IRP_MJ_QUERY_INFORMATION returns Buffer Overflow...

Hello…

First of all, I hope someone will help me on this, because it is not
strictly a FSD-related problem, but an Apache web server problem which
drives me nuts for a few days now and I got into tracing Apache FS calls
with FileMon v4.34 on XP (apache-users mailing list didn’t helped at
all).

This is my configuration:

WinXP Home edition, no SP, F-Secure AV v5.40.

The problem is that I am constantly getting empty pages to the browsers,
as sent by the server. The paths are all all-right, but the logs are
stating that the file size of the returned object is 0.

This is how I finally got into File Monitor after all… By tracing calls
from Apache on the requested resources, I bumped into the subject-line
described problem:

14:30:32 Apache.exe:1368 IRP_MJ_QUERY_VOLUME_INFORMATION
something.XML BUFFER
OVERFLOW
FileFsVolumeInformation

14:30:32 Apache.exe:1368
IRP_MJ_QUERY_INFORMATION something.XML BUFFER
OVERFLOW
FileAllInformation

The files exist and their full paths are quite valid. Is this a
common problem that can be ignored or what are the causes for those
overflows? I do have the nt/2000 native api reference but I can’t
extract much information from there related to this…

I really appreciate anybody’s help on this slightly off-topic question
and I hope I provided enough info to describe my problem.

Regards,

–Razvan.

>14:30:32 Apache.exe:1368 IRP_MJ_QUERY_VOLUME_INFORMATION something.XML

BUFFER OVERFLOW FileFsVolumeInformation
14:30:32 Apache.exe:1368 IRP_MJ_QUERY_INFORMATION something.XML
BUFFER OVERFLOW FileAllInformation

The files exist and their full paths are quite valid. Is this a common
problem that can be ignored or what are the causes for those overflows? I
do have the nt/2000 native api reference but I can’t extract much
information from there related to this…

Actually STATUS_BUFFER_OVERFLOW is not an error status. It means that that
fixed size part of information was returned and variable length part
didn’t fit in output buffer. For example in case of
FileFsVolumeInformation it means that volume label was not returned to
application. If application is not interested in volume label it got what
it needed.

Alexei.

BUFFER OVERFLOW is IIRC OK, just the sign for the user app to allocate the larger buffer and to retry the call with it.

Max
----- Original Message -----
From: Razvan Costea-Barlutiu
To: File Systems Developers
Sent: Thursday, March 06, 2003 3:49 PM
Subject: [ntfsd] IRP_MJ_QUERY_INFORMATION returns Buffer Overflow…

Hello…

First of all, I hope someone will help me on this, because it is not strictly a FSD-related problem, but an Apache web server problem which drives me nuts for a few days now and I got into tracing Apache FS calls with FileMon v4.34 on XP (apache-users mailing list didn’t helped at all).

This is my configuration:
WinXP Home edition, no SP, F-Secure AV v5.40.

The problem is that I am constantly getting empty pages to the browsers, as sent by the server. The paths are all all-right, but the logs are stating that the file size of the returned object is 0.
This is how I finally got into File Monitor after all… By tracing calls from Apache on the requested resources, I bumped into the subject-line described problem:

14:30:32 Apache.exe:1368 IRP_MJ_QUERY_VOLUME_INFORMATION something.XML BUFFER OVERFLOW FileFsVolumeInformation
14:30:32 Apache.exe:1368 IRP_MJ_QUERY_INFORMATION something.XML BUFFER OVERFLOW FileAllInformation

The files exist and their full paths are quite valid. Is this a common problem that can be ignored or what are the causes for those overflows? I do have the nt/2000 native api reference but I can’t extract much information from there related to this…

I really appreciate anybody’s help on this slightly off-topic question and I hope I provided enough info to describe my problem.

Regards,
–Razvan.

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com