OSR's ntfsd List: FilterGetMessage and insufficient buffers

Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:

Creating the right design for your requirements
Reviewing your existing driver code
Analyzing driver reliability/performance issues
Custom training mixed with consulting and focused directly on your specific areas of interest/concern.

Check us out. OSR, the Windows driver experts.

Monthly Seminars at OSR Headquarters

East Coast USA
Windows Internals and SW Drivers, Dulles (Sterling) VA, 9 April 2018

Writing WDF Drivers I: Core Concepts, Manchester, NH, 7 May 2018

Kernel Debugging & Crash Analysis for Windows, Manchester, NH, 21 May 2018

		OSR Online Lists > ntfsd
FilterGetMessage and insufficient buffers

Welcome, Guest
You must login to post to this list

Message 1 of 1

17 Mar 17 07:13

Mauro Leggieri

xxxxxx@mauroleggieri.com

Join Date: 02 Jun 2016

Posts To This List: 37

FilterGetMessage and insufficient buffers

Hi, Because couldn't find documentation nor samples, I did some reverse engineering on FilterGetMessage/FltSendMessage/etc. calls and would like to confirm the behavior if the buffer that receives a message or reply from/to driver is not large enough. Based on what I see, assuming we are sending a message from driver to usermode 1) If buffer size of FilterGetMessage is small, the API will return ERROR_INSUFFICIENT_BUFFER or ERROR_MORE_DATA and we can retry the call using a larger buffer. FltSendMessage will wait for a new request from usermode. 2) When we call FilterReplyMessage with a larger buffer FltSendMessage expects to receive, FltSendMessage will return STATUS_BUFFER_OVERFLOW or STATUS_BUFFER_TOO_SMALL. Usermode will get the win32 error. Sounds right? Regards, Mauro.

Posting Rules
You may not post new threads You may not post replies You may not post attachments	You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 08:08.

Contact Us - Osr Online Homepage - Top