{"id":22863,"date":"2008-04-04T07:00:00","date_gmt":"2008-04-04T14:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2008\/04\/04\/status_buffer_overflow-really-should-be-named-status_buffer_overflow_prevented\/"},"modified":"2022-11-30T13:59:00","modified_gmt":"2022-11-30T21:59:00","slug":"20080404-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20080404-00\/?p=22863","title":{"rendered":"STATUS_BUFFER_OVERFLOW really should be named STATUS_BUFFER_OVERFLOW_PREVENTED"},"content":{"rendered":"<p>One category of dubious security vulnerability that comes into the security response team is people who recently discovered the <code>STATUS_<wbr \/>BUFFER_<wbr \/>OVERFLOW<\/code> status code.<\/p>\n<blockquote class=\"q\">\n<p><b>Title<\/b>: Buffer overflow occurs in scenario\u00a0X<\/p>\n<p><b>Description<\/b>: Run a file monitoring tool and perform scenario\u00a0X. In the log, you will see entries that have the error <code>STATUS_<wbr \/>BUFFER_<wbr \/>OVERFLOW<\/code>. This is an easily reproducible buffer overflow bug.<\/p>\n<\/blockquote>\n<p>If only the system were so smart that it could detect buffer overflows in this way. But what you&#8217;re seeing is not actual a buffer overflow. The status code <code>STATUS_<wbr \/>BUFFER_<wbr \/>OVERFLOW<\/code> does not mean that a buffer overflow has occurred; rather, it means that the buffer passed by the application was too small to hold all the requested data. Its name should really be <code>STATUS_<wbr \/>BUFFER_<wbr \/>OVERFLOW_<wbr \/>PREVENTED<\/code> or <code>STATUS_<wbr \/>INSUFFICIENT_<wbr \/>BUFFER<\/code>. Indeed, the corresponding Win32 error code has the less misleading name <code>ERROR_<wbr \/>INSUFFICIENT_<wbr \/>BUFFER<\/code>.<\/p>\n<p>Every wannabe security investigator sees this error code in a monitoring tool and says &#8220;Jackpot!&#8221; And then they send a report to the security response team and brag about it to their friends. &#8220;Dude, I found two dozen buffer overflows in just a few minutes. I am so <a href=\"http:\/\/www.31337.com\/\">31337<\/a>!&#8221;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Because it&#8217;s saying that the buffer would have overflowed, not that it did.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-22863","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"<p>Because it&#8217;s saying that the buffer would have overflowed, not that it did.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/22863","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=22863"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/22863\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=22863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=22863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=22863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}