Windows must now restart because the [our service name] service terminated unexpectedly

as a disclaimer, I am posting this here because I have only seen comments referring to this type of behavior where people have indicated a possible problem going on with the system. If this is not the correct place to post this, please let me know and I will post where people ask coding questions.

Having said that, I have seen many posts that say "windows must now restart because the service terminated unexpectedly". My situation is different in that the complaint is regarding a proprietary service that my company wrote.

My company builds machines and currently one of them, running as a release build in the field, has had some service crashes. The proprietary service is written for this machine and has been extensively tested. It is running on Win7 32 bit, with Windows updates turned off. The service is written in C++ using VS2010.

On 5/28/20, between 5:05 and 5:16 pm, we had 5 different crashes of this service. Each time the system showed the error message "Windows must now restart because the [our service name] service terminated unexpectedly". When I look at the crash dumps, each time it is sitting at a call to sprintf() where the call stack ends at _invoke_watson(). When I first open the crash dump the error dialog for the crash says "Unhandled exception ... : An invalid parameter was passed to a C runtime function." When I look at the sprintf call, the associated lines are:

char buff[10];
if (sprintf_s(buff, sizeof(buff)/sizeof(buff[0]), "%04d%02d%02d", iyear, imonth, iday) < 0)

These crashes are on the sprintf_s() call. The iyear, imonth, iday are all ints, so they have to have value, but they are the values that were retrieved from a FILETIME struct (populated by a call to GetSystemTimeAsFileTime()) that was converted to a SYSTEMTIME struct (populated by a call to FileTimeToSystemTime()). But either way, an int should be an int.

When I look in the system Event Viewer, for each crash it gives an exception code of 0xc0000417, and a system event ID of 1000 (which of course means crashed due to unknown event).

I am thrown by the fact that, other than during the span of these 13 minutes, this has never happened before and has not happened since. I am trying to dig further into this issue, but I have no idea why a simple sprintf call would do this, and only during a span of 15 minutes.

Does anyone have any suggestions as to questions I should be "asking" of the system? I am very adept with system work, but am not a system guy. Any suggestions for me to continue forward would be highly appreciated.

Again, please let me know if this is the wrong place to be posting this question.

You must be overrunning buff. A format specifier such as %04d does not guarantee that the string placed in the buffer will be no longer than 4 characters, so if iyear somehow contains a value > 9999 then you will write more than the 4 characters you have allowed space for. Similarly for imonth and iday.

So I would add some bounds checking on these values to ensure that you don't overrun your buffer. You might also output them to some kind of debugging log if they are out of range (such as the Application Event Log) to help you track the problem down.

As for bringing down Windows when the service crashes, see: https://devblogs.microsoft.com/oldnewthing/20180216-00/?p=98035 (if you didn't know about that already).