEMORY );
         goto Finished;
@@ -463,16 +463,16 @@ Finished:
 
     VariantClear( &varValue );
 
-    if ( bstrPropertyName != NULL )
+    if ( bstrPropertyName != nullptr )
     {
         SysFreeString( bstrPropertyName );
-        bstrPropertyName = NULL;
+        bstrPropertyName = nullptr;
     }
 
-    if ( pProperty != NULL )
+    if ( pProperty != nullptr )
     {
         pProperty->Release();
-        pProperty = NULL;
+        pProperty = nullptr;
     }
 
     return hr;
@@ -630,7 +630,7 @@ FindElementInCollection(
     DWORD   count;
     DWORD   i;
 
-    BSTR bstrKeyName = NULL;
+    BSTR bstrKeyName = nullptr;
     PFN_FIND_COMPARE_PROC compareProc;
 
     compareProc = (BehaviorFlags & FIND_ELEMENT_CASE_INSENSITIVE)
@@ -738,7 +738,7 @@ VariantAssign(
 
     pv->vt = VT_BSTR;
     pv->bstrVal = bstr;
-    bstr = NULL;
+    bstr = nullptr;
 
 exit:
 
@@ -761,9 +761,9 @@ GetLocationFromFile(
     CComPtr<IAppHostConfigLocationCollection>   pLocationCollection;
     CComPtr<IAppHostConfigLocation>             pLocation;
 
-    BSTR bstrLocationPath = NULL;
+    BSTR bstrLocationPath = nullptr;
 
-    *ppLocation = NULL;
+    *ppLocation = nullptr;
     *pFound = FALSE;
 
     hr = GetLocationCollection( pAdminMgr,
@@ -819,7 +819,7 @@ GetLocationFromFile(
         pLocation.Release();
 
         SysFreeString( bstrLocationPath );
-        bstrLocationPath = NULL;
+        bstrLocationPath = nullptr;
     }
 
 exit:
@@ -847,10 +847,10 @@ GetSectionFromLocation(
     VARIANT varIndex;
     VariantInit( &varIndex );
 
-    BSTR bstrSectionName = NULL;
+    BSTR bstrSectionName = nullptr;
 
     *pFound = FALSE;
-    *ppSectionElement = NULL;
+    *ppSectionElement = nullptr;
 
     hr = pLocation->get_Count( &count );
     if( FAILED(hr) )
@@ -890,7 +890,7 @@ GetSectionFromLocation(
         pSectionElement.Release();
 
         SysFreeString( bstrSectionName );
-        bstrSectionName = NULL;
+        bstrSectionName = nullptr;
     }
 
 exit:
@@ -914,7 +914,7 @@ GetAdminElement(
     BSTR bstrConfigPath = SysAllocString(szConfigPath);
     BSTR bstrElementName = SysAllocString(szElementName);
 
-    if (bstrConfigPath == NULL || bstrElementName == NULL)
+    if (bstrConfigPath == nullptr || bstrElementName == nullptr)
     {
         hr = E_OUTOFMEMORY;
         DBGERROR_HR(hr);
@@ -933,15 +933,15 @@ GetAdminElement(
 
 exit:
 
-    if ( bstrElementName != NULL )
+    if ( bstrElementName != nullptr )
     {
         SysFreeString(bstrElementName);
-        bstrElementName = NULL;
+        bstrElementName = nullptr;
     }
-    if ( bstrConfigPath != NULL )
+    if ( bstrConfigPath != nullptr )
     {
         SysFreeString(bstrConfigPath);
-        bstrConfigPath = NULL;
+        bstrConfigPath = nullptr;
     }
 
     return hr;
@@ -1168,7 +1168,7 @@ CompareElementName(
     OUT     BOOL *                      pMatched
     )
 {
-    BSTR bstrElementName = NULL;
+    BSTR bstrElementName = nullptr;
 
     *pMatched = FALSE;  // until proven otherwise
 
@@ -1258,9 +1258,9 @@ GetSitesCollection(
 
     BSTR bstrConfigPath = SysAllocString(szConfigPath);
     BSTR bstrSitesSectionName = SysAllocString(L"system.applicationHost/sites");
-    *pSitesCollection = NULL;
+    *pSitesCollection = nullptr;
 
-    if (bstrConfigPath == NULL || bstrSitesSectionName == NULL)
+    if (bstrConfigPath == nullptr || bstrSitesSectionName == nullptr)
     {
         hr = E_OUTOFMEMORY;
         DBGERROR_HR(hr);
@@ -1309,9 +1309,9 @@ GetLocationCollection(
     CComPtr<IAppHostConfigFile>         pConfigFile;
 
     BSTR bstrConfigPath = SysAllocString(szConfigPath);
-    *pLocationCollection = NULL;
+    *pLocationCollection = nullptr;
 
-    if (bstrConfigPath == NULL)
+    if (bstrConfigPath == nullptr)
     {
         hr = E_OUTOFMEMORY;
         DBGERROR_HR(hr);
@@ -1378,7 +1378,7 @@ FindNextElement(
     OUT     IAppHostElement **                  pElement
     )
 {
-    *pElement = NULL;
+    *pElement = nullptr;
 
     if (pIndex->Index.ulVal >= pIndex->Count)
     {
@@ -1424,7 +1424,7 @@ FindNextChildElement(
     OUT     IAppHostElement **                  pElement
     )
 {
-    *pElement = NULL;
+    *pElement = nullptr;
 
     if (pIndex->Index.ulVal >= pIndex->Count)
     {
@@ -1470,7 +1470,7 @@ FindNextLocation(
     OUT     IAppHostConfigLocation **           pLocation
     )
 {
-    *pLocation = NULL;
+    *pLocation = nullptr;
 
     if (pIndex->Index.ulVal >= pIndex->Count)
     {
@@ -1516,7 +1516,7 @@ FindNextLocationElement(
     OUT     IAppHostElement **                  pElement
     )
 {
-    *pElement = NULL;
+    *pElement = nullptr;
 
     if (pIndex->Index.ulVal >= pIndex->Count)
     {
@@ -1552,16 +1552,16 @@ Return Value:
 --*/
 {
     HRESULT                 hr = S_OK;
-    IAppHostAdminManager    *pAdminManager = NULL;
+    IAppHostAdminManager    *pAdminManager = nullptr;
 
-    BSTR                    bstrConfigPath = NULL;
+    BSTR                    bstrConfigPath = nullptr;
 
-    IAppHostElement *       pConfigRedirSection = NULL;
+    IAppHostElement *       pConfigRedirSection = nullptr;
 
 
     BSTR bstrSectionName = SysAllocString(L"configurationRedirection");
 
-    if ( bstrSectionName == NULL )
+    if ( bstrSectionName == nullptr )
     {
         hr = E_OUTOFMEMORY;
         DBGERROR_HR(hr);
@@ -1569,7 +1569,7 @@ Return Value:
     }
 
     bstrConfigPath = SysAllocString( L"MACHINE/REDIRECTION" );
-    if ( bstrConfigPath == NULL )
+    if ( bstrConfigPath == nullptr )
     {
         hr = E_OUTOFMEMORY;
         DBGERROR_HR(hr);
@@ -1577,7 +1577,7 @@ Return Value:
     }
 
     hr = CoCreateInstance( CLSID_AppHostAdminManager,
-                           NULL,
+                           nullptr,
                            CLSCTX_INPROC_SERVER,
                            IID_IAppHostAdminManager,
                            (VOID **)&pAdminManager );
@@ -1607,7 +1607,7 @@ Return Value:
     }
 
     pConfigRedirSection->Release();
-    pConfigRedirSection = NULL;
+    pConfigRedirSection = nullptr;
 
 
 exit:
@@ -1616,22 +1616,22 @@ exit:
     // dump config exception to setup log file (if available)
     //
 
-    if ( pConfigRedirSection != NULL )
+    if ( pConfigRedirSection != nullptr )
     {
         pConfigRedirSection->Release();
     }
 
-    if ( pAdminManager != NULL )
+    if ( pAdminManager != nullptr )
     {
         pAdminManager->Release();
     }
 
-    if ( bstrConfigPath != NULL )
+    if ( bstrConfigPath != nullptr )
     {
         SysFreeString( bstrConfigPath );
     }
 
-    if ( bstrSectionName != NULL )
+    if ( bstrSectionName != nullptr )
     {
         SysFreeString( bstrSectionName );
     }

src/Servers/IIS/AspNetCoreModuleV2/IISLib/base64.cpp

@@ -49,13 +49,19 @@ Return Values:
     // Calculate encoded string size.
     cchEncoded = 1 + (cbDecodedBufferSize + 2) / 3 * 4;
 
-    if (NULL != pcchEncoded) {
+    if (nullptr != pcchEncoded) {
         *pcchEncoded = cchEncoded;
     }
 
-    if (cchEncodedStringSize == 0 && pszEncodedString == NULL) {
+    if (cchEncodedStringSize == 0 && pszEncodedString == nullptr) {
         return ERROR_SUCCESS;
     }
+    else if (pszEncodedString == nullptr)
+    {
+        return ERROR_INVALID_PARAMETER;
+    }
+
+    *pszEncodedString = 0;
 
     if (cchEncodedStringSize < cchEncoded) {
         // Given buffer is too small to hold encoded string.
@@ -66,8 +72,16 @@ Return Values:
     ib = ich = 0;
     while (ib < cbDecodedBufferSize) {
         b0 = pbDecodedBuffer[ib++];
-        b1 = (ib < cbDecodedBufferSize) ? pbDecodedBuffer[ib++] : 0;
-        b2 = (ib < cbDecodedBufferSize) ? pbDecodedBuffer[ib++] : 0;
+        b1 = 0;
+        b2 = 0;
+        if (ib < cbDecodedBufferSize)
+        {
+            b1 = pbDecodedBuffer[ib++];
+        }
+        if (ib < cbDecodedBufferSize)
+        {
+            b2 = pbDecodedBuffer[ib++];
+        }
 
         //
         // The checks below for buffer overflow seems redundant to me.
@@ -126,122 +140,6 @@ Return Values:
 }
 
 
-DWORD
-Base64Decode(
-    __in    PCWSTR      pszEncodedString,
-    __out_opt VOID *      pDecodeBuffer,
-    __in    DWORD       cbDecodeBufferSize,
-    __out_opt DWORD *   pcbDecoded
-    )
-/*++
-
-Routine Description:
-
-    Decode a base64-encoded string.
-
-Arguments:
-
-    pszEncodedString (IN) - base64-encoded string to decode.
-    cbDecodeBufferSize (IN) - size in bytes of the decode buffer.
-    pbDecodeBuffer (OUT) - holds the decoded data.
-    pcbDecoded (OUT) - number of data bytes in the decoded data (if success or
-        STATUS_BUFFER_TOO_SMALL).
-
-Return Values:
-
-    0 - success.
-    E_OUTOFMEMORY
-    E_INVALIDARG
-
---*/
-{
-constexpr auto NA = (255);
-#define DECODE(x) (((ULONG)(x) < sizeof(rgbDecodeTable)) ? rgbDecodeTable[x] : NA)
-
-    static BYTE rgbDecodeTable[128] = {
-       NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA,  // 0-15
-       NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA,  // 16-31
-       NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, 62, NA, NA, NA, 63,  // 32-47
-       52, 53, 54, 55, 56, 57, 58, 59, 60, 61, NA, NA, NA,  0, NA, NA,  // 48-63
-       NA,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,  // 64-79
-       15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, NA, NA, NA, NA, NA,  // 80-95
-       NA, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,  // 96-111
-       41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, NA, NA, NA, NA, NA,  // 112-127
-    };
-
-    DWORD   cbDecoded;
-    DWORD   cchEncodedSize;
-    DWORD   ich;
-    DWORD   ib;
-    BYTE    b0, b1, b2, b3;
-    BYTE *  pbDecodeBuffer = (BYTE *) pDecodeBuffer;
-
-    cchEncodedSize = (DWORD)wcslen(pszEncodedString);
-    if (NULL != pcbDecoded) {
-        *pcbDecoded = 0;
-    }
-
-    if ((0 == cchEncodedSize) || (0 != (cchEncodedSize % 4))) {
-        // Input string is not sized correctly to be base64.
-        return ERROR_INVALID_PARAMETER;
-    }
-
-    // Calculate decoded buffer size.
-    cbDecoded = (cchEncodedSize + 3) / 4 * 3;
-    if (pszEncodedString[cchEncodedSize-1] == '=') {
-        if (pszEncodedString[cchEncodedSize-2] == '=') {
-            // Only one data byte is encoded in the last cluster.
-            cbDecoded -= 2;
-        }
-        else {
-            // Only two data bytes are encoded in the last cluster.
-            cbDecoded -= 1;
-        }
-    }
-
-    if (NULL != pcbDecoded) {
-        *pcbDecoded = cbDecoded;
-    }
-
-    if (cbDecodeBufferSize == 0 && pDecodeBuffer == NULL) {
-        return ERROR_SUCCESS;
-    }
-
-    if (cbDecoded > cbDecodeBufferSize) {
-        // Supplied buffer is too small.
-        return ERROR_INSUFFICIENT_BUFFER;
-    }
-
-    // Decode each four-byte cluster into the corresponding three data bytes.
-    ich = ib = 0;
-    while (ich < cchEncodedSize) {
-        b0 = DECODE(pszEncodedString[ich]); ich++;
-        b1 = DECODE(pszEncodedString[ich]); ich++;
-        b2 = DECODE(pszEncodedString[ich]); ich++;
-        b3 = DECODE(pszEncodedString[ich]); ich++;
-
-        if ((NA == b0) || (NA == b1) || (NA == b2) || (NA == b3)) {
-            // Contents of input string are not base64.
-            return ERROR_INVALID_PARAMETER;
-        }
-
-        pbDecodeBuffer[ib++] = (b0 << 2) | (b1 >> 4);
-
-        if (ib < cbDecoded) {
-            pbDecodeBuffer[ib++] = (b1 << 4) | (b2 >> 2);
-
-            if (ib < cbDecoded) {
-                pbDecodeBuffer[ib++] = (b2 << 6) | b3;
-            }
-        }
-    }
-
-    DBG_ASSERT(ib == cbDecoded);
-
-    return ERROR_SUCCESS;
-}
-
-
 DWORD
 Base64Encode(
     __in_bcount(cbDecodedBufferSize)    VOID *  pDecodedBuffer,
@@ -288,13 +186,19 @@ Return Values:
     // Calculate encoded string size.
     cchEncoded = 1 + (cbDecodedBufferSize + 2) / 3 * 4;
 
-    if (NULL != pcchEncoded) {
+    if (nullptr != pcchEncoded) {
         *pcchEncoded = cchEncoded;
     }
 
-    if (cchEncodedStringSize == 0 && pszEncodedString == NULL) {
+    if (cchEncodedStringSize == 0 && pszEncodedString == nullptr) {
         return ERROR_SUCCESS;
     }
+    else if (pszEncodedString == nullptr)
+    {
+        return ERROR_INVALID_PARAMETER;
+    }
+
+    *pszEncodedString = 0;
 
     if (cchEncodedStringSize < cchEncoded) {
         // Given buffer is too small to hold encoded string.
@@ -305,8 +209,16 @@ Return Values:
     ib = ich = 0;
     while (ib < cbDecodedBufferSize) {
         b0 = pbDecodedBuffer[ib++];
-        b1 = (ib < cbDecodedBufferSize) ? pbDecodedBuffer[ib++] : 0;
-        b2 = (ib < cbDecodedBufferSize) ? pbDecodedBuffer[ib++] : 0;
+        b1 = 0;
+        b2 = 0;
+        if (ib < cbDecodedBufferSize)
+        {
+            b1 = pbDecodedBuffer[ib++];
+        }
+        if (ib < cbDecodedBufferSize)
+        {
+            b2 = pbDecodedBuffer[ib++];
+        }
 
         //
         // The checks below for buffer overflow seems redundant to me.
@@ -363,120 +275,3 @@ Return Values:
 
     return ERROR_SUCCESS;
 }
-
-
-DWORD
-Base64Decode(
-    __in    PCSTR       pszEncodedString,
-    __out_opt   VOID *      pDecodeBuffer,
-    __in    DWORD       cbDecodeBufferSize,
-    __out_opt DWORD *   pcbDecoded
-    )
-/*++
-
-Routine Description:
-
-    Decode a base64-encoded string.
-
-Arguments:
-
-    pszEncodedString (IN) - base64-encoded string to decode.
-    cbDecodeBufferSize (IN) - size in bytes of the decode buffer.
-    pbDecodeBuffer (OUT) - holds the decoded data.
-    pcbDecoded (OUT) - number of data bytes in the decoded data (if success or
-        STATUS_BUFFER_TOO_SMALL).
-
-Return Values:
-
-    0 - success.
-    E_OUTOFMEMORY
-    E_INVALIDARG
-
---*/
-{
-#define NA (255)
-#define DECODE(x) (((ULONG)(x) < sizeof(rgbDecodeTable)) ? rgbDecodeTable[x] : NA)
-
-    static BYTE rgbDecodeTable[128] = {
-       NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA,  // 0-15
-       NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA,  // 16-31
-       NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, 62, NA, NA, NA, 63,  // 32-47
-       52, 53, 54, 55, 56, 57, 58, 59, 60, 61, NA, NA, NA,  0, NA, NA,  // 48-63
-       NA,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,  // 64-79
-       15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, NA, NA, NA, NA, NA,  // 80-95
-       NA, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,  // 96-111
-       41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, NA, NA, NA, NA, NA,  // 112-127
-    };
-
-    DWORD   cbDecoded;
-    DWORD   cchEncodedSize;
-    DWORD   ich;
-    DWORD   ib;
-    BYTE    b0, b1, b2, b3;
-    BYTE *  pbDecodeBuffer = (BYTE *) pDecodeBuffer;
-
-    cchEncodedSize = (DWORD)strlen(pszEncodedString);
-    if (NULL != pcbDecoded) {
-        *pcbDecoded = 0;
-    }
-
-    if ((0 == cchEncodedSize) || (0 != (cchEncodedSize % 4))) {
-        // Input string is not sized correctly to be base64.
-        return ERROR_INVALID_PARAMETER;
-    }
-
-    // Calculate decoded buffer size.
-    cbDecoded = (cchEncodedSize + 3) / 4 * 3;
-    if (pszEncodedString[cchEncodedSize-1] == '=') {
-        if (pszEncodedString[cchEncodedSize-2] == '=') {
-            // Only one data byte is encoded in the last cluster.
-            cbDecoded -= 2;
-        }
-        else {
-            // Only two data bytes are encoded in the last cluster.
-            cbDecoded -= 1;
-        }
-    }
-
-    if (NULL != pcbDecoded) {
-        *pcbDecoded = cbDecoded;
-    }
-
-    if (cbDecodeBufferSize == 0 && pDecodeBuffer == NULL) {
-        return ERROR_SUCCESS;
-    }
-
-    if (cbDecoded > cbDecodeBufferSize) {
-        // Supplied buffer is too small.
-        return ERROR_INSUFFICIENT_BUFFER;
-    }
-
-    // Decode each four-byte cluster into the corresponding three data bytes.
-    ich = ib = 0;
-    while (ich < cchEncodedSize) {
-        b0 = DECODE(pszEncodedString[ich]); ich++;
-        b1 = DECODE(pszEncodedString[ich]); ich++;
-        b2 = DECODE(pszEncodedString[ich]); ich++;
-        b3 = DECODE(pszEncodedString[ich]); ich++;
-
-        if ((NA == b0) || (NA == b1) || (NA == b2) || (NA == b3)) {
-            // Contents of input string are not base64.
-            return ERROR_INVALID_PARAMETER;
-        }
-
-        pbDecodeBuffer[ib++] = (b0 << 2) | (b1 >> 4);
-
-        if (ib < cbDecoded) {
-            pbDecodeBuffer[ib++] = (b1 << 4) | (b2 >> 2);
-
-            if (ib < cbDecoded) {
-                pbDecodeBuffer[ib++] = (b2 << 6) | b3;
-            }
-        }
-    }
-
-    DBG_ASSERT(ib == cbDecoded);
-
-    return ERROR_SUCCESS;
-}
-

src/Servers/IIS/AspNetCoreModuleV2/IISLib/base64.h

@@ -15,14 +15,6 @@ Base64Encode(
     __out_opt DWORD *                           pcchEncoded
     );
 
