Bug Check 0xF7: DRIVER_OVERRAN_STACK_BUFFER
The DRIVER_OVERRAN_STACK_BUFFER bug check has a value of 0x000000F7. This indicates that a driver has overrun a stack-based buffer.
Important Info If You Have Received a STOP Code
If you received a blue screen error, or stop code, the computer has shut down abruptly to protect itself from data loss. A hardware device, its driver, or related software might have caused this error. If your copy of Windows came with your computer, call the manufacturer of your computer. If you purchased Windows separately from your computer, Microsoft provides support. To find contact info for Microsoft or your computer manufacturer, Contact Support.
If you have experience with computers and want to try to recover from this error, follow the steps provided in the Microsoft article Resolving STOP (Blue Screen) Errors in Windows.
These actions might prevent an error like this from happening again:
- Download and install updates and device drivers for your computer from Windows Update.
- Scan your computer for computer viruses.
- Check your hard disk for errors.
DRIVER_OVERRAN_STACK_BUFFER Parameters
The following parameters are displayed on the blue screen.
| Parameter | Description |
|---|---|
|
1 |
The actual security check cookie from the stack |
|
2 |
The expected security check cookie |
|
3 |
The bit-complement of the expected security check cookie |
|
4 |
0 |
Cause
A driver overran a stack-based buffer (or local variable) in a way that would have overwritten the function's return address and jumped back to an arbitrary address when the function returned.
This is the classic "buffer overrun" hacking attack. The system has been brought down to prevent a malicious user from gaining complete control of it.
Resolution
Use the kb (Display Stack Backtrace) command to get a stack trace.
The last routine on the stack before the buffer overrun handlers and bug check call is the one that overran its local variable.
Send comments about this topic to Microsoft
Build date: 4/9/2013
