OSR Dev Blog

NTFS Does Not Support Query Operations on Stream File Objects
(By: OSR Staff | Published: 05-Feb-04| Modified: 05-Feb-04)

 The NTFS File System creates internally used "stream" file objects (called this because they are created using IoCreateStreamFileObject or one of its variants, not because they have anything to do with "file streams".)  These file objects are distinguished because they have the FO_STREAM_FILE bit set in the Flags field of the file object.

In Windows 2000 (and presumably earlier) versions of Windows, NTFS does not support file query operations (IRP_MJ_QUERY_INFORMATION) that request basic information on such file objects.  Unfortunately, rather than reject the request, NTFS attempts to use a null pointer in one of the data structures and causes the system to crash.

Kernel developers should be familiar with this limitation and not attempt to query this information from NTFS.

This article was printed from OSR Online http://www.osronline.com

Copyright 2017 OSR Open Systems Resources, Inc.