-DWORD
-Base64Decode(
-    __in    PCWSTR                              pszEncodedString,
-    __out_opt   VOID *                              pDecodeBuffer,
-    __in    DWORD                               cbDecodeBufferSize,
-    __out_opt DWORD *                           pcbDecoded
-    );
-
 DWORD
 Base64Encode(
     __in_bcount( cbDecodedBufferSize ) VOID *   pDecodedBuffer,
@@ -32,13 +24,5 @@ Base64Encode(
     __out_opt DWORD *                           pcchEncoded
     );
 
-DWORD
-Base64Decode(
-    __in    PCSTR                               pszEncodedString,
-    __out_opt   VOID *                              pDecodeBuffer,
-    __in    DWORD                               cbDecodeBufferSize,
-    __out_opt DWORD *                           pcbDecoded
-    );
-
 #endif // _BASE64_HXX_
 

src/Servers/IIS/AspNetCoreModuleV2/IISLib/buffer.h

@@ -259,7 +259,7 @@ C_ASSERT( sizeof(VOID*) <= sizeof(ULONGLONG) );
 //  bytes. If the buffer overflows then a heap buffer will be allocated.
 //
 #define STACK_BUFFER( _name, _size )    \
-    ULONGLONG   __aqw##_name[ ( ( (_size) + sizeof(ULONGLONG) - 1 ) / sizeof(ULONGLONG) ) ]; \
+    ULONGLONG   __aqw##_name[ ( ( (_size) + sizeof(ULONGLONG) - 1 ) / sizeof(ULONGLONG) ) ]{}; \
     BUFFER      _name( (BYTE*)__aqw##_name, sizeof(__aqw##_name) )
 
 //

src/Servers/IIS/AspNetCoreModuleV2/IISLib/hashfn.h

@@ -12,7 +12,7 @@
 // the low end of the hashtable otherwise.  LKRhash applies this internally
 // to all hash signatures for exactly this reason.
 
-inline DWORD
+inline constexpr DWORD
 HashScramble(DWORD dwHash)
 {
     // Here are 10 primes slightly greater than 10^9
@@ -20,9 +20,9 @@ HashScramble(DWORD dwHash)
     //  1000000093, 1000000097, 1000000103, 1000000123, 1000000181.
 
     // default value for "scrambling constant"
-    const DWORD RANDOM_CONSTANT = 314159269UL;
+    constexpr DWORD RANDOM_CONSTANT = 314159269UL;
     // large prime number, also used for scrambling
-    const DWORD RANDOM_PRIME =   1000000007UL;
+    constexpr DWORD RANDOM_PRIME =   1000000007UL;
 
     return (RANDOM_CONSTANT * dwHash) % RANDOM_PRIME ;
 }
@@ -30,7 +30,7 @@ HashScramble(DWORD dwHash)
 
 // Faster scrambling function suggested by Eric Jacobsen
 
-inline DWORD
+inline DWORD constexpr
 HashRandomizeBits(DWORD dw)
 {
 	return (((dw * 1103515245 + 12345) >> 16)
@@ -39,7 +39,7 @@ HashRandomizeBits(DWORD dw)
 
 
 // Small prime number used as a multiplier in the supplied hash functions
-const DWORD HASH_MULTIPLIER = 101;
+constexpr DWORD HASH_MULTIPLIER = 101;
 
 #undef HASH_SHIFT_MULTIPLY
 
@@ -273,51 +273,51 @@ Hash(
 }
 
 // Identity hash functions: scalar values map to themselves
-inline DWORD Hash(char c)
+inline constexpr DWORD Hash(char c)
 { return c; }
 
-inline DWORD Hash(unsigned char uc)
+inline constexpr DWORD Hash(unsigned char uc)
 { return uc; }
 
-inline DWORD Hash(signed char sc)
+inline constexpr DWORD Hash(signed char sc)
 { return sc; }
 
-inline DWORD Hash(short sh)
+inline constexpr DWORD Hash(short sh)
 { return sh; }
 
-inline DWORD Hash(unsigned short ush)
+inline constexpr DWORD Hash(unsigned short ush)
 { return ush; }
 
-inline DWORD Hash(int i)
+inline constexpr DWORD Hash(int i)
 { return i; }
 
-inline DWORD Hash(unsigned int u)
+inline constexpr DWORD Hash(unsigned int u)
 { return u; }
 
-inline DWORD Hash(long l)
+inline constexpr DWORD Hash(long l)
 { return l; }
 
-inline DWORD Hash(unsigned long ul)
+inline constexpr DWORD Hash(unsigned long ul)
 { return ul; }
 
-inline DWORD Hash(float f)
+inline constexpr DWORD Hash(float f)
 {
     // be careful of rounding errors when computing keys
     union {
         float f;
         DWORD dw;
-    } u;
+    } u{};
     u.f = f;
     return u.dw;
 }
 
-inline DWORD Hash(double dbl)
+inline constexpr DWORD Hash(double dbl)
 {
     // be careful of rounding errors when computing keys
     union {
         double dbl;
         DWORD  dw[2];
-    } u;
+    } u{};
     u.dbl = dbl;
     return u.dw[0] * HASH_MULTIPLIER + u.dw[1];
 }

src/Servers/IIS/AspNetCoreModuleV2/IISLib/hashtable.h

@@ -16,14 +16,14 @@ class HASH_NODE
     HASH_NODE(
         _Record *       pRecord,
         DWORD           dwHash
-    ) : _pNext (NULL),
+    ) : _pNext (nullptr),
         _pRecord (pRecord),
         _dwHash (dwHash)
     {}
 
     ~HASH_NODE()
     {
-        _ASSERTE(_pRecord == NULL);
+        _ASSERTE(_pRecord == nullptr);
     }
 
  private:
@@ -57,7 +57,7 @@ public:
     HASH_TABLE(
         VOID
     )
-      : _ppBuckets( NULL ),
+      : _ppBuckets(nullptr),
         _nBuckets( 0 ),
         _nItems( 0 )
     {
@@ -158,7 +158,7 @@ private:
         __deref_out
         HASH_NODE<_Record> **   ppNode,
         __deref_opt_out
-        HASH_NODE<_Record> ***  pppPreviousNodeNextPointer = NULL
+        HASH_NODE<_Record> ***  pppPreviousNodeNextPointer = nullptr
     );
 
     VOID
@@ -166,10 +166,10 @@ private:
         HASH_NODE<_Record> *    pNode
     )
     {
-        if (pNode->_pRecord != NULL)
+        if (pNode->_pRecord != nullptr)
         {
             DereferenceRecord(pNode->_pRecord);
-            pNode->_pRecord = NULL;
+            pNode->_pRecord = nullptr;
         }
 
         delete pNode;
@@ -210,8 +210,8 @@ HASH_TABLE<_Record,_Key>::Initialize(
         goto Failed;
     }
 
-    _ASSERTE(_ppBuckets == NULL );
-    if ( _ppBuckets != NULL )
+    _ASSERTE(_ppBuckets == nullptr);
+    if (_ppBuckets != nullptr)
     {
         hr = E_INVALIDARG;
         goto Failed;
@@ -227,7 +227,7 @@ HASH_TABLE<_Record,_Key>::Initialize(
                             GetProcessHeap(),
                             HEAP_ZERO_MEMORY,
                             nBuckets*sizeof(HASH_NODE<_Record> *));
-    if (_ppBuckets == NULL)
+    if (_ppBuckets == nullptr)
     {
         hr = HRESULT_FROM_WIN32(ERROR_NOT_ENOUGH_MEMORY);
         goto Failed;
@@ -243,7 +243,7 @@ Failed:
         HeapFree(GetProcessHeap(),
                  0,
                  _ppBuckets);
-        _ppBuckets = NULL;
+        _ppBuckets = nullptr;
     }
 
     return hr;
@@ -253,7 +253,7 @@ Failed:
 template <class _Record, class _Key>
 HASH_TABLE<_Record,_Key>::~HASH_TABLE()
 {
-    if (_ppBuckets == NULL)
+    if (_ppBuckets == nullptr)
     {
         return;
     }
@@ -263,7 +263,7 @@ HASH_TABLE<_Record,_Key>::~HASH_TABLE()
     HeapFree(GetProcessHeap(),
              0,
              _ppBuckets);
-    _ppBuckets = NULL;
+    _ppBuckets = nullptr;
     _nBuckets = 0;
 }
 
@@ -288,8 +288,8 @@ template <class _Record, class _Key>
 VOID
 HASH_TABLE<_Record,_Key>::Clear()
 {
-    HASH_NODE<_Record> *pCurrent;
-    HASH_NODE<_Record> *pNext;
+    HASH_NODE<_Record> *pCurrent = nullptr;
+    HASH_NODE<_Record> *pNext = nullptr;
 
     // This is here in the off cases where someone instantiates a hashtable
     // and then does an automatic "clear" before its destruction WITHOUT
@@ -304,8 +304,8 @@ HASH_TABLE<_Record,_Key>::Clear()
     for (DWORD i=0; i<_nBuckets; i++)
     {
         pCurrent = _ppBuckets[i];
-        _ppBuckets[i] = NULL;
-        while (pCurrent != NULL)
+        _ppBuckets[i] = nullptr;
+        while (pCurrent != nullptr)
         {
             pNext = pCurrent->_pNext;
             DeleteNode(pCurrent);
@@ -318,7 +318,7 @@ HASH_TABLE<_Record,_Key>::Clear()
 }
 
 template <class _Record, class _Key>
-__success(*ppNode != NULL && return != FALSE)
+__success(*ppNode != nullptr && return != FALSE)
 BOOL
 HASH_TABLE<_Record,_Key>::FindNodeInternal(
     _Key                    key,
@@ -338,13 +338,13 @@ HASH_TABLE<_Record,_Key>::FindNodeInternal(
   This routine may be called under either read or write lock
 --*/
 {
-    HASH_NODE<_Record> **ppPreviousNodeNextPointer;
-    HASH_NODE<_Record> *pNode;
+    HASH_NODE<_Record> **ppPreviousNodeNextPointer = nullptr;
+    HASH_NODE<_Record> *pNode = nullptr;
     BOOL fFound = FALSE;
 
     ppPreviousNodeNextPointer = _ppBuckets + (dwHash % _nBuckets);
     pNode = *ppPreviousNodeNextPointer;
-    while (pNode != NULL)
+    while (pNode != nullptr)
     {
         if (pNode->_dwHash == dwHash)
         {
@@ -364,10 +364,10 @@ HASH_TABLE<_Record,_Key>::FindNodeInternal(
         pNode = *ppPreviousNodeNextPointer;
     }
 
-    __analysis_assume( (pNode == NULL && fFound == FALSE) ||
-                       (pNode != NULL && fFound == TRUE ) );
+    __analysis_assume( (pNode == nullptr && fFound == FALSE) ||
+                       (pNode != nullptr && fFound == TRUE ) );
     *ppNode = pNode;
-    if (pppPreviousNodeNextPointer != NULL)
+    if (pppPreviousNodeNextPointer != nullptr)
     {
         *pppPreviousNodeNextPointer = ppPreviousNodeNextPointer;
     }
@@ -381,16 +381,19 @@ HASH_TABLE<_Record,_Key>::FindKey(
     _Record **          ppRecord
 )
 {
-    HASH_NODE<_Record> *pNode;
+    HASH_NODE<_Record> *pNode = nullptr;
 
-    *ppRecord = NULL;
+    *ppRecord = nullptr;
 
     DWORD dwHash = CalcKeyHash(key);
 
     _tableLock.SharedAcquire();
 
+    // Dereferencing NULL pointer 'pNode'
+    // FindNodeInternal will set a non-null pNode when true is returned, just need to figure out how to correctly SAL the method
+#pragma warning(suppress: 6011)
     if (FindNodeInternal(key, dwHash, &pNode) &&
-        pNode->_pRecord != NULL)
+        pNode->_pRecord != nullptr)
     {
         ReferenceRecord(pNode->_pRecord);
         *ppRecord = pNode->_pRecord;
@@ -421,9 +424,9 @@ HASH_TABLE<_Record,_Key>::InsertRecord(
     _Key key = ExtractKey(pRecord);
     DWORD dwHash = CalcKeyHash(key);
     HRESULT hr = S_OK;
-    HASH_NODE<_Record> *    pNewNode;
-    HASH_NODE<_Record> *    pNextNode;
-    HASH_NODE<_Record> **   ppPreviousNodeNextPointer;
+    HASH_NODE<_Record> *    pNewNode = nullptr;
+    HASH_NODE<_Record> *    pNextNode = nullptr;
+    HASH_NODE<_Record> **   ppPreviousNodeNextPointer = nullptr;
 
     //
     // Ownership of pRecord is not transferred to pNewNode yet, so remember
@@ -432,7 +435,7 @@ HASH_TABLE<_Record,_Key>::InsertRecord(
     // which users may view as getting flushed out of the hash-table
     //
     pNewNode = new HASH_NODE<_Record>(pRecord, dwHash);
-    if (pNewNode == NULL)
+    if (pNewNode == nullptr)
     {
         hr = HRESULT_FROM_WIN32(ERROR_NOT_ENOUGH_MEMORY);
         goto Finished;
@@ -451,7 +454,7 @@ HASH_TABLE<_Record,_Key>::InsertRecord(
             //
             // If node already there, return error
             //
-            pNewNode->_pRecord = NULL;
+            pNewNode->_pRecord = nullptr;
             DeleteNode(pNewNode);
 
             //
@@ -470,10 +473,10 @@ HASH_TABLE<_Record,_Key>::InsertRecord(
                                                pNewNode,
                                                pNextNode) != pNextNode);
     // pass ownership of pRecord now
-    if (pRecord != NULL)
+    if (pRecord != nullptr)
     {
         ReferenceRecord(pRecord);
-        pRecord = NULL;
+        pRecord = nullptr;
     }
     InterlockedIncrement((LONG *)&_nItems);
 
@@ -498,8 +501,8 @@ HASH_TABLE<_Record,_Key>::DeleteKey(
     _Key        key
 )
 {
-    HASH_NODE<_Record> *pNode;
-    HASH_NODE<_Record> **ppPreviousNodeNextPointer;
+    HASH_NODE<_Record> *pNode = nullptr;
+    HASH_NODE<_Record> **ppPreviousNodeNextPointer = nullptr;
 
     DWORD dwHash = CalcKeyHash(key);
 
@@ -507,6 +510,9 @@ HASH_TABLE<_Record,_Key>::DeleteKey(
 
     if (FindNodeInternal(key, dwHash, &pNode, &ppPreviousNodeNextPointer))
     {
+        // Dereferencing NULL pointer 'pNode'
+        // FindNodeInternal will set a non-null pNode when true is returned, just need to figure out how to correctly SAL the method
+#pragma warning(suppress: 6011)
         *ppPreviousNodeNextPointer = pNode->_pNext;
         DeleteNode(pNode);
         _nItems--;
@@ -531,7 +537,7 @@ HASH_TABLE<_Record,_Key>::DeleteIf(
     {
         ppPreviousNodeNextPointer = _ppBuckets + i;
         pNode = *ppPreviousNodeNextPointer;
-        while (pNode != NULL)
+        while (pNode != nullptr)
         {
             //
             // Non empty nodes deleted based on DeleteIf, empty nodes deleted
@@ -569,9 +575,9 @@ HASH_TABLE<_Record,_Key>::Apply(
     for (DWORD i=0; i<_nBuckets; i++)
     {
         pNode = _ppBuckets[i];
-        while (pNode != NULL)
+        while (pNode != nullptr)
         {
-            if (pNode->_pRecord != NULL)
+            if (pNode->_pRecord != nullptr)
             {
                 pfnApply(pNode->_pRecord, pvContext);
             }
@@ -624,7 +630,7 @@ HASH_TABLE<_Record,_Key>::RehashTableIfNeeded(
                         GetProcessHeap(),
                         HEAP_ZERO_MEMORY,
                         nBuckets*sizeof(HASH_NODE<_Record> *));
-    if (ppBuckets == NULL)
+    if (ppBuckets == nullptr)
     {
         goto Finished;
     }
@@ -636,13 +642,13 @@ HASH_TABLE<_Record,_Key>::RehashTableIfNeeded(
     for (DWORD i=0; i<_nBuckets; i++)
     {
         pNode = _ppBuckets[i];
-        while (pNode != NULL)
+        while (pNode != nullptr)
         {
             pNextNode = pNode->_pNext;
 
             ppNextPointer = ppBuckets + (pNode->_dwHash % nBuckets);
             pNewNextNode = *ppNextPointer;
-            while (pNewNextNode != NULL &&
+            while (pNewNextNode != nullptr &&
                    pNewNextNode->_dwHash <= pNode->_dwHash)
             {
                 ppNextPointer = &pNewNextNode->_pNext;
@@ -658,7 +664,7 @@ HASH_TABLE<_Record,_Key>::RehashTableIfNeeded(
     HeapFree(GetProcessHeap(), 0, _ppBuckets);
     _ppBuckets = ppBuckets;
     _nBuckets = nBuckets;
-    ppBuckets = NULL;
+    ppBuckets = nullptr;
 
