Dear All,
I am working on a security application specifically for Windows 2000 NTFS
file system and have developed a “file system filter driver” to implement
the same. The driver is on similar patterns on what filespy is made (FileSpy
is a sample file system filter driver provided in IFS kit). I am running
this application along with the Norton antivirus application. NAV also
installs a filter driver on the file system (SymEvent.sys)
I am running my application and studying the debug prints from the DebugView
and came to know that it is showing the following error
“NTFS: Stack space low. Posting create request.”
This error comes exactly after I create a file using following code::
///////////////////////////////////////////////////////////////
InitializeObjectAttributes( &objectAttributes,
&linkFullFileNameUnicode,
OBJ_CASE_INSENSITIVE,
NULL,
NULL
);
status = ZwCreateFile ( &ntFileHandle,
SYNCHRONIZE|DELETE|FILE_GENERIC_WRITE|FILE_GENERIC_READ,
&objectAttributes,
&ioStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_VALID_FLAGS,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT|FILE_WRITE_THROUGH,
NULL,
0
);
//////////////////////////////////////////////////////////
According to the previous discussions, one of the reasons of this error is
that if we have used WCHAR arrays in our code . But I have substituted them
by the non-paged memory. But still this debug print is flashing. Although
the system is not crashing. The system doesn’t restart properly.
And Mr. Dan told that:
"While the OP most likely is being injudicious in his use of stack space,
there is another possibility here. SymEvent calls ZwCreateFile in it’s
create dispatch routine If the OP is doing the same, without recognizing the
recursion, then the stack will be recursed to death.
He should look at the stack, and see WHY it is being exhausted. (Use dds to
tear apart the stack after the SymEvent stack switch)."
I think that Mr. Reasoning is also very accurate, but unfortunately I am not
able to understand how to look at the stack. (What is dds??)
The application is working fine but the system doesn’t restart properly when
this application is been run along with NAV. Can you please tell how to
solve this problem?
Regards,
Rohit