Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an ASP.NET application that is stuck loading pages (nothing ever happens, no timeout, nothing). In procmon I am seeing a BUFFER OVERFLOW for QueryInformationVolume and QueryAllInformationFile for default.aspx. How can I figure out what is happening?

Edit: Added Example Lines


23:11.7 w3wp.exe	8648	QueryInformationVolume	D:\www\AppName\Default.aspx	BUFFER OVERFLOW	VolumeCreationTime: 11/8/2007 9:18:37 AM, VolumeSerialNumber: AA05-4B19, SupportsObjects: True, VolumeLabel: DAT؛
23:11.7 w3wp.exe	8648	QueryAllInformationFile	D:\www\AppName\Default.aspx	BUFFER OVERFLOW	CreationTime: 9/16/2008 9:38:26 PM, LastAccessTime: 9/2/2009 10:21:51 AM, LastWriteTime: 8/27/2009 4:49:00 PM, ChangeTime: 8/27/2009 4:49:00 PM, FileAttributes: A, AllocationSize: 4,096, EndOfFile: 644, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x5a00000002e419, EaSize: 0, Access: Generic Read, Position: 0, Mode: , AlignmentRequirement: Byte

share|improve this question

3 Answers 3

The buffer overflows are nothing. Look at Mark Russinovich's blog for the explanation.

Do these errors indicate a problem? No, they are a standard way for the system to indicate that there’s more information available than can fit into a requester’s output buffer. In other words, the system is telling the caller that if it was to copy all the data requested, it would overflow the buffer. Thus, the error really means that a buffer overflow was avoided, not that one occurred.

The bottom line is that buffer overflow errors in a Filemon trace are not an indication that there's a security problem and are usually not due to bad programming.

share|improve this answer

I don't recommend using IISRESET as it has numerous side effects. Have you stopped and restarted the AppPool either by modifying the web.config file OR within IIS snap-in itself? Can you give more information about the actual ASP.NET app itself?

QueryInformation is an IRP (I/O Request Packet) Function code. You can see here on MSDN that this is a file system error. Is IIS redirecting to a fileshare on another server? Are the files locked for writing? Maybe another process/application is hogging up the filesystem and IIS is waiting for Default.aspx.

share|improve this answer
    
My issue isn't so much getting the app running again as much as finding the root cause. It was only this app pool with the issue and restarting the app pool did fix the issue for the time being. It wasn't just the single page that was having an issue, all requests were perpetually loading. –  Greg Arcara Sep 2 '09 at 19:28

By debugging?

Is this some application you wrote, or someone else just put it in a web server you're managing?

share|improve this answer
    
I am the main developer on the project, this is something that hasn't happened before and this code has been in heavy use for about a week now. I don't believe it to be a coding issue and more likely something else on the server.. –  Greg Arcara Sep 2 '09 at 17:42
    
A buffer overflow is very likely to be a coding error; maybe it just didn't show up until now. –  Massimo Sep 2 '09 at 19:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.