 Finished:
 

src/Servers/IIS/AspNetCoreModuleV2/IISLib/listentry.h

@@ -140,7 +140,7 @@ PopEntryList(
 {
     PSINGLE_LIST_ENTRY FirstEntry;
     FirstEntry = ListHead->Next;
-    if (FirstEntry != NULL) {
+    if (FirstEntry != nullptr) {
         ListHead->Next = FirstEntry->Next;
     }
 

src/Servers/IIS/AspNetCoreModuleV2/IISLib/multisz.cpp

@@ -35,7 +35,7 @@ MULTISZ::CalcLength( const WCHAR * str,
         count++;
     }
 
-    if( pcStrings != NULL ) {
+    if( pcStrings != nullptr ) {
         *pcStrings = count;
     }
 
@@ -51,8 +51,8 @@ MULTISZ::FindString( const WCHAR * str ) const
     // Sanity check.
     //
 
-    DBG_ASSERT( QueryStr() != NULL );
-    DBG_ASSERT( str != NULL );
+    DBG_ASSERT( QueryStr() != nullptr );
+    DBG_ASSERT( str != nullptr );
     DBG_ASSERT( *str != '\0' );
 
     //
@@ -85,8 +85,8 @@ MULTISZ::FindStringNoCase( const WCHAR * str ) const
     // Sanity check.
     //
 
-    DBG_ASSERT( QueryStr() != NULL );
-    DBG_ASSERT( str != NULL );
+    DBG_ASSERT( QueryStr() != nullptr );
+    DBG_ASSERT( str != nullptr );
     DBG_ASSERT( *str != '\0' );
 
     //
@@ -149,7 +149,7 @@ MULTISZ::AuxInit( const WCHAR * pInit )
 
 BOOL MULTISZ::AuxAppend( const WCHAR * pStr, UINT cbStr, BOOL fAddSlop )
 {
-    DBG_ASSERT( pStr != NULL );
+    DBG_ASSERT( pStr != nullptr );
 
     UINT cbThis = QueryCB();
 
@@ -247,7 +247,7 @@ MULTISZ::CopyToBuffer( WCHAR * lpszBuffer, LPDWORD lpcch) const
 {
    BOOL fReturn = TRUE;
 
-    if ( lpcch == NULL) {
+    if ( lpcch == nullptr ) {
         SetLastError( ERROR_INVALID_PARAMETER);
         return ( FALSE);
     }
@@ -305,7 +305,7 @@ MULTISZ::CopyToBuffer( __out_ecount_opt(*lpcch) WCHAR * lpszBuffer, LPDWORD lpcc
 {
    BOOL fReturn = TRUE;
 
-    if ( lpcch == NULL) {
+    if ( lpcch == nullptr ) {
         SetLastError( ERROR_INVALID_PARAMETER);
         return ( FALSE);
     }
@@ -335,7 +335,7 @@ MULTISZ::Equals(
 // Compares this to pmszRhs, returns TRUE if equal
 //
 {
-    DBG_ASSERT( NULL != pmszRhs );
+    DBG_ASSERT( nullptr != pmszRhs );
 
     PCWSTR pszLhs = First( );
     PCWSTR pszRhs = pmszRhs->First( );
@@ -345,9 +345,9 @@ MULTISZ::Equals(
         return FALSE;
     }
 
-    while( NULL != pszLhs )
+    while( nullptr  != pszLhs )
     {
-        DBG_ASSERT( NULL != pszRhs );
+        DBG_ASSERT( nullptr != pszRhs );
 
         if( 0 != wcscmp( pszLhs, pszRhs ) )
         {
@@ -390,8 +390,8 @@ Return Value:
 {
     HRESULT                 hr = S_OK;
 
-    if ( pszList == NULL ||
-         pmszList == NULL )
+    if ( pszList == nullptr ||
+         pmszList == nullptr )
     {
         DBG_ASSERT( FALSE );
         hr = HRESULT_FROM_WIN32( ERROR_INVALID_PARAMETER );
@@ -417,9 +417,9 @@ Return Value:
           pszCurrent = pszNext + 1,
           pszNext = wcschr( pszCurrent, L',' ) )
     {
-        PCWSTR pszEnd = NULL;
+        PCWSTR pszEnd = nullptr;
 
-        if ( pszNext != NULL )
+        if ( pszNext != nullptr )
         {
             pszEnd = pszNext;
         }
@@ -450,7 +450,7 @@ Return Value:
             }
         }
 
-        if ( pszNext == NULL )
+        if ( pszNext == nullptr )
         {
             break;
         }

src/Servers/IIS/AspNetCoreModuleV2/IISLib/multisza.cpp

@@ -33,7 +33,7 @@ MULTISZA::CalcLength( const CHAR * str,
         count++;
     }
 
-    if( pcStrings != NULL ) {
+    if( pcStrings != nullptr ) {
         *pcStrings = count;
     }
 
@@ -49,8 +49,8 @@ MULTISZA::FindString( const CHAR * str ) const
     // Sanity check.
     //
 
-    DBG_ASSERT( QueryStr() != NULL );
-    DBG_ASSERT( str != NULL );
+    DBG_ASSERT( QueryStr() != nullptr);
+    DBG_ASSERT( str != nullptr );
     DBG_ASSERT( *str != '\0' );
 
     //
@@ -83,8 +83,8 @@ MULTISZA::FindStringNoCase( const CHAR * str ) const
     // Sanity check.
     //
 
-    DBG_ASSERT( QueryStr() != NULL );
-    DBG_ASSERT( str != NULL );
+    DBG_ASSERT( QueryStr() != nullptr);
+    DBG_ASSERT( str != nullptr);
     DBG_ASSERT( *str != '\0' );
 
     //
@@ -96,9 +96,7 @@ MULTISZA::FindStringNoCase( const CHAR * str ) const
     while( *multisz != '\0' ) {
 
         if( !_stricmp( multisz, str ) ) {
-
             return TRUE;
-
         }
 
         multisz += strlen( multisz ) + 1;
@@ -147,7 +145,7 @@ MULTISZA::AuxInit( const CHAR * pInit )
 
 BOOL MULTISZA::AuxAppend( const CHAR * pStr, UINT cbStr, BOOL fAddSlop )
 {
-    DBG_ASSERT( pStr != NULL );
+    DBG_ASSERT( pStr != nullptr);
 
     UINT cbThis = QueryCB();
 
@@ -240,7 +238,7 @@ MULTISZA::CopyToBuffer( __out_ecount_opt(*lpcch) CHAR * lpszBuffer, LPDWORD lpcc
 {
    BOOL fReturn = TRUE;
 
-    if ( lpcch == NULL) {
+    if ( lpcch == nullptr) {
         SetLastError( ERROR_INVALID_PARAMETER);
         return ( FALSE);
     }
@@ -270,7 +268,7 @@ MULTISZA::Equals(
 // Compares this to pmszRhs, returns TRUE if equal
 //
 {
-    DBG_ASSERT( NULL != pmszRhs );
+    DBG_ASSERT(nullptr != pmszRhs );
 
     PCSTR pszLhs = First( );
     PCSTR pszRhs = pmszRhs->First( );
@@ -280,9 +278,9 @@ MULTISZA::Equals(
         return FALSE;
     }
 
-    while( NULL != pszLhs )
+    while( nullptr != pszLhs )
     {
-        DBG_ASSERT( NULL != pszRhs );
+        DBG_ASSERT( nullptr != pszRhs );
 
         if( 0 != strcmp( pszLhs, pszRhs ) )
         {
@@ -325,8 +323,8 @@ Return Value:
 {
     HRESULT                 hr = S_OK;
 
-    if ( pszList == NULL ||
-         pmszList == NULL )
+    if ( pszList == nullptr ||
+         pmszList == nullptr)
     {
         DBG_ASSERT( FALSE );
         hr = HRESULT_FROM_WIN32( ERROR_INVALID_PARAMETER );
@@ -352,9 +350,9 @@ Return Value:
           pszCurrent = pszNext + 1,
           pszNext = strchr( pszCurrent, L',' ) )
     {
-        PCSTR pszEnd = NULL;
+        PCSTR pszEnd = nullptr;
 
-        if ( pszNext != NULL )
+        if ( pszNext != nullptr )
         {
             pszEnd = pszNext;
         }
@@ -385,7 +383,7 @@ Return Value:
             }
         }
         
-        if ( pszNext == NULL )
+        if ( pszNext == nullptr )
         {
             break;
         }

src/Servers/IIS/AspNetCoreModuleV2/IISLib/multisza.h

@@ -69,7 +69,7 @@ public:
     BOOL IsEmpty( VOID) const      { return ( *QueryStr() == L'\0'); }
 
     BOOL Append( const CHAR  * pchInit ) {
-      return ((pchInit != NULL) ? (AuxAppend( pchInit,
+      return ((pchInit != nullptr) ? (AuxAppend( pchInit,
                                               (DWORD) (::strlen(pchInit)) * sizeof(CHAR)
                                               )) :
               TRUE);
@@ -77,7 +77,7 @@ public:
 
 
     BOOL Append( const CHAR  * pchInit, DWORD cchLen ) {
-      return ((pchInit != NULL) ? (AuxAppend( pchInit,
+      return ((pchInit != nullptr) ? (AuxAppend( pchInit,
                                               cchLen * sizeof(CHAR))) :
               TRUE);
     }
@@ -88,7 +88,7 @@ public:
 
     // Resets the internal string to be NULL string. Buffer remains cached.
     VOID Reset()
-    { DBG_ASSERT( QueryPtr() != NULL);
+    { DBG_ASSERT( QueryPtr() != nullptr );
       QueryStr()[0] = L'\0';
       QueryStr()[1] = L'\0';
       m_cchLen = 2;
@@ -97,7 +97,7 @@ public:
 
     BOOL Copy( const CHAR  * pchInit, IN DWORD cbLen ) {
       if ( QueryPtr() ) { Reset(); }
-      return ( (pchInit != NULL) ?
+      return ( (pchInit != nullptr) ?
                AuxAppend( pchInit, cbLen, FALSE ):
                TRUE);
     }
@@ -140,7 +140,7 @@ public:
     BOOL
       Clone( OUT MULTISZA * pstrClone) const
         {
-          return ((pstrClone == NULL) ?
+          return ((pstrClone == nullptr) ?
                   (SetLastError(ERROR_INVALID_PARAMETER), FALSE) :
                   (pstrClone->Copy( *this))
                   );
@@ -160,7 +160,7 @@ public:
     //
 
     static DWORD CalcLength( const CHAR * str,
-                                    LPDWORD pcStrings = NULL );
+                                    LPDWORD pcStrings = nullptr );
 
     //
     // Determine if the MULTISZA contains a specific string.
@@ -185,11 +185,11 @@ public:
     //
 
     const CHAR * First( VOID ) const
-        { return *QueryStr() == L'\0' ? NULL : QueryStr(); }
+        { return *QueryStr() == L'\0' ? nullptr : QueryStr(); }
 
     const CHAR * Next( const CHAR * Current ) const
         { Current += ::strlen( Current ) + 1;
-          return *Current == L'\0' ? NULL : Current; }
+          return *Current == L'\0' ? nullptr : Current; }
 
     BOOL
     Equals(

src/Servers/IIS/AspNetCoreModuleV2/IISLib/reftrace.h

@@ -23,7 +23,7 @@ extern "C" {
 
 // No-op value for the Context1,2,3 parameters of WriteRefTraceLogEx
 //#define REF_TRACE_EMPTY_CONTEXT ((PVOID) -1)
-#define REF_TRACE_EMPTY_CONTEXT NULL
+#define REF_TRACE_EMPTY_CONTEXT nullptr
 
 
 //

src/Servers/IIS/AspNetCoreModuleV2/IISLib/rwlock.h

@@ -160,21 +160,25 @@ public:
         return S_OK;
     }
 
+    _Acquires_shared_lock_(this->m_rwLock)
     void SharedAcquire()
     {
         AcquireSRWLockShared(&m_rwLock);
     }
-    
+
+    _Releases_shared_lock_(this->m_rwLock)
     void SharedRelease()
     {
         ReleaseSRWLockShared(&m_rwLock);
     }
 
+    _Acquires_exclusive_lock_(this->m_rwLock)
     void ExclusiveAcquire()
     {
         AcquireSRWLockExclusive(&m_rwLock);
     }
-    
+
+    _Releases_exclusive_lock_(this->m_rwLock)
     void ExclusiveRelease()
     {
         ReleaseSRWLockExclusive(&m_rwLock);

src/Servers/IIS/AspNetCoreModuleV2/IISLib/stringa.cpp

@@ -32,7 +32,7 @@ STRA::STRA(
 
 --*/
 {
-    _ASSERTE( NULL != pbInit );
+    _ASSERTE( nullptr != pbInit );
     _ASSERTE( cchInit > 0 );
     _ASSERTE( pbInit[0] == '\0' );
 }
@@ -51,7 +51,7 @@ STRA::Equals(
     __in BOOL   fIgnoreCase /*= FALSE*/
 ) const
 {
-    _ASSERTE( NULL != pszRhs );
+    _ASSERTE( nullptr != pszRhs );
 
     if( fIgnoreCase )
     {
@@ -67,7 +67,7 @@ STRA::Equals(
     __in BOOL           fIgnoreCase /*= FALSE*/
 ) const
 {
-    _ASSERTE( NULL != pstrRhs );
+    _ASSERTE( nullptr != pstrRhs );
     return Equals( pstrRhs->QueryStr(), fIgnoreCase );
 }
 
@@ -135,6 +135,12 @@ STRA::QueryStr(
     return m_Buff.QueryPtr();
 }
 
+VOID STRA::EnsureNullTerminated()
+{
+    // m_cchLen represents the string's length, not the underlying buffer length
+    m_Buff.QueryPtr()[m_cchLen] = '\0';
+}
+
 VOID
 STRA::Reset(
 )
@@ -142,7 +148,7 @@ STRA::Reset(
 // Resets the internal string to be NULL string. Buffer remains cached.
 //
 {
-    _ASSERTE( QueryStr() != NULL );
+    _ASSERTE( QueryStr() != nullptr );
     *(QueryStr()) = '\0';
     m_cchLen = 0;
 }
@@ -220,7 +226,7 @@ STRA::Copy(
     __in const STRA * pstrRhs
 )
 {
-    _ASSERTE( pstrRhs != NULL );
+    _ASSERTE( pstrRhs != nullptr );
     return Copy( pstrRhs->QueryStr(), pstrRhs->QueryCCH() );
 }
 
@@ -323,7 +329,7 @@ STRA::Append(
     __in const STRA * pstrRhs
 )
 {
-    _ASSERTE( pstrRhs != NULL );
+    _ASSERTE( pstrRhs != nullptr );
     return Append( pstrRhs->QueryStr(), pstrRhs->QueryCCH() );
 }
 
@@ -382,8 +388,8 @@ STRA::CopyToBuffer(
 // Makes a copy of the stored string into the given buffer
 //
 {
-    _ASSERTE( NULL != pszBuffer );
-    _ASSERTE( NULL != pcb );
+    _ASSERTE( nullptr != pszBuffer );
+    _ASSERTE( nullptr != pcb );
 
     HRESULT hr          = S_OK;
     DWORD   cbNeeded    = QueryCB() + sizeof( CHAR );
@@ -464,6 +470,7 @@ Return Value:
 
     HRESULT hr = SafeVsnprintf(pszFormatString, argsList);
 
+#pragma warning(suppress: 26477) // va_end uses 0
     va_end( argsList );
     return hr;
 }
@@ -675,7 +682,7 @@ Return Value:
 --*/
 {
     LPCSTR  pch     = QueryStr();
-    __analysis_assume( pch != NULL );
+    __analysis_assume( pch != nullptr );
     int     i      = 0;
     BYTE    ch;
     HRESULT hr      = S_OK;
@@ -695,7 +702,7 @@ Return Value:
 
     _ASSERTE( pch );
 
-    while (pch[i] != NULL)
+    while ((DWORD)i < m_cchLen && pch[i] != NULL)
     {
         //
         //  Escape characters that are in the non-printable range
@@ -859,8 +866,8 @@ Return Value:
                                         1,
                                         static_cast<LPSTR>(pDest),
                                         6,
-                                        NULL,
-                                        NULL);
+                                        nullptr,
+                                        nullptr);
 
             pDest += dwLen;
             pScan += 6;
@@ -1000,7 +1007,7 @@ STRA::AuxAppend(
     __in DWORD      cbOffset
 )
 {
-    _ASSERTE( NULL != pStr );
+    _ASSERTE( nullptr != pStr );
     _ASSERTE( cbOffset <= QueryCB() );
 
     ULONGLONG cb64NewSize = static_cast<ULONGLONG>(cbOffset) + cbLen + sizeof( CHAR );
@@ -1070,8 +1077,8 @@ STRA::AuxAppendW(
         cchAppendW,
         QueryStr() + cbOffset,
         cbAvailable,
-        NULL,
-        NULL
+        nullptr,
+        nullptr
     );
     if( 0 != cbRet )
     {
@@ -1104,10 +1111,10 @@ STRA::AuxAppendW(
         dwFlags,
         pszAppendW,
         cchAppendW,
-        NULL,
+        nullptr,
         0,
-        NULL,
-        NULL
+        nullptr,
+        nullptr
     );
     if( 0 == cbRet )
     {
@@ -1133,8 +1140,8 @@ STRA::AuxAppendW(
         cchAppendW,
         QueryStr() + cbOffset,
         cbAvailable,
-        NULL,
-        NULL
+        nullptr,
+        nullptr
     );
     if( 0 == cbRet )
     {
@@ -1153,7 +1160,7 @@ Finished:
     // ensure we're still NULL terminated in the right spot
     // (regardless of success or failure)
     //
-    QueryStr()[m_cchLen] = '\0';
+    EnsureNullTerminated();
 
     return hr;
 }
@@ -1169,7 +1176,7 @@ STRA::AuxAppendWTruncate(
 // Cheesey WCHAR --> CHAR conversion
 //
 {
-    _ASSERTE( NULL != pszAppendW );
+    _ASSERTE( nullptr != pszAppendW );
     _ASSERTE( 0 == cbOffset || cbOffset == QueryCB() );
 
     if( !pszAppendW )
@@ -1213,8 +1220,8 @@ STRA::ConvertUnicodeToCodePage(
     __in UINT                   uCodePage
 )
 {
-    _ASSERTE(NULL != pszSrcUnicodeString);
-    _ASSERTE(NULL != pbufDstAnsiString);
+    _ASSERTE(nullptr != pszSrcUnicodeString);
+    _ASSERTE(nullptr != pbufDstAnsiString);
 
