AMajor/SoftEtherVPN
1
0
Fork 0
mirror of https://github.com/SoftEtherVPN/SoftEtherVPN.git synced 2024-11-22 17:39:53 +03:00
Code Releases Activity

Added ProbeForWrite() buffer writable check routine for Irp->UserBuffer in the See driver. The See driver is a legacy driver for packet capturing with NDIS 5.x (Windows 2000 or XP). It is based on the source code of WinPcap.

Browse Source
This commit is contained in:
Daiyuu Nobori 2019-05-28 10:36:31 +09:00
parent a3c29fbca6
commit 18cfe18950
1 changed files with 52 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
src/See/Packet.c
View File

@ -668,6 +668,8 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
PUINT pStats; PUINT pStats;
ULONG Information = 0; ULONG Information = 0;
BOOLEAN check_ok;
IF_LOUD(DbgPrint("NPF: IoControl\n");) IF_LOUD(DbgPrint("NPF: IoControl\n");)
IrpSp = IoGetCurrentIrpStackLocation(Irp); IrpSp = IoGetCurrentIrpStackLocation(Irp);
@ -686,6 +688,22 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
EXIT_FAILURE(0); EXIT_FAILURE(0);
} }
check_ok = TRUE;
__try
{
ProbeForWrite(Irp->UserBuffer, IrpSp->Parameters.DeviceIoControl.OutputBufferLength, 1);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
check_ok = FALSE;
}
if (check_ok == FALSE)
{
EXIT_FAILURE(0);
}
else
{
pStats = (PUINT)(Irp->UserBuffer); pStats = (PUINT)(Irp->UserBuffer);
pStats[3] = 0; pStats[3] = 0;
@ -702,6 +720,7 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
pStats[2] += 0; // Not yet supported pStats[2] += 0; // Not yet supported
} }
EXIT_SUCCESS(4*sizeof(UINT)); EXIT_SUCCESS(4*sizeof(UINT));
}
break; break;
@ -711,9 +730,26 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
EXIT_FAILURE(0); EXIT_FAILURE(0);
} }
check_ok = TRUE;
__try
{
ProbeForWrite(Irp->UserBuffer, IrpSp->Parameters.DeviceIoControl.OutputBufferLength, 1);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
check_ok = FALSE;
}
if (check_ok == FALSE)
{
EXIT_FAILURE(0);
}
else
{
RtlCopyMemory(Irp->UserBuffer,(Open->ReadEventName.Buffer)+18,26); RtlCopyMemory(Irp->UserBuffer,(Open->ReadEventName.Buffer)+18,26);
EXIT_SUCCESS(26); EXIT_SUCCESS(26);
}
break; break;