AMajor/SoftEtherVPN
1
0
Fork 0
mirror of https://github.com/SoftEtherVPN/SoftEtherVPN.git synced 2024-09-19 18:20:40 +03:00
Code Releases Activity

Merge PR #929: Added ProbeForWrite() buffer writable check routine for Irp->UserBuffer in the NDIX 5.x See driver.

Browse Source
This commit is contained in:
Davide Beatrici 2019-06-29 17:02:57 +02:00 committed by GitHub
commit 919f6c825f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 52 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
src/See/Packet.c
View File

@ -668,6 +668,8 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
PUINT pStats; PUINT pStats;
ULONG Information = 0; ULONG Information = 0;
BOOLEAN check_ok;
IF_LOUD(DbgPrint("NPF: IoControl\n");) IF_LOUD(DbgPrint("NPF: IoControl\n");)
IrpSp = IoGetCurrentIrpStackLocation(Irp); IrpSp = IoGetCurrentIrpStackLocation(Irp);
@ -686,6 +688,22 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
EXIT_FAILURE(0); EXIT_FAILURE(0);
} }
check_ok = TRUE;
__try
{
ProbeForWrite(Irp->UserBuffer, IrpSp->Parameters.DeviceIoControl.OutputBufferLength, 1);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
check_ok = FALSE;
}
if (check_ok == FALSE)
{
EXIT_FAILURE(0);
}
else
{
pStats = (PUINT)(Irp->UserBuffer); pStats = (PUINT)(Irp->UserBuffer);
pStats[3] = 0; pStats[3] = 0;
@ -702,6 +720,7 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
pStats[2] += 0; // Not yet supported pStats[2] += 0; // Not yet supported
} }
EXIT_SUCCESS(4*sizeof(UINT)); EXIT_SUCCESS(4*sizeof(UINT));
}
break; break;
@ -711,9 +730,26 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
EXIT_FAILURE(0); EXIT_FAILURE(0);
} }
check_ok = TRUE;
__try
{
ProbeForWrite(Irp->UserBuffer, IrpSp->Parameters.DeviceIoControl.OutputBufferLength, 1);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
check_ok = FALSE;
}
if (check_ok == FALSE)
{
EXIT_FAILURE(0);
}
else
{
RtlCopyMemory(Irp->UserBuffer,(Open->ReadEventName.Buffer)+18,26); RtlCopyMemory(Irp->UserBuffer,(Open->ReadEventName.Buffer)+18,26);
EXIT_SUCCESS(26); EXIT_SUCCESS(26);
}
break; break;