     DWORD dwFlags;
 
@@ -1233,17 +1240,17 @@ STRA::ConvertUnicodeToCodePage(
                                       dwStringLen,
                                       static_cast<LPSTR>(pbufDstAnsiString->QueryPtr()),
                                       static_cast<int>(pbufDstAnsiString->QuerySize()),
-                                      NULL,
-                                      NULL);
+                                      nullptr,
+                                      nullptr);
     if ((iStrLen == 0) && (GetLastError() == ERROR_INSUFFICIENT_BUFFER)) {
         iStrLen = WideCharToMultiByte(uCodePage,
                                       dwFlags,
                                       pszSrcUnicodeString,
                                       dwStringLen,
-                                      NULL,
+                                      nullptr,
                                       0,
-                                      NULL,
-                                      NULL);
+                                      nullptr,
+                                      nullptr);
         if (iStrLen != 0) {
             // add one just for the extra NULL
             BOOL bTemp = pbufDstAnsiString->Resize(iStrLen + 1);
@@ -1259,8 +1266,8 @@ STRA::ConvertUnicodeToCodePage(
                                               dwStringLen,
                                               static_cast<LPSTR>(pbufDstAnsiString->QueryPtr()),
                                               static_cast<int>(pbufDstAnsiString->QuerySize()),
-                                              NULL,
-                                              NULL);
+                                              nullptr,
+                                              nullptr);
             }
 
         }
@@ -1387,7 +1394,7 @@ STRA::StartsWith(
     __in const STRA *   pStraPrefix,
     __in bool           fIgnoreCase) const
 {
-    _ASSERTE( pStraPrefix != NULL );
+    _ASSERTE( pStraPrefix != nullptr );
     return StartsWith(pStraPrefix->QueryStr(), fIgnoreCase);
 }
 
@@ -1436,7 +1443,7 @@ STRA::StartsWith(
     __in PCSTR          pszPrefix,
     __in bool           fIgnoreCase) const
 {
-    if (pszPrefix == NULL)
+    if (pszPrefix == nullptr)
     {
         return FALSE;
     }
@@ -1488,7 +1495,7 @@ STRA::EndsWith(
     __in const STRA *   pStraSuffix,
     __in bool           fIgnoreCase) const
 {
-    _ASSERTE( pStraSuffix != NULL );
+    _ASSERTE( pStraSuffix != nullptr );
     return EndsWith(pStraSuffix->QueryStr(), fIgnoreCase);
 }
 
@@ -1541,7 +1548,7 @@ STRA::EndsWith(
 {
     PSTR      pszString   = QueryStr();
 
-    if (pszSuffix == NULL)
+    if (pszSuffix == nullptr)
     {
         return FALSE;
     }

src/Servers/IIS/AspNetCoreModuleV2/IISLib/stringa.h

@@ -143,6 +143,9 @@ public:
     QueryStr(
     ) const;
 
+
+    VOID EnsureNullTerminated();
+
     VOID
     Reset(
     );

src/Servers/IIS/AspNetCoreModuleV2/IISLib/tracelog.c

@@ -46,7 +46,7 @@ Return Value:
     ULONG ulEntrySize = 0;
     ULONG ulTmpResult = 0;
     ULONG ulExtraBytesInHeader = 0;
-    PTRACE_LOG log = NULL;
+    PTRACE_LOG log = nullptr;
     HRESULT hr = S_OK;
 
     //
@@ -74,7 +74,7 @@ Return Value:
     if ( FAILED(hr) )
     { 
         SetLastError( ERROR_ARITHMETIC_OVERFLOW );
-        return NULL;
+        return nullptr;
     }
 
     //
@@ -85,7 +85,7 @@ Return Value:
     if ( FAILED(hr) )
     { 
         SetLastError( ERROR_ARITHMETIC_OVERFLOW );
-        return NULL;
+        return nullptr;
     }
   
     //
@@ -96,13 +96,13 @@ Return Value:
     if ( FAILED(hr) )
     { 
         SetLastError( ERROR_ARITHMETIC_OVERFLOW );
-        return NULL;
+        return nullptr;
     }
 
     if ( ulTotalSize > (ULONG) 0x7FFFFFFF )
     { 
         SetLastError( ERROR_ARITHMETIC_OVERFLOW );
-        return NULL;
+        return nullptr;
     }
 
     //
@@ -115,7 +115,7 @@ Return Value:
     // Initialize it.
     //
 
-    if( log != NULL ) {
+    if( log != nullptr ) {
 
         RtlZeroMemory( log, ulTotalSize );
 
@@ -151,7 +151,7 @@ Return Value:
 
 --*/
 {
-        if ( Log != NULL ) {
+        if ( Log != nullptr ) {
         //DBG_ASSERT( Log->Signature == TRACE_LOG_SIGNATURE );
 
         Log->Signature = TRACE_LOG_SIGNATURE_X;

src/Servers/IIS/AspNetCoreModuleV2/IISLib/util.cpp

@@ -47,6 +47,9 @@ Return Values:
                 // we need to change it to Win32 from ("\\?\")
                 //
 
+                // Buffer overrun while writing to 'pstrPath->QueryStr()'
+                // We know it's not an overrun because we just copied pszName into pstrPath and pszName is at least 4 in length
+#pragma warning(suppress: 6386)
                 pstrPath->QueryStr()[2] = L'?';
             }
 

src/Servers/IIS/AspNetCoreModuleV2/InProcessRequestHandler/StartupExceptionApplication.h

@@ -24,7 +24,7 @@ public:
         m_error(errorPageContent),
         m_statusCode(statusCode),
         m_subStatusCode(subStatusCode),
-        m_statusText(std::move(statusText)),
+        m_statusText(statusText),
         InProcessApplicationBase(pServer, pApplication)
     {
     }

src/Servers/IIS/AspNetCoreModuleV2/InProcessRequestHandler/dllmain.cpp

@@ -24,10 +24,10 @@ DECLARE_DEBUG_PRINT_OBJECT("aspnetcorev2_inprocess.dll");
 BOOL                g_fGlobalInitialize = FALSE;
 BOOL                g_fProcessDetach = FALSE;
 SRWLOCK             g_srwLockRH;
-IHttpServer *       g_pHttpServer = NULL;
+IHttpServer *       g_pHttpServer = nullptr;
 HINSTANCE           g_hWinHttpModule;
 HINSTANCE           g_hAspNetCoreModule;
-HANDLE              g_hEventLog = NULL;
+HANDLE              g_hEventLog = nullptr;
 bool                g_fInProcessApplicationCreated = false;
 std::string         g_errorPageContent;
 HINSTANCE           g_hServerModule;
@@ -50,11 +50,11 @@ InitializeGlobalConfiguration(
 
             if (pServer->IsCommandLineLaunch())
             {
-                g_hEventLog = RegisterEventSource(NULL, ASPNETCORE_IISEXPRESS_EVENT_PROVIDER);
+                g_hEventLog = RegisterEventSource(nullptr, ASPNETCORE_IISEXPRESS_EVENT_PROVIDER);
             }
             else
             {
-                g_hEventLog = RegisterEventSource(NULL, ASPNETCORE_EVENT_PROVIDER);
+                g_hEventLog = RegisterEventSource(nullptr, ASPNETCORE_EVENT_PROVIDER);
             }
 
             DebugInitializeFromConfig(*pServer, *pHttpApplication);
@@ -85,6 +85,7 @@ BOOL APIENTRY DllMain(HMODULE hModule,
         IN_PROCESS_HANDLER::StaticTerminate();
         ALLOC_CACHE_HANDLER::StaticTerminate();
         DebugStop();
+        break;
     default:
         break;
     }

src/Servers/IIS/AspNetCoreModuleV2/InProcessRequestHandler/inprocessapplication.cpp

@@ -14,7 +14,7 @@
 #include "Environment.h"
 #include "HostFxr.h"
 
-IN_PROCESS_APPLICATION* IN_PROCESS_APPLICATION::s_Application = NULL;
+IN_PROCESS_APPLICATION* IN_PROCESS_APPLICATION::s_Application = nullptr;
 
 IN_PROCESS_APPLICATION::IN_PROCESS_APPLICATION(
     IHttpServer& pHttpServer,
@@ -327,11 +327,11 @@ IN_PROCESS_APPLICATION::ExecuteApplication()
 
         if (m_pConfig->QueryCallStartupHook())
         {
-            PWSTR startupHookValue = NULL;
+            PWSTR startupHookValue = nullptr;
             // Will get property not found if the environment variable isn't set.
             context->m_hostFxr.GetRuntimePropertyValue(DOTNETCORE_STARTUP_HOOK, &startupHookValue);
 
-            if (startupHookValue == NULL)
+            if (startupHookValue == nullptr)
             {
                 RETURN_IF_NOT_ZERO(context->m_hostFxr.SetRuntimePropertyValue(DOTNETCORE_STARTUP_HOOK, ASPNETCORE_STARTUP_ASSEMBLY));
             }

src/Servers/IIS/AspNetCoreModuleV2/InProcessRequestHandler/inprocesshandler.cpp

@@ -6,7 +6,7 @@
 #include "ShuttingDownApplication.h"
 #include "ntassert.h"
 
-ALLOC_CACHE_HANDLER * IN_PROCESS_HANDLER::sm_pAlloc = NULL;
+ALLOC_CACHE_HANDLER * IN_PROCESS_HANDLER::sm_pAlloc = nullptr;
 
 IN_PROCESS_HANDLER::IN_PROCESS_HANDLER(
     _In_ std::unique_ptr<IN_PROCESS_APPLICATION, IAPPLICATION_DELETER> pApplication,
@@ -37,7 +37,7 @@ IN_PROCESS_HANDLER::ExecuteRequestHandler()
 {
     ::RaiseEvent<ANCMEvents::ANCM_INPROC_EXECUTE_REQUEST_START>(m_pW3Context, nullptr);
 
-    if (m_pRequestHandler == NULL)
+    if (m_pRequestHandler == nullptr)
     {
         ::RaiseEvent<ANCMEvents::ANCM_INPROC_EXECUTE_REQUEST_COMPLETION>(m_pW3Context, nullptr, RQ_NOTIFICATION_FINISH_REQUEST);
         return RQ_NOTIFICATION_FINISH_REQUEST;
@@ -198,10 +198,10 @@ IN_PROCESS_HANDLER::SetManagedHttpContext(
 // static
 void * IN_PROCESS_HANDLER::operator new(size_t)
 {
-    DBG_ASSERT(sm_pAlloc != NULL);
-    if (sm_pAlloc == NULL)
+    DBG_ASSERT(sm_pAlloc != nullptr);
+    if (sm_pAlloc == nullptr)
     {
-        return NULL;
+        return nullptr;
     }
     return sm_pAlloc->Alloc();
 }
@@ -209,8 +209,8 @@ void * IN_PROCESS_HANDLER::operator new(size_t)
 // static
 void IN_PROCESS_HANDLER::operator delete(void * pMemory)
 {
-    DBG_ASSERT(sm_pAlloc != NULL);
-    if (sm_pAlloc != NULL)
+    DBG_ASSERT(sm_pAlloc != nullptr);
+    if (sm_pAlloc != nullptr)
     {
         sm_pAlloc->Free(pMemory);
     }
@@ -234,7 +234,7 @@ HRESULT
     HRESULT                         hr = S_OK;
 
     sm_pAlloc = new ALLOC_CACHE_HANDLER;
-    if (sm_pAlloc == NULL)
+    if (sm_pAlloc == nullptr)
     {
         hr = E_OUTOFMEMORY;
         goto Finished;
@@ -255,9 +255,9 @@ Finished:
 void
 IN_PROCESS_HANDLER::StaticTerminate(VOID)
 {
-    if (sm_pAlloc != NULL)
+    if (sm_pAlloc != nullptr)
     {
         delete sm_pAlloc;
-        sm_pAlloc = NULL;
+        sm_pAlloc = nullptr;
     }
 }

src/Servers/IIS/AspNetCoreModuleV2/InProcessRequestHandler/managedexports.cpp

@@ -29,7 +29,7 @@ public:
         PCSTR
         GetTrailer(
             _In_  PCSTR    pszHeaderName,
-            _Out_ USHORT* pcchHeaderValue = NULL
+            _Out_ USHORT* pcchHeaderValue = nullptr
         ) const = 0;
 
     virtual
@@ -70,7 +70,7 @@ register_callbacks(
     _In_ VOID* pvShutdownHandlerContext
 )
 {
-    if (pInProcessApplication == NULL)
+    if (pInProcessApplication == nullptr)
     {
         return E_INVALIDARG;
     }
@@ -117,6 +117,8 @@ http_get_server_variable(
     PCWSTR pszVariableValue;
     DWORD cbLength;
 
+    *pwszReturn = nullptr;
+
     HRESULT hr = pInProcessHandler
         ->QueryHttpContext()
         ->GetServerVariable(pszVariableName, &pszVariableValue, &cbLength);
@@ -128,7 +130,7 @@ http_get_server_variable(
 
     *pwszReturn = SysAllocString(pszVariableValue);
 
-    if (*pwszReturn == NULL)
+    if (*pwszReturn == nullptr)
     {
         hr = E_OUTOFMEMORY;
         goto Finished;
@@ -245,7 +247,7 @@ http_get_application_properties(
 )
 {
     auto pInProcessApplication = IN_PROCESS_APPLICATION::GetInstance();
-    if (pInProcessApplication == NULL)
+    if (pInProcessApplication == nullptr)
     {
         return E_FAIL;
     }
@@ -276,8 +278,9 @@ http_read_request_bytes(
 )
 {
     HRESULT hr = S_OK;
+    *pvBuffer = 0;
 
-    if (pInProcessHandler == NULL)
+    if (pInProcessHandler == nullptr)
     {
         return E_FAIL;
     }
@@ -522,7 +525,7 @@ EXTERN_C __declspec(dllexport)
 HRESULT
 http_stop_calls_into_managed(_In_ IN_PROCESS_APPLICATION* pInProcessApplication)
 {
-    if (pInProcessApplication == NULL)
+    if (pInProcessApplication == nullptr)
     {
         return E_INVALIDARG;
     }
@@ -535,7 +538,7 @@ EXTERN_C __declspec(dllexport)
 HRESULT
 http_stop_incoming_requests(_In_ IN_PROCESS_APPLICATION* pInProcessApplication)
 {
-    if (pInProcessApplication == NULL)
+    if (pInProcessApplication == nullptr)
     {
         return E_INVALIDARG;
     }

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/dllmain.cpp

@@ -16,12 +16,12 @@ BOOL                g_fProcessDetach = FALSE;
 DWORD               g_OptionalWinHttpFlags = 0;
 DWORD               g_dwTlsIndex = TLS_OUT_OF_INDEXES;
 SRWLOCK             g_srwLockRH;
-HINTERNET           g_hWinhttpSession = NULL;
-IHttpServer *       g_pHttpServer = NULL;
+HINTERNET           g_hWinhttpSession = nullptr;
+IHttpServer *       g_pHttpServer = nullptr;
 HINSTANCE           g_hWinHttpModule;
 HINSTANCE           g_hOutOfProcessRHModule;
 HINSTANCE           g_hAspNetCoreModule;
-HANDLE              g_hEventLog = NULL;
+HANDLE              g_hEventLog = nullptr;
 
 VOID
 InitializeGlobalConfiguration(
@@ -45,11 +45,11 @@ InitializeGlobalConfiguration(
         g_pHttpServer = pServer;
         if (pServer->IsCommandLineLaunch())
         {
-            g_hEventLog = RegisterEventSource(NULL, ASPNETCORE_IISEXPRESS_EVENT_PROVIDER);
+            g_hEventLog = RegisterEventSource(nullptr, ASPNETCORE_IISEXPRESS_EVENT_PROVIDER);
         }
         else
         {
-            g_hEventLog = RegisterEventSource(NULL, ASPNETCORE_EVENT_PROVIDER);
+            g_hEventLog = RegisterEventSource(nullptr, ASPNETCORE_EVENT_PROVIDER);
         }
 
         if (RegOpenKeyEx(HKEY_LOCAL_MACHINE,
@@ -65,7 +65,7 @@ InitializeGlobalConfiguration(
             cbData = sizeof(dwData);
             if ((RegQueryValueEx(hKey,
                 L"OptionalWinHttpFlags",
-                NULL,
+                nullptr,
                 &dwType,
                 (LPBYTE)&dwData,
                 &cbData) == NO_ERROR) &&
@@ -77,7 +77,7 @@ InitializeGlobalConfiguration(
             cbData = sizeof(dwData);
             if ((RegQueryValueEx(hKey,
                 L"EnableReferenceCountTracing",
-                NULL,
+                nullptr,
                 &dwType,
                 (LPBYTE)&dwData,
                 &cbData) == NO_ERROR) &&
@@ -151,12 +151,16 @@ EnsureOutOfProcessInitializtion(IHttpApplication *pHttpApplication)
             }
         }
 
+#pragma warning(push)
+#pragma warning(disable: 26477) // NULL usage via Windows header
         g_hWinhttpSession = WinHttpOpen(L"",
             WINHTTP_ACCESS_TYPE_NO_PROXY,
             WINHTTP_NO_PROXY_NAME,
             WINHTTP_NO_PROXY_BYPASS,
             WINHTTP_FLAG_ASYNC);
-        FINISHED_LAST_ERROR_IF(g_hWinhttpSession == NULL);
+#pragma warning(pop)
+
+        FINISHED_LAST_ERROR_IF(g_hWinhttpSession == nullptr);
 
         //
         // Don't set non-blocking callbacks WINHTTP_OPTION_ASSURED_NON_BLOCKING_CALLBACKS,
@@ -171,7 +175,7 @@ EnsureOutOfProcessInitializtion(IHttpApplication *pHttpApplication)
             FORWARDING_HANDLER::OnWinHttpCompletion,
             (WINHTTP_CALLBACK_FLAG_ALL_COMPLETIONS |
                 WINHTTP_CALLBACK_STATUS_SENDING_REQUEST),
-            NULL) == WINHTTP_INVALID_STATUS_CALLBACK);
+            0) == WINHTTP_INVALID_STATUS_CALLBACK);
 
