1

I have an ASP.NET application that is stuck loading pages (nothing ever happens, no timeout, nothing). In procmon I am seeing a BUFFER OVERFLOW for QueryInformationVolume and QueryAllInformationFile for default.aspx. How can I figure out what is happening?

Edit: Added Example Lines


23:11.7 w3wp.exe    8648    QueryInformationVolume  D:\www\AppName\Default.aspx BUFFER OVERFLOW VolumeCreationTime: 11/8/2007 9:18:37 AM, VolumeSerialNumber: AA05-4B19, SupportsObjects: True, VolumeLabel: DAT؛
23:11.7 w3wp.exe    8648    QueryAllInformationFile D:\www\AppName\Default.aspx BUFFER OVERFLOW CreationTime: 9/16/2008 9:38:26 PM, LastAccessTime: 9/2/2009 10:21:51 AM, LastWriteTime: 8/27/2009 4:49:00 PM, ChangeTime: 8/27/2009 4:49:00 PM, FileAttributes: A, AllocationSize: 4,096, EndOfFile: 644, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x5a00000002e419, EaSize: 0, Access: Generic Read, Position: 0, Mode: , AlignmentRequirement: Byte
Greg Arcara
  • 183

3 Answers3

3

The buffer overflows are nothing. Look at Mark Russinovich's blog for the explanation.

Do these errors indicate a problem? No, they are a standard way for the system to indicate that there’s more information available than can fit into a requester’s output buffer. In other words, the system is telling the caller that if it was to copy all the data requested, it would overflow the buffer. Thus, the error really means that a buffer overflow was avoided, not that one occurred.

The bottom line is that buffer overflow errors in a Filemon trace are not an indication that there's a security problem and are usually not due to bad programming.

Community
  • 1
Igal Serban
  • 1,585
0

By debugging?

Is this some application you wrote, or someone else just put it in a web server you're managing?

Massimo
  • 71,269
  • I am the main developer on the project, this is something that hasn't happened before and this code has been in heavy use for about a week now. I don't believe it to be a coding issue and more likely something else on the server.. – Greg Arcara Sep 02 '09 at 17:42
  • A buffer overflow is very likely to be a coding error; maybe it just didn't show up until now. – Massimo Sep 02 '09 at 19:01
0

I don't recommend using IISRESET as it has numerous side effects. Have you stopped and restarted the AppPool either by modifying the web.config file OR within IIS snap-in itself? Can you give more information about the actual ASP.NET app itself?

QueryInformation is an IRP (I/O Request Packet) Function code. You can see here on MSDN that this is a file system error. Is IIS redirecting to a fileshare on another server? Are the files locked for writing? Maybe another process/application is hogging up the filesystem and IIS is waiting for Default.aspx.

osij2is
  • 3,885
  • My issue isn't so much getting the app running again as much as finding the root cause. It was only this app pool with the issue and restarting the app pool did fix the issue for the time being. It wasn't just the single page that was having an issue, all requests were perpetually loading. – Greg Arcara Sep 02 '09 at 19:28