What does NTSTATUS 0xC0000231 (STATUS_MARSHALL_OVERFLOW) mean?

 
Previous Next
STATUS_PROPSET_NOT_FOUND STATUS_INVALID_VARIANT

STATUS_MARSHALL_OVERFLOW

Measure the marshaled representation, not only the caller's source objects

STATUS_MARSHALL_OVERFLOW identifies overflow of a user/kernel marshaling buffer. Marshaling can expand data because a transfer representation includes headers, counts, alignment, type tags, and copied variable-length payloads. The source object count or source string length is therefore not always equal to the number of bytes required at the boundary.

When investigating, locate the code that computes the marshaled size and compare it with the actual encoder. Use checked arithmetic for every addition and alignment operation before allocating or reserving the transfer area. A 32-bit intermediate used for count * element_size can wrap before a later comparison with a larger buffer size, making the validation appear to pass. The related STATUS_CLIENT_SERVER_PARAMETERS_INVALID message also highlights shared client/server parameter windows as size-constrained boundaries.

Preserve the operation code, item count, each variable-length field size, calculated encoded size, and buffer capacity. Do not simply enlarge a private buffer when the receiving boundary has a fixed maximum. The correct response may be to split the operation or reject a request that exceeds the interface limit. If data crosses a trust boundary, validate the declared encoded length independently from the number of bytes actually available.

What to inspect

  • Instrument the size calculator and encoder with the same field-by-field byte accounting.
  • Use checked multiplication, addition, and alignment arithmetic before allocating the marshaling buffer.
  • Distinguish a local allocation limit from a fixed ABI or shared-window maximum.

References

Looking for a different code? Search another status or error code.