         //
         // Make sure we see the redirects (rather than winhttp doing it
@@ -219,6 +223,7 @@ BOOL APIENTRY DllMain(HMODULE hModule,
         FORWARDING_HANDLER::StaticTerminate();
         ALLOC_CACHE_HANDLER::StaticTerminate();
         DebugStop();
+        break;
     default:
         break;
     }

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/forwarderconnection.cpp

@@ -7,7 +7,7 @@
 FORWARDER_CONNECTION::FORWARDER_CONNECTION(
     VOID
 ) : m_cRefs (1),
-    m_hConnection (NULL)
+    m_hConnection (nullptr)
 {
 }
 

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/forwarderconnection.h

@@ -88,10 +88,10 @@ private:
 
     ~FORWARDER_CONNECTION()
     {
-        if (m_hConnection != NULL)
+        if (m_hConnection != nullptr)
         {
             WinHttpCloseHandle(m_hConnection);
-            m_hConnection = NULL;
+            m_hConnection = nullptr;
         }
     }
 

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/forwardinghandler.cpp

@@ -20,10 +20,10 @@ C_ASSERT(sizeof(FORWARDING_HANDLER) <= 632);
 #define FORWARDING_HANDLER_SIGNATURE        ((DWORD)'FHLR')
 #define FORWARDING_HANDLER_SIGNATURE_FREE   ((DWORD)'fhlr')
 
-ALLOC_CACHE_HANDLER *       FORWARDING_HANDLER::sm_pAlloc = NULL;
-TRACE_LOG *                 FORWARDING_HANDLER::sm_pTraceLog = NULL;
+ALLOC_CACHE_HANDLER *       FORWARDING_HANDLER::sm_pAlloc = nullptr;
+TRACE_LOG *                 FORWARDING_HANDLER::sm_pTraceLog = nullptr;
 PROTOCOL_CONFIG             FORWARDING_HANDLER::sm_ProtocolConfig;
-RESPONSE_HEADER_HASH *      FORWARDING_HANDLER::sm_pResponseHeaderHash = NULL;
+RESPONSE_HEADER_HASH *      FORWARDING_HANDLER::sm_pResponseHeaderHash = nullptr;
 
 FORWARDING_HANDLER::FORWARDING_HANDLER(
     _In_ IHttpContext                  *pW3Context,
@@ -36,12 +36,12 @@ FORWARDING_HANDLER::FORWARDING_HANDLER(
     m_fDoReverseRewriteHeaders(FALSE),
     m_fFinishRequest(FALSE),
     m_fHasError(FALSE),
-    m_pszHeaders(NULL),
+    m_pszHeaders(nullptr),
     m_cchHeaders(0),
     m_BytesToReceive(0),
     m_BytesToSend(0),
     m_fWebSocketEnabled(FALSE),
-    m_pWebSocket(NULL),
+    m_pWebSocket(nullptr),
     m_dwHandlers (1), // default http handler
     m_fDoneAsyncCompletion(FALSE),
     m_fHttpHandleInClose(FALSE),
@@ -87,7 +87,7 @@ FORWARDING_HANDLER::~FORWARDING_HANDLER(
     if (m_pWebSocket)
     {
         m_pWebSocket->Terminate();
-        m_pWebSocket = NULL;
+        m_pWebSocket = nullptr;
     }
 }
 
@@ -100,12 +100,12 @@ FORWARDING_HANDLER::ExecuteRequestHandler()
     BOOL                        fRequestLocked = FALSE;
     BOOL                        fFailedToStartKestrel = FALSE;
     BOOL                        fSecure = FALSE;
-    HINTERNET                   hConnect = NULL;
+    HINTERNET                   hConnect = nullptr;
     IHttpRequest               *pRequest = m_pW3Context->GetRequest();
     IHttpResponse              *pResponse = m_pW3Context->GetResponse();
-    IHttpConnection            *pClientConnection = NULL;
+    IHttpConnection            *pClientConnection = nullptr;
     PROTOCOL_CONFIG            *pProtocol = &sm_ProtocolConfig;
-    SERVER_PROCESS             *pServerProcess = NULL;
+    SERVER_PROCESS             *pServerProcess = nullptr;
 
     USHORT                      cchHostName = 0;
 
@@ -124,13 +124,13 @@ FORWARDING_HANDLER::ExecuteRequestHandler()
 
     // check connection
     pClientConnection = m_pW3Context->GetConnection();
-    if (pClientConnection == NULL ||
+    if (pClientConnection == nullptr ||
         !pClientConnection->IsConnected())
     {
         FAILURE(HRESULT_FROM_WIN32(WSAECONNRESET));
     }
 
-    if (m_pApplication == NULL)
+    if (m_pApplication == nullptr)
     {
         FAILURE(E_INVALIDARG);
     }
@@ -142,13 +142,13 @@ FORWARDING_HANDLER::ExecuteRequestHandler()
         FAILURE(hr);
     }
 
-    if (pServerProcess == NULL)
+    if (pServerProcess == nullptr)
     {
         fFailedToStartKestrel = TRUE;
         FAILURE(HRESULT_FROM_WIN32(ERROR_CREATE_FAILED));
     }
 
-    if (pServerProcess->QueryWinHttpConnection() == NULL)
+    if (pServerProcess->QueryWinHttpConnection() == nullptr)
     {
         FAILURE(HRESULT_FROM_WIN32(ERROR_INVALID_HANDLE));
     }
@@ -200,11 +200,11 @@ FORWARDING_HANDLER::ExecuteRequestHandler()
     // before staring a WinHTTP operation.
     //
     DBG_ASSERT(fRequestLocked);
-    DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == NULL);
+    DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == nullptr);
     TlsSetValue(g_dwTlsIndex, this);
     DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == this);
 
-    if (m_hRequest == NULL)
+    if (m_hRequest == nullptr)
     {
         FAILURE(HRESULT_FROM_WIN32(WSAECONNRESET));
     }
@@ -219,7 +219,7 @@ FORWARDING_HANDLER::ExecuteRequestHandler()
     //
     DWORD cbContentLength = 0;
     PCSTR pszContentLength = pRequest->GetHeader(HttpHeaderContentLength);
-    if (pszContentLength != NULL)
+    if (pszContentLength != nullptr)
     {
         cbContentLength = m_BytesToReceive = atol(pszContentLength);
         if (m_BytesToReceive == INFINITE)
@@ -227,7 +227,7 @@ FORWARDING_HANDLER::ExecuteRequestHandler()
             FAILURE(HRESULT_FROM_WIN32(WSAECONNRESET));
         }
     }
-    else if (pRequest->GetHeader(HttpHeaderTransferEncoding) != NULL)
+    else if (pRequest->GetHeader(HttpHeaderTransferEncoding) != nullptr)
     {
         m_BytesToReceive = INFINITE;
     }
@@ -239,7 +239,7 @@ FORWARDING_HANDLER::ExecuteRequestHandler()
         //
         if (!WinHttpSetOption(m_hRequest,
             WINHTTP_OPTION_UPGRADE_TO_WEB_SOCKET,
-            NULL,
+            nullptr,
             0))
         {
             FINISHED(HRESULT_FROM_WIN32(GetLastError()));
@@ -253,16 +253,16 @@ FORWARDING_HANDLER::ExecuteRequestHandler()
     {
         ANCMEvents::ANCM_REQUEST_FORWARD_START::RaiseEvent(
             m_pW3Context->GetTraceContext(),
-            NULL);
+            nullptr);
     }
 
     if (!WinHttpSendRequest(m_hRequest,
         m_pszHeaders,
         m_cchHeaders,
-        NULL,
+        nullptr,
         0,
         cbContentLength,
-        reinterpret_cast<DWORD_PTR>(static_cast<PVOID>(this))))
+        reinterpret_cast<DWORD_PTR>(this)))
     {
         hr = HRESULT_FROM_WIN32(GetLastError());
 
@@ -273,7 +273,7 @@ FORWARDING_HANDLER::ExecuteRequestHandler()
         {
             ANCMEvents::ANCM_REQUEST_FORWARD_FAIL::RaiseEvent(
                 m_pW3Context->GetTraceContext(),
-                NULL,
+                nullptr,
                 hr);
         }
 
@@ -338,9 +338,9 @@ Finished:
     if (fRequestLocked)
     {
         DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == this);
-        TlsSetValue(g_dwTlsIndex, NULL);
+        TlsSetValue(g_dwTlsIndex, nullptr);
         ReleaseSRWLockShared(&m_RequestLock);
-        DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == NULL);
+        DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == nullptr);
     }
 
     DereferenceRequestHandler();
@@ -382,8 +382,8 @@ REQUEST_NOTIFICATION_STATUS
     BOOL                        fClosed = FALSE;
     BOOL                        fWebSocketUpgraded = FALSE;
 
-    DBG_ASSERT(m_pW3Context != NULL);
-    __analysis_assume(m_pW3Context != NULL);
+    DBG_ASSERT(m_pW3Context != nullptr);
+    __analysis_assume(m_pW3Context != nullptr);
 
     //
     // Take a reference so that object does not go away as a result of
@@ -391,7 +391,7 @@ REQUEST_NOTIFICATION_STATUS
     //
     ReferenceRequestHandler();
 
-    if (sm_pTraceLog != NULL)
+    if (sm_pTraceLog != nullptr)
     {
         WriteRefTraceLogEx(sm_pTraceLog,
             m_cRefs,
@@ -424,7 +424,7 @@ REQUEST_NOTIFICATION_STATUS
         // This should be the write completion of the 101 response.
         //
         m_pWebSocket = new WEBSOCKET_HANDLER();
-        if (m_pWebSocket == NULL)
+        if (m_pWebSocket == nullptr)
         {
             FAILURE(E_OUTOFMEMORY);
         }
@@ -447,7 +447,7 @@ REQUEST_NOTIFICATION_STATUS
         m_fHttpHandleInClose = TRUE;
         fClosed = WinHttpCloseHandle(m_hRequest);
         DBG_ASSERT(fClosed);
-        m_hRequest = NULL;
+        m_hRequest = nullptr;
 
         if (!fClosed)
         {
@@ -490,7 +490,7 @@ REQUEST_NOTIFICATION_STATUS
 
     default:
         DBG_ASSERT(m_RequestStatus == FORWARDER_DONE);
-        if (m_hRequest == NULL && m_pWebSocket == NULL)
+        if (m_hRequest == nullptr && m_pWebSocket == nullptr)
         {
             // Request must have been done
             if (!m_fFinishRequest)
@@ -567,7 +567,7 @@ Failure:
                     0,
                     strDescription.QueryStr(),
                     strDescription.QuerySizeCCH(),
-                    NULL);
+                    nullptr);
             }
             else
             {
@@ -598,17 +598,17 @@ Failure:
         }
     }
 
-    if (m_pWebSocket != NULL && !m_fWebSocketHandleInClose)
+    if (m_pWebSocket != nullptr && !m_fWebSocketHandleInClose)
     {
         m_fWebSocketHandleInClose = TRUE;
         m_pWebSocket->TerminateRequest();
     }
 
-    if (m_hRequest != NULL && !m_fHttpHandleInClose)
+    if (m_hRequest != nullptr && !m_fHttpHandleInClose)
     {
         m_fHttpHandleInClose = TRUE;
         WinHttpCloseHandle(m_hRequest);
-        m_hRequest = NULL;
+        m_hRequest = nullptr;
     }
 
 Finished:
@@ -694,33 +694,33 @@ Finished:
 VOID
 FORWARDING_HANDLER::StaticTerminate()
 {
-    if (sm_pResponseHeaderHash != NULL)
+    if (sm_pResponseHeaderHash != nullptr)
     {
         sm_pResponseHeaderHash->Clear();
         delete sm_pResponseHeaderHash;
-        sm_pResponseHeaderHash = NULL;
+        sm_pResponseHeaderHash = nullptr;
     }
 
-    if (sm_pTraceLog != NULL)
+    if (sm_pTraceLog != nullptr)
     {
         DestroyRefTraceLog(sm_pTraceLog);
-        sm_pTraceLog = NULL;
+        sm_pTraceLog = nullptr;
     }
 
-    if (sm_pAlloc != NULL)
+    if (sm_pAlloc != nullptr)
     {
         delete sm_pAlloc;
-        sm_pAlloc = NULL;
+        sm_pAlloc = nullptr;
     }
 }
 
 // static
 void * FORWARDING_HANDLER::operator new(size_t)
 {
-    DBG_ASSERT(sm_pAlloc != NULL);
-    if (sm_pAlloc == NULL)
+    DBG_ASSERT(sm_pAlloc != nullptr);
+    if (sm_pAlloc == nullptr)
     {
-        return NULL;
+        return nullptr;
     }
     return sm_pAlloc->Alloc();
 }
@@ -728,8 +728,8 @@ void * FORWARDING_HANDLER::operator new(size_t)
 // static
 void FORWARDING_HANDLER::operator delete(void * pMemory)
 {
-    DBG_ASSERT(sm_pAlloc != NULL);
-    if (sm_pAlloc != NULL)
+    DBG_ASSERT(sm_pAlloc != nullptr);
+    if (sm_pAlloc != nullptr)
     {
         sm_pAlloc->Free(pMemory);
     }
@@ -797,13 +797,13 @@ FORWARDING_HANDLER::GetHeaders(
     // iterate the list of headers to be removed and delete them from the request.
     //
 
-    while (ppHeadersToBeRemoved != NULL)
+    while (ppHeadersToBeRemoved != nullptr)
     {
         m_pW3Context->GetRequest()->DeleteHeader(ppHeadersToBeRemoved);
         ppHeadersToBeRemoved = mszMsAspNetCoreHeaders.Next(ppHeadersToBeRemoved);
     }
 
-    if (pServerProcess->QueryGuid() != NULL)
+    if (pServerProcess->QueryGuid() != nullptr)
     {
         RETURN_IF_FAILED(m_pW3Context->GetRequest()->SetHeader("MS-ASPNETCORE-TOKEN",
             pServerProcess->QueryGuid(),
@@ -815,10 +815,10 @@ FORWARDING_HANDLER::GetHeaders(
         (_wcsicmp(m_pW3Context->GetUser()->GetAuthenticationType(), L"negotiate") == 0 ||
             _wcsicmp(m_pW3Context->GetUser()->GetAuthenticationType(), L"ntlm") == 0))
     {
-        if (m_pW3Context->GetUser()->GetPrimaryToken() != NULL &&
+        if (m_pW3Context->GetUser()->GetPrimaryToken() != nullptr &&
             m_pW3Context->GetUser()->GetPrimaryToken() != INVALID_HANDLE_VALUE)
         {
-            HANDLE hTargetTokenHandle = NULL;
+            HANDLE hTargetTokenHandle = nullptr;
             RETURN_IF_FAILED(pServerProcess->SetWindowsAuthToken(m_pW3Context->GetUser()->GetPrimaryToken(),
                 &hTargetTokenHandle));
 
@@ -843,7 +843,7 @@ FORWARDING_HANDLER::GetHeaders(
         strTemp.Reset();
 
         pszCurrentHeader = pRequest->GetHeader(pProtocol->QueryXForwardedForName()->QueryStr(), &cchCurrentHeader);
-        if (pszCurrentHeader != NULL)
+        if (pszCurrentHeader != nullptr)
         {
             RETURN_IF_FAILED(strTemp.Copy(pszCurrentHeader, cchCurrentHeader));
             RETURN_IF_FAILED(strTemp.Append(", ", 2));
@@ -884,7 +884,7 @@ FORWARDING_HANDLER::GetHeaders(
     {
         const HTTP_SSL_INFO *pSslInfo = pRequest->GetRawHttpRequest()->pSslInfo;
         LPSTR pszScheme = "http";
-        if (pSslInfo != NULL)
+        if (pSslInfo != nullptr)
         {
             pszScheme = "https";
         }
@@ -892,7 +892,7 @@ FORWARDING_HANDLER::GetHeaders(
         strTemp.Reset();
 
         pszCurrentHeader = pRequest->GetHeader(pProtocol->QuerySslHeaderName()->QueryStr(), &cchCurrentHeader);
-        if (pszCurrentHeader != NULL)
+        if (pszCurrentHeader != nullptr)
         {
             RETURN_IF_FAILED(strTemp.Copy(pszCurrentHeader, cchCurrentHeader));
             RETURN_IF_FAILED(strTemp.Append(", ", 2));
@@ -908,8 +908,8 @@ FORWARDING_HANDLER::GetHeaders(
 
     if (!pProtocol->QueryClientCertName()->IsEmpty())
     {
-        if (pRequest->GetRawHttpRequest()->pSslInfo == NULL ||
-            pRequest->GetRawHttpRequest()->pSslInfo->pClientCertInfo == NULL)
+        if (pRequest->GetRawHttpRequest()->pSslInfo == nullptr ||
+            pRequest->GetRawHttpRequest()->pSslInfo->pClientCertInfo == nullptr)
         {
             pRequest->DeleteHeader(pProtocol->QueryClientCertName()->QueryStr());
         }
@@ -924,7 +924,7 @@ FORWARDING_HANDLER::GetHeaders(
                 pRequest->GetRawHttpRequest()->pSslInfo->pClientCertInfo->CertEncodedSize,
                 strTemp.QueryStr(),
                 strTemp.QuerySize(),
-                NULL);
+                nullptr);
             strTemp.SyncWithBuffer();
 
             RETURN_IF_FAILED(pRequest->SetHeader(
@@ -963,7 +963,7 @@ FORWARDING_HANDLER::CreateWinHttpRequest(
 )
 {
     HRESULT         hr = S_OK;
-    PCWSTR          pszVersion = NULL;
+    PCWSTR          pszVersion = nullptr;
     PCSTR           pszVerb;
     DWORD           dwTimeout = INFINITE;
     STACK_STRU(strVerb, 32);
@@ -976,7 +976,7 @@ FORWARDING_HANDLER::CreateWinHttpRequest(
     FINISHED_IF_FAILED(strVerb.CopyA(pszVerb));
 
     //pszVersion = pProtocol->QueryVersion();
-    if (pszVersion == NULL)
+    if (pszVersion == nullptr)
     {
         DWORD cchUnused;
         FINISHED_IF_FAILED(m_pW3Context->GetServerVariable(
@@ -985,6 +985,8 @@ FORWARDING_HANDLER::CreateWinHttpRequest(
             &cchUnused));
     }
 
