locked
Whats wrong with "Microsoft Windows Search Indexer"

    Question

  • Hi
    Reliability Monitor on windows telling me that there is problem with "Microsoft Windows Search Indexer".  Here is the technical details of that app failure.
     

    _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

    Description

     

    Faulting Application Path: C:\Windows\System32\SearchIndexer.exe

    Problem signature

    Problem Event Name: BEX64

    Application Name: SearchIndexer.exe

    Application Version: 7.0.8102.0

    Application Timestamp: 4e54437d

    Fault Module Name: TQUERY.DLL

    Fault Module Version: 7.0.8102.0

    Fault Module Timestamp: 4e544ce1

    Exception Offset: 000000000007819f

    Exception Code: c0000409

    Exception Data: 0000000000000000

    OS Version: 6.2.8102.2.0.0.256.74

    Locale ID: 1033

    Additional Information 1: 8c27

    Additional Information 2: 8c27c492ef4105d8acfa5740bdb9c9f3

    Additional Information 3: 2267

    Additional Information 4: 22677c74e53253ec903ce397718588df

    Extra information about the problem

    Bucket ID: 1c7aa148a75d980eaac5b781a0062404

    _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

    I tried uninstall this feature and re installing it Nothing Changed.

    Sunday, September 25, 2011 1:33 AM

Answers

  • You have a Stack buffer overflow - code c0000409 :

    Child-SP          RetAddr           Call Site
    00000053`90c87b18 000007fc`bf151362 ntdll!NtWaitForMultipleObjects+0xa
    00000053`90c87b20 000007fc`bf34c925 KERNELBASE!WaitForMultipleObjectsEx+0xe5
    00000053`90c87e00 000007fc`bf34c998 kernel32!WerpReportFaultInternal+0x1b1
    00000053`90c87ea0 000007fc`bf17c353 kernel32!WerpReportFault+0x44
    00000053`90c87ed0 000007fc`ae100f15 KERNELBASE!UnhandledExceptionFilter+0x1d3
    00000053`90c87fd0 000007fc`ae06819f tquery!_report_gsfailure+0xfd
    00000053`90c88060 000007fc`ae0fd26b tquery!inverted::_AddValueIndexToWordList+0x177
    00000053`90c88790 000007fc`ae0d03da tquery!inverted::CInvertedIndex::_GenerateValueIndexKeys+0x1d0
    00000053`90c88920 000007fc`adff5b93 tquery!inverted::CInvertedIndex::SetProperty+0x176
    00000053`90c889d0 000007fc`ad8892a9 tquery!CInvertedStoreDocument::AddProperty+0x23e
    00000053`90c88af0 000007fc`ad88a444 mssrch!CPluginCollectionSink::AddChunk+0x371
    00000053`90c88bf0 000007fc`ad883b0e mssrch!CPluginCollectionSink::PushProperties+0xfd9
    00000053`90c8b0a0 000007fc`bf343cdc mssrch!CRobotThread::Thread+0xb15
    00000053`90c8fd50 000007fc`c1da3c85 kernel32!BaseThreadInitThunk+0x18
    00000053`90c8fd80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

    FOLLOWUP_IP:
    tquery!inverted::_AddValueIndexToWordList+177
    000007fc`ae06819f 488b9c2438070000 mov     rbx,qword ptr [rsp+738h]

    SYMBOL_STACK_INDEX:  6

    IMAGE_NAME:  tquery.dll

    FAILURE_BUCKET_ID:  STACK_BUFFER_OVERRUN_SEHOP_AFTER_CALL_c0000409_tquery.dll!inverted::_AddValueIndexToWordList

    BUCKET_ID:  X64_APPLICATION_FAULT_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_SEHOP_AFTER_CALL_MISSING_GSFRAME_tquery!inverted::_AddValueIndexToWordList+177


    We can't fix this. MS must look at the dumps and fix it in later Windows 8 Builds.

    To disable the dump creation, run regedit.exe, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting and delete the LocalDumps key.


    "A programmer is just a tool which converts caffeine into code"

    • Marked as answer by TohidPC Tuesday, September 27, 2011 1:19 AM
    Monday, September 26, 2011 7:55 PM

All replies

  • try a system restore.
    And report this using the feedback tool.

