AMajor/SoftEtherVPN
1
0
Fork 0
mirror of https://github.com/SoftEtherVPN/SoftEtherVPN.git synced 2024-11-22 17:39:53 +03:00
Code Releases Activity

Merge PR #929: Added ProbeForWrite() buffer writable check routine for Irp->UserBuffer in the NDIX 5.x See driver.

Browse Source
This commit is contained in:
Davide Beatrici 2019-06-29 17:02:57 +02:00 committed by GitHub
commit 919f6c825f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 52 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
src/See/Packet.c
View File

@ -668,6 +668,8 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
PUINT pStats; PUINT pStats;
ULONG Information = 0; ULONG Information = 0;
BOOLEAN check_ok;
IF_LOUD(DbgPrint("NPF: IoControl\n");) IF_LOUD(DbgPrint("NPF: IoControl\n");)
IrpSp = IoGetCurrentIrpStackLocation(Irp); IrpSp = IoGetCurrentIrpStackLocation(Irp);
@ -686,22 +688,39 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
EXIT_FAILURE(0); EXIT_FAILURE(0);
} }
pStats = (PUINT)(Irp->UserBuffer); check_ok = TRUE;
__try
pStats[3] = 0;
pStats[0] = 0;
pStats[1] = 0;
pStats[2] = 0; // Not yet supported
for(i = 0 ; i < NCpu ; i++)
{ {
ProbeForWrite(Irp->UserBuffer, IrpSp->Parameters.DeviceIoControl.OutputBufferLength, 1);
pStats[3] += Open->CpuData[i].Accepted; }
pStats[0] += Open->CpuData[i].Received; __except (EXCEPTION_EXECUTE_HANDLER)
pStats[1] += Open->CpuData[i].Dropped; {
pStats[2] += 0; // Not yet supported check_ok = FALSE;
}
if (check_ok == FALSE)
{
EXIT_FAILURE(0);
}
else
{
pStats = (PUINT)(Irp->UserBuffer);
pStats[3] = 0;
pStats[0] = 0;
pStats[1] = 0;
pStats[2] = 0; // Not yet supported
for(i = 0 ; i < NCpu ; i++)
{
pStats[3] += Open->CpuData[i].Accepted;
pStats[0] += Open->CpuData[i].Received;
pStats[1] += Open->CpuData[i].Dropped;
pStats[2] += 0; // Not yet supported
}
EXIT_SUCCESS(4*sizeof(UINT));
} }
EXIT_SUCCESS(4*sizeof(UINT));
break; break;
@ -711,9 +730,26 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
EXIT_FAILURE(0); EXIT_FAILURE(0);
} }
RtlCopyMemory(Irp->UserBuffer,(Open->ReadEventName.Buffer)+18,26); check_ok = TRUE;
__try
{
ProbeForWrite(Irp->UserBuffer, IrpSp->Parameters.DeviceIoControl.OutputBufferLength, 1);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
check_ok = FALSE;
}
EXIT_SUCCESS(26); if (check_ok == FALSE)
{
EXIT_FAILURE(0);
}
else
{
RtlCopyMemory(Irp->UserBuffer,(Open->ReadEventName.Buffer)+18,26);
EXIT_SUCCESS(26);
}
break; break;