+#pragma warning(push)
+#pragma warning(disable: 26477) // NULL usage via Windows header
     m_hRequest = WinHttpOpenRequest(hConnect,
         strVerb.QueryStr(),
         pstrUrl->QueryStr(),
@@ -993,6 +995,7 @@ FORWARDING_HANDLER::CreateWinHttpRequest(
         WINHTTP_DEFAULT_ACCEPT_TYPES,
         WINHTTP_FLAG_ESCAPE_DISABLE_QUERY
         | g_OptionalWinHttpFlags);
+#pragma warning(pop)
 
     FINISHED_LAST_ERROR_IF_NULL (m_hRequest);
 
@@ -1038,7 +1041,7 @@ FORWARDING_HANDLER::CreateWinHttpRequest(
         (WINHTTP_CALLBACK_FLAG_ALL_COMPLETIONS |
             WINHTTP_CALLBACK_FLAG_HANDLES |
             WINHTTP_CALLBACK_STATUS_SENDING_REQUEST),
-        NULL) == WINHTTP_INVALID_STATUS_CALLBACK);
+        0) == WINHTTP_INVALID_STATUS_CALLBACK);
 
     FINISHED_IF_FAILED(GetHeaders(pProtocol,
                     m_pApplication->QueryConfig()->QueryForwardWindowsAuthToken(),
@@ -1060,7 +1063,7 @@ FORWARDING_HANDLER::OnWinHttpCompletion(
 )
 {
     FORWARDING_HANDLER * pThis = static_cast<FORWARDING_HANDLER *>(reinterpret_cast<PVOID>(dwContext));
-    if (pThis == NULL)
+    if (pThis == nullptr)
     {
         //error happened, nothing can be done here
         return;
@@ -1105,11 +1108,11 @@ None
     BOOL fAnotherCompletionExpected = FALSE;
     BOOL fDoPostCompletion = FALSE;
     BOOL fHandleClosing = (dwInternetStatus == WINHTTP_CALLBACK_STATUS_HANDLE_CLOSING);
-    DWORD dwHandlers = 1; // defaullt for http handler
+    DWORD dwHandlers = 1; // default for http handler
 
 
-    DBG_ASSERT(m_pW3Context != NULL);
-    __analysis_assume(m_pW3Context != NULL);
+    DBG_ASSERT(m_pW3Context != nullptr);
+    __analysis_assume(m_pW3Context != nullptr);
     IHttpResponse * pResponse = m_pW3Context->GetResponse();
 
     // Reference the request handler to prevent it from being released prematurely
@@ -1117,14 +1120,14 @@ None
 
     UNREFERENCED_PARAMETER(dwStatusInformationLength);
 
-    if (sm_pTraceLog != NULL)
+    if (sm_pTraceLog != nullptr)
     {
         WriteRefTraceLogEx(sm_pTraceLog,
             m_cRefs,
             this,
             "FORWARDING_HANDLER::OnWinHttpCompletionInternal Enter",
             reinterpret_cast<PVOID>(static_cast<DWORD_PTR>(dwInternetStatus)),
-            NULL);
+            nullptr);
     }
 
     //FREB log
@@ -1132,7 +1135,7 @@ None
     {
         ANCMEvents::ANCM_WINHTTP_CALLBACK::RaiseEvent(
             m_pW3Context->GetTraceContext(),
-            NULL,
+            nullptr,
             dwInternetStatus);
     }
 
@@ -1149,11 +1152,11 @@ None
 
     if (TlsGetValue(g_dwTlsIndex) != this)
     {
-        DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == NULL);
+        DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == nullptr);
         if (m_RequestStatus != FORWARDER_RECEIVED_WEBSOCKET_RESPONSE)
         {
-            // Webscoket has already been guarded by critical section
-            // Only require exclisive lock for non-websocket scenario which has duplex channel
+            // Websocket has already been guarded by critical section
+            // Only require exclusive lock for non-websocket scenario which has duplex channel
             // Otherwise, there will be a deadlock
             AcquireLockExclusive();
             fExclusiveLocked = TRUE;
@@ -1195,7 +1198,7 @@ None
     if (m_RequestStatus == FORWARDER_RECEIVED_WEBSOCKET_RESPONSE)
     {
         fAnotherCompletionExpected = TRUE;
-        if (m_pWebSocket == NULL)
+        if (m_pWebSocket == nullptr)
         {
             goto Finished;
         }
@@ -1280,14 +1283,14 @@ None
         {
             ANCMEvents::ANCM_REQUEST_FORWARD_END::RaiseEvent(
                 m_pW3Context->GetTraceContext(),
-                NULL);
+                nullptr);
         }
         if (m_RequestStatus != FORWARDER_DONE)
         {
             hr = LOG_IF_FAILED(ERROR_CONNECTION_ABORTED);
             fClientError = m_fClientDisconnected;
         }
-        m_hRequest = NULL;
+        m_hRequest = nullptr;
         fAnotherCompletionExpected = FALSE;
         break;
 
@@ -1301,14 +1304,14 @@ None
         //
         DBG_ASSERT(FALSE);
         hr = LOG_IF_FAILED(E_UNEXPECTED);
-        if (sm_pTraceLog != NULL)
+        if (sm_pTraceLog != nullptr)
         {
             WriteRefTraceLogEx(sm_pTraceLog,
                 m_cRefs,
                 this,
                 "FORWARDING_HANDLER::OnWinHttpCompletionInternal Unexpected WinHTTP Status",
                 reinterpret_cast<PVOID>(static_cast<DWORD_PTR>(dwInternetStatus)),
-                NULL);
+                nullptr);
         }
         break;
     }
@@ -1372,7 +1375,7 @@ Failure:
                     0,
                     strDescription.QueryStr(),
                     strDescription.QuerySizeCCH(),
-                    NULL) == 0)
+                    nullptr) == 0)
             {
                 LoadString(g_hAspNetCoreModule,
                     IDS_SERVER_ERROR,
@@ -1396,7 +1399,7 @@ Failure:
     {
         ANCMEvents::ANCM_REQUEST_FORWARD_FAIL::RaiseEvent(
             m_pW3Context->GetTraceContext(),
-            NULL,
+            nullptr,
             hr);
     }
 
@@ -1421,10 +1424,10 @@ Finished:
         RemoveRequest();
         m_fFinishRequest = TRUE;
         fDoPostCompletion = TRUE;
-        if (m_pWebSocket != NULL)
+        if (m_pWebSocket != nullptr)
         {
             m_pWebSocket->Terminate();
-            m_pWebSocket = NULL;
+            m_pWebSocket = nullptr;
         }
     }
     else if (m_RequestStatus == FORWARDER_DONE)
@@ -1433,14 +1436,14 @@ Finished:
         // Error path
         //
         RemoveRequest();
-        if (m_hRequest != NULL && !m_fHttpHandleInClose)
+        if (m_hRequest != nullptr && !m_fHttpHandleInClose)
         {
             m_fHttpHandleInClose = TRUE;
             WinHttpCloseHandle(m_hRequest);
-            m_hRequest = NULL;
+            m_hRequest = nullptr;
         }
 
-        if (m_pWebSocket != NULL && !m_fWebSocketHandleInClose)
+        if (m_pWebSocket != nullptr && !m_fWebSocketHandleInClose)
         {
             m_fWebSocketHandleInClose = TRUE;
             m_pWebSocket->TerminateRequest();
@@ -1475,9 +1478,9 @@ Finished:
     else if (fSharedLocked)
     {
         DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == this);
-        TlsSetValue(g_dwTlsIndex, NULL);
+        TlsSetValue(g_dwTlsIndex, nullptr);
         ReleaseSRWLockShared(&m_RequestLock);
-        DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == NULL);
+        DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == nullptr);
     }
 
     DereferenceRequestHandler();
@@ -1495,6 +1498,8 @@ FORWARDING_HANDLER::OnWinHttpCompletionSendRequestOrWriteComplete(
     HRESULT hr = S_OK;
     IHttpRequest *      pRequest = m_pW3Context->GetRequest();
 
+    *pfClientError = FALSE;
+
     //
     // completion for sending the initial request or request entity to
     // winhttp, get more request entity if available, else start receiving
@@ -1502,27 +1507,27 @@ FORWARDING_HANDLER::OnWinHttpCompletionSendRequestOrWriteComplete(
     //
     if (m_BytesToReceive > 0)
     {
-        if (m_pEntityBuffer == NULL)
+        if (m_pEntityBuffer == nullptr)
         {
             FINISHED_IF_NULL_ALLOC(m_pEntityBuffer = GetNewResponseBuffer(
                 ENTITY_BUFFER_SIZE));
         }
 
-        if (sm_pTraceLog != NULL)
+        if (sm_pTraceLog != nullptr)
         {
             WriteRefTraceLogEx(sm_pTraceLog,
                 m_cRefs,
                 this,
                 "Calling ReadEntityBody",
-                NULL,
-                NULL);
+                nullptr,
+                nullptr);
         }
         hr = pRequest->ReadEntityBody(
             m_pEntityBuffer + 6,
             min(m_BytesToReceive, BUFFER_SIZE),
             TRUE,       // fAsync
-            NULL,       // pcbBytesReceived
-            NULL);      // pfCompletionPending
+            nullptr,       // pcbBytesReceived
+            nullptr);      // pfCompletionPending
         if (hr == HRESULT_FROM_WIN32(ERROR_HANDLE_EOF))
         {
             DBG_ASSERT(m_BytesToReceive == 0 ||
@@ -1548,7 +1553,7 @@ FORWARDING_HANDLER::OnWinHttpCompletionSendRequestOrWriteComplete(
                 if (!WinHttpWriteData(m_hRequest,
                     "0\r\n\r\n",
                     5,
-                    NULL))
+                    nullptr))
                 {
                     FINISHED(HRESULT_FROM_WIN32(GetLastError()));
                     //DereferenceForwardingHandler();
@@ -1577,7 +1582,7 @@ FORWARDING_HANDLER::OnWinHttpCompletionSendRequestOrWriteComplete(
 
     m_RequestStatus = FORWARDER_RECEIVING_RESPONSE;
 
-    FINISHED_LAST_ERROR_IF(!WinHttpReceiveResponse(hRequest, NULL));
+    FINISHED_LAST_ERROR_IF(!WinHttpReceiveResponse(hRequest, nullptr));
     *pfAnotherCompletionExpected = TRUE;
 
 Finished:
@@ -1596,7 +1601,7 @@ FORWARDING_HANDLER::OnWinHttpCompletionStatusHeadersAvailable(
     STACK_STRA(strHeaders, 2048);
     DWORD         dwHeaderSize = bufHeaderBuffer.QuerySize();
 
-    UNREFERENCED_PARAMETER(pfAnotherCompletionExpected);
+    *pfAnotherCompletionExpected = FALSE;
 
     //
     // Headers are available, read the status line and headers and pass
@@ -1605,6 +1610,8 @@ FORWARDING_HANDLER::OnWinHttpCompletionStatusHeadersAvailable(
     // WinHttpQueryHeaders operates synchronously,
     // no need for taking reference.
     //
+#pragma warning(push)
+#pragma warning(disable: 26477) // NULL usage via Windows header
     dwHeaderSize = bufHeaderBuffer.QuerySize();
     if (!WinHttpQueryHeaders(hRequest,
         WINHTTP_QUERY_RAW_HEADERS_CRLF,
@@ -1629,6 +1636,7 @@ FORWARDING_HANDLER::OnWinHttpCompletionStatusHeadersAvailable(
             &dwHeaderSize,
             WINHTTP_NO_HEADER_INDEX));
     }
+#pragma warning(pop)
 
     FINISHED_IF_FAILED(strHeaders.CopyW(reinterpret_cast<PWSTR>(bufHeaderBuffer.QueryPtr())));
 
@@ -1664,8 +1672,8 @@ FORWARDING_HANDLER::OnWinHttpCompletionStatusHeadersAvailable(
         hr = m_pW3Context->GetResponse()->Flush(
             TRUE,
             TRUE,
-            NULL,
-            NULL);
+            nullptr,
+            nullptr);
 
         if (FAILED_LOG(hr))
         {
@@ -1691,6 +1699,8 @@ FORWARDING_HANDLER::OnWinHttpCompletionStatusDataAvailable(
 {
     HRESULT hr = S_OK;
 
+    *pfAnotherCompletionExpected = FALSE;
+
     //
     // Response data is available from winhttp, read it
     //
@@ -1726,7 +1736,7 @@ FORWARDING_HANDLER::OnWinHttpCompletionStatusDataAvailable(
     FINISHED_LAST_ERROR_IF(!WinHttpReadData(hRequest,
         m_pEntityBuffer,
         min(m_BytesToSend, BUFFER_SIZE),
-        NULL));
+        nullptr));
 
     *pfAnotherCompletionExpected = TRUE;
 
@@ -1744,6 +1754,8 @@ FORWARDING_HANDLER::OnWinHttpCompletionStatusReadComplete(
 {
     HRESULT hr = S_OK;
 
+    *pfAnotherCompletionExpected = FALSE;
+
     //
     // Response data has been read from winhttp, send it to the client
     //
@@ -1799,7 +1811,7 @@ FORWARDING_HANDLER::OnWinHttpCompletionStatusReadComplete(
         //
         FINISHED_IF_FAILED(pResponse->Flush(TRUE,     // fAsync
             TRUE,     // fMoreData
-            NULL));    // pcbSent
+            nullptr));    // pcbSent
 
         *pfAnotherCompletionExpected = TRUE;
     }
@@ -1820,6 +1832,8 @@ FORWARDING_HANDLER::OnSendingRequest(
     __out BOOL *                pfClientError
 )
 {
+    *pfClientError = FALSE;
+
     //
     // This is a completion for a read from http.sys, abort in case
     // of failure, if we read anything write it out over WinHTTP,
@@ -1836,13 +1850,13 @@ FORWARDING_HANDLER::OnSendingRequest(
             RETURN_LAST_ERROR_IF(!WinHttpWriteData(m_hRequest,
                 "0\r\n\r\n",
                 5,
-                NULL));
+                nullptr));
         }
         else
         {
             m_RequestStatus = FORWARDER_RECEIVING_RESPONSE;
 
-            RETURN_LAST_ERROR_IF(!WinHttpReceiveResponse(m_hRequest, NULL));
+            RETURN_LAST_ERROR_IF(!WinHttpReceiveResponse(m_hRequest, nullptr));
         }
     }
     else if (SUCCEEDED(hrCompletionStatus))
@@ -1904,7 +1918,7 @@ FORWARDING_HANDLER::OnSendingRequest(
         RETURN_LAST_ERROR_IF(!WinHttpWriteData(m_hRequest,
             m_pEntityBuffer + cbOffset,
             cbCompletion,
-            NULL));
+            nullptr));
     }
     else
     {
@@ -1946,17 +1960,17 @@ FORWARDING_HANDLER::OnReceivingResponse(
         //
         // No buffering enabled.
         //
-        RETURN_LAST_ERROR_IF(!WinHttpQueryDataAvailable(m_hRequest, NULL));
+        RETURN_LAST_ERROR_IF(!WinHttpQueryDataAvailable(m_hRequest, nullptr));
     }
     else
     {
         //
         // Buffering enabled.
         //
-        if (m_pEntityBuffer == NULL)
+        if (m_pEntityBuffer == nullptr)
         {
             m_pEntityBuffer = GetNewResponseBuffer(min(m_BytesToSend, BUFFER_SIZE));
-            if (m_pEntityBuffer == NULL)
+            if (m_pEntityBuffer == nullptr)
             {
                 RETURN_HR(E_OUTOFMEMORY);
             }
@@ -1965,7 +1979,7 @@ FORWARDING_HANDLER::OnReceivingResponse(
         RETURN_LAST_ERROR_IF(!WinHttpReadData(m_hRequest,
             m_pEntityBuffer,
             min(m_BytesToSend, BUFFER_SIZE),
-            NULL));
+            nullptr));
     }
 
     return S_OK;
@@ -1981,15 +1995,15 @@ FORWARDING_HANDLER::GetNewResponseBuffer(
         !m_buffEntityBuffers.Resize(
             max(dwNeededSize, m_buffEntityBuffers.QuerySize() * 2)))
     {
-        return NULL;
+        return nullptr;
     }
 
     BYTE *pBuffer = (BYTE *)HeapAlloc(GetProcessHeap(),
         0, // dwFlags
         dwBufferSize);
-    if (pBuffer == NULL)
+    if (pBuffer == nullptr)
     {
-        return NULL;
+        return nullptr;
     }
 
     m_buffEntityBuffers.QueryPtr()[m_cEntityBuffers] = pBuffer;
@@ -2009,7 +2023,7 @@ FORWARDING_HANDLER::FreeResponseBuffers()
             pBuffers[i]);
     }
     m_cEntityBuffers = 0;
-    m_pEntityBuffer = NULL;
+    m_pEntityBuffer = nullptr;
     m_cBytesBuffered = 0;
 }
 
@@ -2028,13 +2042,13 @@ FORWARDING_HANDLER::SetStatusAndHeaders(
     PCSTR           pchEndofHeaderValue;
     BOOL            fServerHeaderPresent = FALSE;
 
-    _ASSERT(pszHeaders != NULL);
+    _ASSERT(pszHeaders != nullptr);
 
     //
     // The first line is the status line
     //
     PSTR pchStatus = const_cast<PSTR>(strchr(pszHeaders, ' '));
-    if (pchStatus == NULL)
+    if (pchStatus == nullptr)
     {
         return HRESULT_FROM_WIN32(ERROR_INVALID_PARAMETER);
     }
@@ -2054,7 +2068,7 @@ FORWARDING_HANDLER::SetStatusAndHeaders(
     }
 
     pchStatus = strchr(pchStatus, ' ');
-    if (pchStatus == NULL)
+    if (pchStatus == nullptr)
     {
         return HRESULT_FROM_WIN32(ERROR_INVALID_PARAMETER);
     }
@@ -2068,7 +2082,7 @@ FORWARDING_HANDLER::SetStatusAndHeaders(
     }
 
     pchNewline = strchr(pchStatus, '\n');
-    if (pchNewline == NULL)
+    if (pchNewline == nullptr)
     {
         return HRESULT_FROM_WIN32(ERROR_INVALID_PARAMETER);
     }
@@ -2096,7 +2110,7 @@ FORWARDING_HANDLER::SetStatusAndHeaders(
                 strHeaderValue.QueryStr(),
                 0,
                 S_OK,
-                NULL,
+                nullptr,
                 TRUE));
     }
 
@@ -2114,7 +2128,7 @@ FORWARDING_HANDLER::SetStatusAndHeaders(
         //
         pchNewline = const_cast<PSTR>(strchr(pszHeaders + index, '\n'));
 