    Regards,

    Dylan Meeus


    0x2B |~ 0x2B Blog : www.it-ca.net/blogdylan
    Sunday, September 25, 2011 1:47 AM
  • //
    // MessageId: STATUS_STACK_BUFFER_OVERRUN
    //
    // MessageText:
    //
    // The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
    //
    #define STATUS_STACK_BUFFER_OVERRUN      ((NTSTATUS)0xC0000409L)    // winnt


    Please download this reg file from my SkyDrive:

    http://cid-128fc518635be2dc.office.live.com/self.aspx/.Public/MS%20Foren/Registry/LocalDumps.reg

    and make a double click on the file to import it.

    When an application crashes, Windows Error Reporting Service [1] creates a dmp file under C:\Localdumps. Please upload the dump (zip it first) to your public Skydrive [2] folder and post the link here so that the Team can look at the dump and look what is wrong.

    André

    [1] http://msdn.microsoft.com/en-us/library/bb787181%28VS.85%29.aspx
    [2] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65


    "A programmer is just a tool which converts caffeine into code"

    Sunday, September 25, 2011 5:26 PM
  • Thanks for your respond.

    and here is the link:

    https://skydrive.live.com/redir.aspx?cid=2c17b5249ea04cdb&page=play&resid=2C17B5249EA04CDB!852

    Actually there is a lots of dump files about search indexer I picked one of theme.

    and please tell me how can i put end to these dump files, these files are big as 200mb and the search indexer keep crashing every 3 or 5 minutes.

    thanks again.


    • Edited by TohidPC Sunday, September 25, 2011 11:30 PM
    Sunday, September 25, 2011 11:23 PM
  • You have a Stack buffer overflow - code c0000409 :

    Child-SP          RetAddr           Call Site
    00000053`90c87b18 000007fc`bf151362 ntdll!NtWaitForMultipleObjects+0xa
    00000053`90c87b20 000007fc`bf34c925 KERNELBASE!WaitForMultipleObjectsEx+0xe5
    00000053`90c87e00 000007fc`bf34c998 kernel32!WerpReportFaultInternal+0x1b1
    00000053`90c87ea0 000007fc`bf17c353 kernel32!WerpReportFault+0x44
    00000053`90c87ed0 000007fc`ae100f15 KERNELBASE!UnhandledExceptionFilter+0x1d3
    00000053`90c87fd0 000007fc`ae06819f tquery!_report_gsfailure+0xfd
    00000053`90c88060 000007fc`ae0fd26b tquery!inverted::_AddValueIndexToWordList+0x177
    00000053`90c88790 000007fc`ae0d03da tquery!inverted::CInvertedIndex::_GenerateValueIndexKeys+0x1d0
    00000053`90c88920 000007fc`adff5b93 tquery!inverted::CInvertedIndex::SetProperty+0x176
    00000053`90c889d0 000007fc`ad8892a9 tquery!CInvertedStoreDocument::AddProperty+0x23e
    00000053`90c88af0 000007fc`ad88a444 mssrch!CPluginCollectionSink::AddChunk+0x371
    00000053`90c88bf0 000007fc`ad883b0e mssrch!CPluginCollectionSink::PushProperties+0xfd9
    00000053`90c8b0a0 000007fc`bf343cdc mssrch!CRobotThread::Thread+0xb15
    00000053`90c8fd50 000007fc`c1da3c85 kernel32!BaseThreadInitThunk+0x18
    00000053`90c8fd80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

    FOLLOWUP_IP:
    tquery!inverted::_AddValueIndexToWordList+177
    000007fc`ae06819f 488b9c2438070000 mov     rbx,qword ptr [rsp+738h]

    SYMBOL_STACK_INDEX:  6

    IMAGE_NAME:  tquery.dll

    FAILURE_BUCKET_ID:  STACK_BUFFER_OVERRUN_SEHOP_AFTER_CALL_c0000409_tquery.dll!inverted::_AddValueIndexToWordList

    BUCKET_ID:  X64_APPLICATION_FAULT_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_SEHOP_AFTER_CALL_MISSING_GSFRAME_tquery!inverted::_AddValueIndexToWordList+177


    We can't fix this. MS must look at the dumps and fix it in later Windows 8 Builds.

    To disable the dump creation, run regedit.exe, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting and delete the LocalDumps key.


    "A programmer is just a tool which converts caffeine into code"

    • Marked as answer by TohidPC Tuesday, September 27, 2011 1:19 AM
    Monday, September 26, 2011 7:55 PM