Process Monitor: Entries with BUFFER OVERFLOW

Question

I´m trying to solve IE 8 performance problems on my system at the moment.

I analyzed my system with Sysinternals Process Monitor and found lots of "BUFFER OVERFLOW"s entries in the Log (See below). Any ideas to solve the problem?

Log entries for example:

iexplore.exe RegQueryValue HKLM\System\CurrentControlSet\services\NetBT\Linkage\Export BUFFER OVERFLOW Length: 144
communicator.exe RegQueryValue HKLM\System\CurrentControlSet\services\Tcpip\Linkage\Bind BUFFER OVERFLOW Length: 144
OUTLOOK.EXE RegQueryValue HKLM\System\CurrentControlSet\services\Tcpip\Linkage\Bind BUFFER OVERFLOW Length: 144

Answer 1

This is not an error. What is happening is the program is requesting data the length of which it does not know. It provides an initial buffer. If it is too small, a Buffer Overflow is returned together with the size needed and the program can reissue the request with the correct size. Do not confuse with the use of the term buffer overflow to designate the erroneous overwriting of data which can lead to a security vulnerability.

Answer 2

I notice this myself occasionally in different programs, and a lot of network scanners and tools bring this about as well for me.

The first logical step is to narrow the "error," or issue, if you like -- by watching Process Monitor and look at when it happens and try to replicate it. If you're having trouble, try adjusting your filters.

I am trying this now and I found BluetoothView.exe to result in buffer overflow (BO) after creating a file, and then querying that same file -- which is what caused the BO. One example is an instance where in under a thousandths of a millisecond, BluetoothView creates a BO with the operation: QuerySecurityFile (BluetoothApis.dll).

Under the Process tab in Event Properties (in procmon), there is a list of modules including common shell files and things such as SkyDriveShell.dll, KernelBase.dll, ieframe.dll, Windows.Media.Streaming.dll and codecs, and other Nirsoft software such as Network Explorer. Although these things might have been found to being effected by Bluetooth, it's strange the actual program never turned up anything.

Under the Stack tab, the modules are: ntdll.dll, kernel32.dll, wow64.dll, wow64cpu.dll, guard32.dll, fltmgr.sys, ntoskrnl.exe, apphelp.dll, BluetoothView.exe, and <unknown>.

I was checking this because I had left my house for a while and left my computer running for a few days, when I came back I noticed a few things out of place and just wanted to check. After opening Task Manager my computer crashed, and would no longer complete loading Windows 8. Instead of a load/splash screen for W8, four or five lines of code flashed on the screen, as the flashing indicator on the top left (the one that lets you know that commands may be entered) drop about 4 or 5 lines down the screen, which is not normal function.

I had to do some unconventional things to be able to get back into Windows, but I won't go into that.

In your case, and in mine, I think the next step is to poke around at this program, and also to look into the programs its playing around with.