-        if (pchNewline == NULL)
+        if (pchNewline == nullptr)
         {
             return HRESULT_FROM_WIN32(ERROR_INVALID_PARAMETER);
         }
@@ -2129,8 +2143,8 @@ FORWARDING_HANDLER::SetStatusAndHeaders(
         }
 
         DBG_ASSERT(
-            (pchColon != NULL) && (pchColon < pchNewline));
-        if ((pchColon == NULL) || (pchColon >= pchNewline))
+            (pchColon != nullptr) && (pchColon < pchNewline));
+        if ((pchColon == nullptr) || (pchColon >= pchNewline))
         {
             return HRESULT_FROM_WIN32(ERROR_INVALID_PARAMETER);
         }
@@ -2265,7 +2279,7 @@ FORWARDING_HANDLER::DoReverseRewrite(
 )
 {
     DBG_ASSERT(pResponse == m_pW3Context->GetResponse());
-    BOOL fSecure = (m_pW3Context->GetRequest()->GetRawHttpRequest()->pSslInfo != NULL);
+    BOOL fSecure = (m_pW3Context->GetRequest()->GetRawHttpRequest()->pSslInfo != nullptr);
     STRA strTemp;
     PCSTR pszHeader;
     PCSTR pszStartHost;
@@ -2277,7 +2291,7 @@ FORWARDING_HANDLER::DoReverseRewrite(
     // http[s]://host/url format
     //
     pszHeader = pResponse->GetHeader(HttpHeaderContentLocation);
-    if (pszHeader != NULL)
+    if (pszHeader != nullptr)
     {
         if (_strnicmp(pszHeader, "http://", 7) == 0)
         {
@@ -2297,7 +2311,7 @@ FORWARDING_HANDLER::DoReverseRewrite(
         RETURN_IF_FAILED(strTemp.Copy(fSecure ? "https://" : "http://"));
         RETURN_IF_FAILED(strTemp.Append(m_pszOriginalHostHeader));
 
-        if (pszEndHost != NULL)
+        if (pszEndHost != nullptr)
         {
             RETURN_IF_FAILED(strTemp.Append(pszEndHost));
         }
@@ -2310,7 +2324,7 @@ FORWARDING_HANDLER::DoReverseRewrite(
 Location:
 
     pszHeader = pResponse->GetHeader(HttpHeaderLocation);
-    if (pszHeader != NULL)
+    if (pszHeader != nullptr)
     {
         if (_strnicmp(pszHeader, "http://", 7) == 0)
         {
@@ -2330,7 +2344,7 @@ Location:
         RETURN_IF_FAILED(strTemp.Copy(fSecure ? "https://" : "http://"));
         RETURN_IF_FAILED(strTemp.Append(m_pszOriginalHostHeader));
 
-        if (pszEndHost != NULL)
+        if (pszEndHost != nullptr)
         {
             RETURN_IF_FAILED(strTemp.Append(pszEndHost));
         }
@@ -2356,7 +2370,7 @@ SetCookie:
 
         pszHeader = pHeaders->pUnknownHeaders[i].pRawValue;
         pszStartHost = strchr(pszHeader, ';');
-        while (pszStartHost != NULL)
+        while (pszStartHost != nullptr)
         {
             pszStartHost++;
             while (IsSpace(*pszStartHost))
@@ -2401,7 +2415,7 @@ SetCookie:
             RETURN_IF_FAILED(strTemp.Append(pszEndHost));
 
             pszHeader = (PCSTR)m_pW3Context->AllocateRequestMemory(strTemp.QueryCCH() + 1);
-            if (pszHeader == NULL)
+            if (pszHeader == nullptr)
             {
                 RETURN_HR(E_OUTOFMEMORY);
             }
@@ -2460,20 +2474,22 @@ FORWARDING_HANDLER::NotifyDisconnect()
     }
 }
 
+_Acquires_exclusive_lock_(this->m_RequestLock)
 VOID
 FORWARDING_HANDLER::AcquireLockExclusive()
 {
-    DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == NULL);
+    DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == nullptr);
     AcquireSRWLockExclusive(&m_RequestLock);
     TlsSetValue(g_dwTlsIndex, this);
     DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == this);
 }
 
+_Releases_exclusive_lock_(this->m_RequestLock)
 VOID
 FORWARDING_HANDLER::ReleaseLockExclusive()
 {
     DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == this);
-    TlsSetValue(g_dwTlsIndex, NULL);
+    TlsSetValue(g_dwTlsIndex, nullptr);
     ReleaseSRWLockExclusive(&m_RequestLock);
-    DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == NULL);
+    DBG_ASSERT(TlsGetValue(g_dwTlsIndex) == nullptr);
 }

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/forwardinghandler.h

@@ -77,9 +77,11 @@ public:
 
 private:
 
+    _Acquires_exclusive_lock_(this->m_RequestLock)
     VOID
     AcquireLockExclusive();
 
+    _Releases_exclusive_lock_(this->m_RequestLock)
     VOID
     ReleaseLockExclusive();
 

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/outprocessapplication.cpp

@@ -12,17 +12,17 @@ OUT_OF_PROCESS_APPLICATION::OUT_OF_PROCESS_APPLICATION(
     m_fWebSocketSupported(WEBSOCKET_STATUS::WEBSOCKET_UNKNOWN),
     m_pConfig(std::move(pConfig))
 {
-    m_pProcessManager = NULL;
+    m_pProcessManager = nullptr;
 }
 
 OUT_OF_PROCESS_APPLICATION::~OUT_OF_PROCESS_APPLICATION()
 {
     SRWExclusiveLock lock(m_stopLock);
-    if (m_pProcessManager != NULL)
+    if (m_pProcessManager != nullptr)
     {
         m_pProcessManager->Shutdown();
         m_pProcessManager->DereferenceProcessManager();
-        m_pProcessManager = NULL;
+        m_pProcessManager = nullptr;
     }
 }
 
@@ -30,7 +30,7 @@ HRESULT
 OUT_OF_PROCESS_APPLICATION::Initialize(
 )
 {
-    if (m_pProcessManager == NULL)
+    if (m_pProcessManager == nullptr)
     {
         m_pProcessManager = new PROCESS_MANAGER();
         RETURN_IF_FAILED(m_pProcessManager->Initialize());
@@ -52,7 +52,7 @@ OUT_OF_PROCESS_APPLICATION::StopInternal(bool fServerInitiated)
 {
     AppOfflineTrackingApplication::StopInternal(fServerInitiated);
 
-    if (m_pProcessManager != NULL)
+    if (m_pProcessManager != nullptr)
     {
         m_pProcessManager->Shutdown();
     }
@@ -63,7 +63,7 @@ OUT_OF_PROCESS_APPLICATION::CreateHandler(
     _In_  IHttpContext       *pHttpContext,
     _Out_ IREQUEST_HANDLER  **pRequestHandler)
 {
-    IREQUEST_HANDLER* pHandler = NULL;
+    IREQUEST_HANDLER* pHandler = nullptr;
 
     //add websocket check here
     if (m_fWebSocketSupported == WEBSOCKET_STATUS::WEBSOCKET_UNKNOWN)

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/processmanager.cpp

@@ -32,12 +32,12 @@ PROCESS_MANAGER::Initialize(
 
     m_dwRapidFailTickStart = GetTickCount();
 
-    if( m_hNULHandle == NULL )
+    if( m_hNULHandle == nullptr )
     {
         SECURITY_ATTRIBUTES saAttr;
         saAttr.nLength = sizeof(SECURITY_ATTRIBUTES);
         saAttr.bInheritHandle = TRUE;
-        saAttr.lpSecurityDescriptor = NULL;
+        saAttr.lpSecurityDescriptor = nullptr;
 
         m_hNULHandle = CreateFileW( L"NUL",
                                     FILE_WRITE_DATA,
@@ -45,7 +45,7 @@ PROCESS_MANAGER::Initialize(
                                     &saAttr,
                                     CREATE_ALWAYS,
                                     FILE_ATTRIBUTE_NORMAL,
-                                    NULL );
+                                    nullptr );
         RETURN_LAST_ERROR_IF( m_hNULHandle == INVALID_HANDLE_VALUE );
     }
 
@@ -82,7 +82,7 @@ PROCESS_MANAGER::GetProcess(
 
             for (DWORD i = 0; i < m_dwProcessesPerApplication; ++i)
             {
-                m_ppServerProcessList[i] = NULL;
+                m_ppServerProcessList[i] = nullptr;
             }
         }
         m_fServerProcessListReady = TRUE;
@@ -97,7 +97,7 @@ PROCESS_MANAGER::GetProcess(
         dwProcessIndex = InterlockedIncrement(&m_dwRouteToProcessIndex);
         dwProcessIndex = dwProcessIndex % m_dwProcessesPerApplication;
 
-        if (m_ppServerProcessList[dwProcessIndex] != NULL &&
+        if (m_ppServerProcessList[dwProcessIndex] != nullptr &&
             m_ppServerProcessList[dwProcessIndex]->IsReady())
         {
             *ppServerProcess = m_ppServerProcessList[dwProcessIndex];
@@ -106,12 +106,12 @@ PROCESS_MANAGER::GetProcess(
     }
 
     // should make the lock per process so that we can start processes simultaneously ?
-    if (m_ppServerProcessList[dwProcessIndex] == NULL ||
+    if (m_ppServerProcessList[dwProcessIndex] == nullptr ||
         !m_ppServerProcessList[dwProcessIndex]->IsReady())
     {
         auto lock = SRWExclusiveLock(m_srwLock);
 
-        if (m_ppServerProcessList[dwProcessIndex] != NULL)
+        if (m_ppServerProcessList[dwProcessIndex] != nullptr)
         {
             if (!m_ppServerProcessList[dwProcessIndex]->IsReady())
             {
@@ -143,7 +143,7 @@ PROCESS_MANAGER::GetProcess(
             RETURN_HR(HRESULT_FROM_WIN32(ERROR_SERVER_DISABLED));
         }
 
-        if (m_ppServerProcessList[dwProcessIndex] == NULL)
+        if (m_ppServerProcessList[dwProcessIndex] == nullptr)
         {
 
             pSelectedServerProcess = std::make_unique<SERVER_PROCESS>();

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/processmanager.h

@@ -53,12 +53,12 @@ public:
 
         for(DWORD i = 0; i < m_dwProcessesPerApplication; ++i )
         {
-            if( m_ppServerProcessList != NULL && 
-                m_ppServerProcessList[i] != NULL )
+            if( m_ppServerProcessList != nullptr && 
+                m_ppServerProcessList[i] != nullptr )
             {
                 m_ppServerProcessList[i]->SendSignal();
                 m_ppServerProcessList[i]->DereferenceServerProcess();
-                m_ppServerProcessList[i] = NULL;
+                m_ppServerProcessList[i] = nullptr;
             }
         }
 
@@ -107,8 +107,8 @@ public:
     }
 
     PROCESS_MANAGER() : 
-        m_ppServerProcessList( NULL ),
-        m_hNULHandle( NULL ),
+        m_ppServerProcessList(nullptr),
+        m_hNULHandle(nullptr),
         m_cRapidFailCount( 0 ),
         m_dwProcessesPerApplication( 1 ),
         m_dwRouteToProcessIndex( 0 ),
@@ -116,7 +116,7 @@ public:
         m_lStopping(0),
         m_cRefs( 1 )
     {
-        m_ppServerProcessList = NULL;
+        m_ppServerProcessList = nullptr;
         m_fServerProcessListReady = FALSE;
         InitializeSRWLock( &m_srwLock );
     }
@@ -151,14 +151,14 @@ private:
     {
         for(DWORD i = 0; i < m_dwProcessesPerApplication; ++i )
         {
-            if( m_ppServerProcessList != NULL && 
-                m_ppServerProcessList[i] != NULL && 
+            if( m_ppServerProcessList != nullptr &&
+                m_ppServerProcessList[i] != nullptr &&
                 m_ppServerProcessList[i]->GetPort() == pServerProcess->GetPort() )
             {
                 // shutdown pServerProcess if not already shutdown.
                 m_ppServerProcessList[i]->StopProcess();
                 m_ppServerProcessList[i]->DereferenceServerProcess();
-                m_ppServerProcessList[i] = NULL;
+                m_ppServerProcessList[i] = nullptr;
             }
         }
     }
@@ -170,13 +170,13 @@ private:
     {
         for(DWORD i = 0; i < m_dwProcessesPerApplication; ++i )
         {
-            if( m_ppServerProcessList != NULL &&
-                m_ppServerProcessList[i] != NULL )
+            if( m_ppServerProcessList != nullptr &&
+                m_ppServerProcessList[i] != nullptr)
             {
                 // shutdown pServerProcess if not already shutdown.
                 m_ppServerProcessList[i]->SendSignal();
                 m_ppServerProcessList[i]->DereferenceServerProcess();
-                m_ppServerProcessList[i] = NULL;
+                m_ppServerProcessList[i] = nullptr;
             }
         }
     }

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/responseheaderhash.h

@@ -73,10 +73,10 @@ public:
         PCSTR             pszName
     )
     {
-        HEADER_RECORD *       pRecord = NULL;
+        HEADER_RECORD* pRecord = nullptr;
 
         FindKey(pszName, &pRecord);
-        if (pRecord != NULL)
+        if (pRecord != nullptr)
         {
             return pRecord->_ulHeaderIndex;
         }
@@ -96,7 +96,7 @@ public:
             return sm_rgHeaders[ulIndex]._pszName;
         }
 
-        return NULL;
+        return nullptr;
     }
     
 private:

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/url_utility.cpp

@@ -66,7 +66,7 @@ Return Value:
     // Find the 3rd slash corresponding to the url
     //
     LPCWSTR pszSlash = wcschr(pszDestinationUrl, L'/');
-    if (pszSlash == NULL)
+    if (pszSlash == nullptr)
     {
         RETURN_IF_FAILED(pstrUrl->Copy(L"/", 1));
         RETURN_IF_FAILED(pstrDestination->Copy(pszDestinationUrl));
@@ -81,14 +81,6 @@ Return Value:
     return S_OK;
 }
 
-// Change a hexadecimal digit to its numerical equivalent
-#define TOHEX( ch )                                     \
-    ((ch) > L'9' ?                                      \
-        (ch) >= L'a' ?                                  \
-            (ch) - L'a' + 10 :                          \
-            (ch) - L'A' + 10                            \
-        : (ch) - L'0')
-
 HRESULT
 URL_UTILITY::EscapeAbsPath(
     IHttpRequest * pRequest,
@@ -96,8 +88,8 @@ URL_UTILITY::EscapeAbsPath(
 )
 {
     STRU    strAbsPath;
-    LPCWSTR pszAbsPath = NULL;
-    LPCWSTR pszFindStr = NULL;
+    LPCWSTR pszAbsPath = nullptr;
+    LPCWSTR pszFindStr = nullptr;
 
     RETURN_IF_FAILED(strAbsPath.Copy( pRequest->GetRawHttpRequest()->CookedUrl.pAbsPath,
         pRequest->GetRawHttpRequest()->CookedUrl.AbsPathLength / sizeof(WCHAR) ));
@@ -105,7 +97,7 @@ URL_UTILITY::EscapeAbsPath(
     pszAbsPath = strAbsPath.QueryStr();
     pszFindStr = wcschr(pszAbsPath, L'?');
 
-    while(pszFindStr != NULL)
+    while(pszFindStr != nullptr)
     {
         RETURN_IF_FAILED(strEscapedUrl->Append( pszAbsPath, pszFindStr - pszAbsPath));
         RETURN_IF_FAILED(strEscapedUrl->Append(L"%3F"));

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/websockethandler.cpp

@@ -37,10 +37,10 @@ LIST_ENTRY WEBSOCKET_HANDLER::sm_RequestsListHead;
 TRACE_LOG * WEBSOCKET_HANDLER::sm_pTraceLog;
 
 WEBSOCKET_HANDLER::WEBSOCKET_HANDLER() :
-    _pHttpContext(NULL),
-    _pWebSocketContext(NULL),
-    _hWebSocketRequest(NULL),
-    _pHandler(NULL),
+    _pHttpContext(nullptr),
+    _pWebSocketContext(nullptr),
+    _hWebSocketRequest(nullptr),
+    _pHandler(nullptr),
     _dwOutstandingIo(0),
     _fCleanupInProgress(FALSE),
     _fIndicateCompletionToIis(FALSE),
@@ -64,18 +64,18 @@ WEBSOCKET_HANDLER::Terminate(
     RemoveRequest();
     _fCleanupInProgress = TRUE;
 
-    if (_pHttpContext != NULL)
+    if (_pHttpContext != nullptr)
     {
         _pHttpContext->CancelIo();
-        _pHttpContext = NULL;
+        _pHttpContext = nullptr;
     }
     if (_hWebSocketRequest)
     {
         WinHttpCloseHandle(_hWebSocketRequest);
-        _hWebSocketRequest = NULL;
+        _hWebSocketRequest = nullptr;
     }
 
-    _pWebSocketContext = NULL;
+    _pWebSocketContext = nullptr;
     DeleteCriticalSection(&_RequestLock);
 
     delete this;
@@ -129,7 +129,7 @@ WEBSOCKET_HANDLER::StaticTerminate(
     if (sm_pTraceLog)
     {
         DestroyRefTraceLog(sm_pTraceLog);
-        sm_pTraceLog = NULL;
+        sm_pTraceLog = nullptr;
     }
 }
 
@@ -220,14 +220,14 @@ WEBSOCKET_HANDLER::IndicateCompletionToIIS(
     // Make sure no pending IO as there is no IIS websocket cancelation,
     // any unexpected callback will lead to AV. Revisit it once CanelOutGoingIO works
     //
-    if (_hWebSocketRequest != NULL && _dwOutstandingIo == 0)
+    if (_hWebSocketRequest != nullptr && _dwOutstandingIo == 0)
     {
         LOG_TRACE(L"WEBSOCKET_HANDLER::IndicateCompletionToIIS");
 
         _pHandler->SetStatus(FORWARDER_DONE);
         _fHandleClosed = TRUE;
         WinHttpCloseHandle(_hWebSocketRequest);
-        _hWebSocketRequest = NULL;
+        _hWebSocketRequest = nullptr;
     }
 }
 
@@ -279,7 +279,7 @@ Routine Description:
 
      _pWebSocketContext = (IWebSocketContext *) _pHttpContext->
         GetNamedContextContainer()->GetNamedContext(IIS_WEBSOCKET);
-    if ( _pWebSocketContext == NULL )
+    if ( _pWebSocketContext == nullptr )
     {
         hr = HRESULT_FROM_WIN32( ERROR_FILE_NOT_FOUND );
         goto Finished;
@@ -292,7 +292,7 @@ Routine Description:
         hRequest,
         (DWORD_PTR) pHandler);
 
-    if (_hWebSocketRequest == NULL)
+    if (_hWebSocketRequest == nullptr)
     {
         hr = HRESULT_FROM_WIN32(GetLastError());
         goto Finished;
@@ -394,7 +394,7 @@ Routine Description:
             &fClose,
             OnReadIoCompletion,
             this,
-            NULL);
+            nullptr);
     if (FAILED_LOG(hr))
     {
         DecrementOutstandingIo();
@@ -428,8 +428,8 @@ Routine Description:
                 _hWebSocketRequest,
                 &_WinHttpReceiveBuffer,
                 RECEIVE_BUFFER_SIZE,
-                NULL,
-                NULL);
+                nullptr,
+                nullptr);
 
     if (dwError != NO_ERROR)
     {
@@ -509,15 +509,15 @@ Routine Description:
         hr = _pWebSocketContext->SendConnectionClose(
             TRUE,
             uStatus,
-            uStatus == 1005 ? NULL : strCloseReason.QueryStr(),
+            uStatus == 1005 ? nullptr : strCloseReason.QueryStr(),
             OnWriteIoCompletion,
             this,
-            NULL);
+            nullptr);
     }
     else
     {
         //
-        // Get equivalant flags for IIS API from buffer type.
+        // Get equivalent flags for IIS API from buffer type.
         //
 
         WINHTTP_HELPER::GetFlagsFromBufferType(eBufferType,
@@ -538,7 +538,7 @@ Routine Description:
                 fFinalFragment,
                 OnWriteIoCompletion,
                 this,
-                NULL);
+                nullptr);
     }
 
     if (FAILED_LOG(hr))
@@ -607,7 +607,7 @@ Routine Description:
         dwError = WINHTTP_HELPER::sm_pfnWinHttpWebSocketShutdown(
             _hWebSocketRequest,
             uStatus,
-            strCloseReason.QueryCCH() == 0 ? NULL : (PVOID) strCloseReason.QueryStr(),
+            strCloseReason.QueryCCH() == 0 ? nullptr : (PVOID) strCloseReason.QueryStr(),
             strCloseReason.QueryCCH());
 
         if (dwError == ERROR_IO_PENDING)
@@ -638,7 +638,7 @@ Routine Description:
         dwError = WINHTTP_HELPER::sm_pfnWinHttpWebSocketSend(
                         _hWebSocketRequest,
                         eBufferType,
-                        cbData == 0 ? NULL : &_IisReceiveBuffer,
+                        cbData == 0 ? nullptr : &_IisReceiveBuffer,
                         cbData
                         );
     }
@@ -1099,23 +1099,24 @@ Arguments:
     if (reason == ClientDisconnect || reason == ServerStateUnavailable)
     {
         //
-        // Calling shutdown to notify the backend about disonnect
+        // Calling shutdown to notify the backend about disconnect
         //
         WINHTTP_HELPER::sm_pfnWinHttpWebSocketShutdown(
             _hWebSocketRequest,
-            1011, // indicate that a server is terminating the connection because it encountered
-                  // an unexpected condition that prevent it from fulfilling the request
-            NULL, // Reason
-            0);   // length og Reason
+            1011,    // indicate that a server is terminating the connection because it encountered
+                     // an unexpected condition that prevent it from fulfilling the request
+            nullptr, // Reason
+            0);      // length of Reason
 
     }
 
     if (reason == ServerDisconnect || reason == ServerStateUnavailable)
     {
         _pHttpContext->CancelIo();
+
         //
-        // CancelIo sometime may not be able to cannel pending websocket IO
-        // ResetConnection to force IISWebsocket module to release the pipeline
+        // CancelIo sometimes may not be able to cancel pending websocket IO.
+        // ResetConnection to force IISWebsocket module to release the pipeline.
         //
         _pHttpContext->GetResponse()->ResetConnection();
     }

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/winhttphelper.cpp

@@ -21,9 +21,7 @@ WINHTTP_HELPER::sm_pfnWinHttpWebSocketQueryCloseStatus;
 
 //static
 HRESULT
-WINHTTP_HELPER::StaticInitialize(
-    VOID
-)
+WINHTTP_HELPER::StaticInitialize()
 {
     //
     // Initialize the function pointers for WinHttp Websocket API's.
@@ -34,27 +32,27 @@ WINHTTP_HELPER::StaticInitialize(
     }
 
     HMODULE  hWinHttp = GetModuleHandleA("winhttp.dll");
-    RETURN_LAST_ERROR_IF (hWinHttp == NULL);
+    RETURN_LAST_ERROR_IF (hWinHttp == nullptr);
 
     sm_pfnWinHttpWebSocketCompleteUpgrade = (PFN_WINHTTP_WEBSOCKET_COMPLETE_UPGRADE)
         GetProcAddress(hWinHttp, "WinHttpWebSocketCompleteUpgrade");
-    RETURN_LAST_ERROR_IF (sm_pfnWinHttpWebSocketCompleteUpgrade == NULL);
+    RETURN_LAST_ERROR_IF (sm_pfnWinHttpWebSocketCompleteUpgrade == nullptr);
 
     sm_pfnWinHttpWebSocketQueryCloseStatus = (PFN_WINHTTP_WEBSOCKET_QUERY_CLOSE_STATUS)
         GetProcAddress(hWinHttp, "WinHttpWebSocketQueryCloseStatus");
-    RETURN_LAST_ERROR_IF (sm_pfnWinHttpWebSocketQueryCloseStatus == NULL);
+    RETURN_LAST_ERROR_IF (sm_pfnWinHttpWebSocketQueryCloseStatus == nullptr);
 
     sm_pfnWinHttpWebSocketReceive = (PFN_WINHTTP_WEBSOCKET_RECEIVE)
         GetProcAddress(hWinHttp, "WinHttpWebSocketReceive");
-    RETURN_LAST_ERROR_IF (sm_pfnWinHttpWebSocketReceive == NULL);
+    RETURN_LAST_ERROR_IF (sm_pfnWinHttpWebSocketReceive == nullptr);
 
     sm_pfnWinHttpWebSocketSend = (PFN_WINHTTP_WEBSOCKET_SEND)
         GetProcAddress(hWinHttp, "WinHttpWebSocketSend");
-    RETURN_LAST_ERROR_IF (sm_pfnWinHttpWebSocketSend == NULL);
+    RETURN_LAST_ERROR_IF (sm_pfnWinHttpWebSocketSend == nullptr);
 
     sm_pfnWinHttpWebSocketShutdown = (PFN_WINHTTP_WEBSOCKET_SHUTDOWN)
         GetProcAddress(hWinHttp, "WinHttpWebSocketShutdown");
-    RETURN_LAST_ERROR_IF (sm_pfnWinHttpWebSocketShutdown == NULL);
+    RETURN_LAST_ERROR_IF (sm_pfnWinHttpWebSocketShutdown == nullptr);
 
     return S_OK;
 }
@@ -69,6 +67,10 @@ WINHTTP_HELPER::GetFlagsFromBufferType(
     __out BOOL *                           pfClose
 )
 {
+    *pfClose = FALSE;
+    *pfFinalFragment = FALSE;
+    *pfUtf8Encoded = FALSE;
+
     switch (BufferType)
     {
     case WINHTTP_WEB_SOCKET_BINARY_MESSAGE_BUFFER_TYPE:

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/winhttphelper.h

@@ -7,7 +7,7 @@ typedef
 HINTERNET
 (WINAPI * PFN_WINHTTP_WEBSOCKET_COMPLETE_UPGRADE)(
     _In_ HINTERNET hRequest,
-    _In_opt_ DWORD_PTR pContext
+    DWORD_PTR pContext
 );
 
 

src/Servers/IIS/AspNetCoreModuleV2/RequestHandlerLib/filewatcher.cpp

@@ -99,7 +99,7 @@ FILE_WATCHER::Create(
         (LPTHREAD_START_ROUTINE)ChangeNotificationThread,
         this,
         0,
-        NULL));
+        nullptr));
 
     if (pszDirectoryToMonitor == nullptr ||
         pszFileNameToMonitor == nullptr ||
@@ -128,7 +128,7 @@ FILE_WATCHER::Create(
         nullptr,
         OPEN_EXISTING,
         FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OVERLAPPED,
-        NULL);
+        nullptr);
 
     RETURN_LAST_ERROR_IF(_hDirectory == INVALID_HANDLE_VALUE);
 
@@ -475,7 +475,7 @@ FILE_WATCHER::StopMonitor()
     LOG_INFO(L"Stopping file watching.");
 
     // Signal the file watcher thread to exit
-    PostQueuedCompletionStatus(m_hCompletionPort, 0, FILE_WATCHER_SHUTDOWN_KEY, NULL);
+    PostQueuedCompletionStatus(m_hCompletionPort, 0, FILE_WATCHER_SHUTDOWN_KEY, nullptr);
     WaitForWatcherThreadExit();
 
     if (m_fShadowCopyEnabled)

src/Servers/IIS/AspNetCoreModuleV2/RequestHandlerLib/filewatcher.h

@@ -50,7 +50,7 @@ public:
 
     static DWORD WINAPI CopyAndShutdown(FILE_WATCHER* watcher);
 
-    HRESULT HandleChangeCompletion(DWORD cbCompletion);
+    HRESULT HandleChangeCompletion(_In_ DWORD bytesTransferred);
 
     HRESULT Monitor();
     void StopMonitor();

src/Servers/IIS/AspNetCoreModuleV2/RequestHandlerLib/requesthandler_config.cpp

@@ -11,10 +11,10 @@
 
 REQUESTHANDLER_CONFIG::~REQUESTHANDLER_CONFIG()
 {
-    if (m_ppStrArguments != NULL)
+    if (m_ppStrArguments != nullptr)
     {
         delete[] m_ppStrArguments;
-        m_ppStrArguments = NULL;
+        m_ppStrArguments = nullptr;
     }
 }
 
@@ -27,19 +27,19 @@ REQUESTHANDLER_CONFIG::CreateRequestHandlerConfig(
 )
 {
     HRESULT                 hr = S_OK;
-    REQUESTHANDLER_CONFIG  *pRequestHandlerConfig = NULL;
+    REQUESTHANDLER_CONFIG  *pRequestHandlerConfig = nullptr;
     STRU                    struHostFxrDllLocation;
     STRU                    struExeLocation;
 
     try
     {
-        if (ppAspNetCoreConfig == NULL)
+        if (ppAspNetCoreConfig == nullptr)
         {
             hr = E_INVALIDARG;
             goto Finished;
         }
 
-        *ppAspNetCoreConfig = NULL;
+        *ppAspNetCoreConfig = nullptr;
 
         pRequestHandlerConfig = new REQUESTHANDLER_CONFIG;
 
@@ -58,7 +58,7 @@ REQUESTHANDLER_CONFIG::CreateRequestHandlerConfig(
         }
 
         *ppAspNetCoreConfig = pRequestHandlerConfig;
-        pRequestHandlerConfig = NULL;
+        pRequestHandlerConfig = nullptr;
     }
     catch (std::bad_alloc&)
     {
@@ -67,10 +67,10 @@ REQUESTHANDLER_CONFIG::CreateRequestHandlerConfig(
 
 Finished:
 
-    if (pRequestHandlerConfig != NULL)
+    if (pRequestHandlerConfig != nullptr)
     {
         delete pRequestHandlerConfig;
-        pRequestHandlerConfig = NULL;
+        pRequestHandlerConfig = nullptr;
     }
 
     return hr;
@@ -89,19 +89,19 @@ REQUESTHANDLER_CONFIG::Populate(
     STRU                            strEnvValue;
     STRU                            strExpandedEnvValue;
     STRU                            strApplicationFullPath;
-    IAppHostAdminManager           *pAdminManager = NULL;
-    IAppHostElement                *pAspNetCoreElement = NULL;
-    IAppHostElement                *pWindowsAuthenticationElement = NULL;
-    IAppHostElement                *pBasicAuthenticationElement = NULL;
-    IAppHostElement                *pAnonymousAuthenticationElement = NULL;
+    IAppHostAdminManager           *pAdminManager = nullptr;
+    IAppHostElement                *pAspNetCoreElement = nullptr;
+    IAppHostElement                *pWindowsAuthenticationElement = nullptr;
+    IAppHostElement                *pBasicAuthenticationElement = nullptr;
+    IAppHostElement                *pAnonymousAuthenticationElement = nullptr;
     ULONGLONG                       ullRawTimeSpan = 0;
     DWORD                           dwCounter = 0;
     DWORD                           dwPosition = 0;
-    WCHAR*                          pszPath = NULL;
-    BSTR                            bstrWindowAuthSection = NULL;
-    BSTR                            bstrBasicAuthSection = NULL;
-    BSTR                            bstrAnonymousAuthSection = NULL;
-    BSTR                            bstrAspNetCoreSection = NULL;
+    WCHAR*                          pszPath = nullptr;
+    BSTR                            bstrWindowAuthSection = nullptr;
+    BSTR                            bstrBasicAuthSection = nullptr;
+    BSTR                            bstrAnonymousAuthSection = nullptr;
+    BSTR                            bstrAspNetCoreSection = nullptr;
     std::optional<std::wstring> launcherPathEnv;
     std::optional<std::wstring> launcherArgsEnv;
 
@@ -161,7 +161,7 @@ REQUESTHANDLER_CONFIG::Populate(
     }
 
     bstrWindowAuthSection = SysAllocString(CS_WINDOWS_AUTHENTICATION_SECTION);
-    if (bstrWindowAuthSection == NULL)
+    if (bstrWindowAuthSection == nullptr)
     {
         hr = E_OUTOFMEMORY;
         goto Finished;
@@ -188,7 +188,7 @@ REQUESTHANDLER_CONFIG::Populate(
     }
 
     bstrBasicAuthSection = SysAllocString(CS_BASIC_AUTHENTICATION_SECTION);
-    if (bstrBasicAuthSection == NULL)
+    if (bstrBasicAuthSection == nullptr)
     {
         hr = E_OUTOFMEMORY;
         goto Finished;
@@ -213,7 +213,7 @@ REQUESTHANDLER_CONFIG::Populate(
     }
 
     bstrAnonymousAuthSection = SysAllocString(CS_ANONYMOUS_AUTHENTICATION_SECTION);
-    if (bstrAnonymousAuthSection == NULL)
+    if (bstrAnonymousAuthSection == nullptr)
     {
         hr = E_OUTOFMEMORY;
         goto Finished;
@@ -238,7 +238,7 @@ REQUESTHANDLER_CONFIG::Populate(
     }
 
     bstrAspNetCoreSection = SysAllocString(CS_ASPNETCORE_SECTION);
-    if (bstrAspNetCoreSection == NULL)
+    if (bstrAspNetCoreSection == nullptr)
     {
         hr = E_OUTOFMEMORY;
         goto Finished;
@@ -423,28 +423,28 @@ REQUESTHANDLER_CONFIG::Populate(
 
 Finished:
 
-    if (pAspNetCoreElement != NULL)
+    if (pAspNetCoreElement != nullptr)
     {
         pAspNetCoreElement->Release();
-        pAspNetCoreElement = NULL;
+        pAspNetCoreElement = nullptr;
     }
 
-    if (pWindowsAuthenticationElement != NULL)
+    if (pWindowsAuthenticationElement != nullptr)
     {
         pWindowsAuthenticationElement->Release();
-        pWindowsAuthenticationElement = NULL;
+        pWindowsAuthenticationElement = nullptr;
     }
 
-    if (pAnonymousAuthenticationElement != NULL)
+    if (pAnonymousAuthenticationElement != nullptr)
     {
         pAnonymousAuthenticationElement->Release();
-        pAnonymousAuthenticationElement = NULL;
+        pAnonymousAuthenticationElement = nullptr;
     }
 
-    if (pBasicAuthenticationElement != NULL)
+    if (pBasicAuthenticationElement != nullptr)
     {
         pBasicAuthenticationElement->Release();
-        pBasicAuthenticationElement = NULL;
+        pBasicAuthenticationElement = nullptr;
     }
 
     return hr;

src/Servers/IIS/AspNetCoreModuleV2/RequestHandlerLib/requesthandler_config.h

@@ -236,7 +236,7 @@ protected:
     REQUESTHANDLER_CONFIG() :
         m_fStdoutLogEnabled(FALSE),
         m_hostingModel(HOSTING_UNKNOWN),
-        m_ppStrArguments(NULL)
+        m_ppStrArguments(nullptr)
     {
     }
 

src/Servers/IIS/AspNetCoreModuleV2/gtest/gtest.vcxproj

@@ -7,6 +7,7 @@
   <PropertyGroup Label="Globals">
     <ProjectGuid>{CAC1267B-8778-4257-AAC6-CAF481723B01}</ProjectGuid>
     <RootNamespace>gtest</RootNamespace>
+    <RunCodeAnalysis>false</RunCodeAnalysis>
   </PropertyGroup>
   <PropertyGroup Label="Configuration">
     <TargetName>gtest</TargetName>

src/Servers/IIS/Directory.Build.props

@@ -8,6 +8,6 @@
     <HostArch Condition="'$(Platform)' == 'AnyCPU'">x64</HostArch>
     <LibNetHostPath>$(NetCoreTargetingPackRoot)Microsoft.NETCore.App.Host.win-$(HostArch)\$(LibNetHostAppPackVersion)\runtimes\win-$(HostArch)\native</LibNetHostPath>
     <!-- This tools version MUST match the same version as runtime uses to compile libnethost.lib -->
-    <PlatformToolsetVersion>v142</PlatformToolsetVersion>
+    <PlatformToolsetVersion>143</PlatformToolsetVersion>
   </PropertyGroup>
 </Project>

src/Servers/IIS/build/Build.Common.Settings

@@ -32,6 +32,12 @@
   </ImportGroup>
   <PropertyGroup Label="UserMacros" />
 
+  <PropertyGroup>
+     <CodeAnalysisRuleSet>..\DefaultRules.ruleset</CodeAnalysisRuleSet>
+     <RunCodeAnalysis Condition="'$(VCToolsRedistVersion)' != '' AND '$(VCToolsRedistVersion)' >= 14.15.26706">true</RunCodeAnalysis>
+     <EnablePREfast>$(RunCodeAnalysis)</EnablePREfast>
+   </PropertyGroup>
+
   <ItemDefinitionGroup>
     <ClCompile>
       <PrecompiledHeader>Use</PrecompiledHeader>