From 1916d9bf0665dab03f49a61217e510c75fd7fb02 Mon Sep 17 00:00:00 2001
From: Bill Zissimopoulos <billziss@navimatics.com>
Date: Mon, 27 Jul 2026 16:16:41 +0300
Subject: [PATCH] sys: FspVolumeNotifyWork: fix vulnerability reported by
 Wencheng Xue (GitHub @panwnvda)

Correct bounds checking on FSP_FSCTL_NOTIFY_INFO records.
---
 src/sys/volume.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/sys/volume.c b/src/sys/volume.c
index 105bdb9b..722ac90d 100644
--- a/src/sys/volume.c
+++ b/src/sys/volume.c
@@ -1523,6 +1523,8 @@ static VOID FspVolumeNotifyWork(PVOID NotifyWorkItem0)
             Unlock = TRUE;
             break;
         }
+        if ((SIZE_T)(NotifyInfoEnd - (PUINT8)NotifyInfo) < NotifyInfoSize)
+            break;
 
         FileName.Length =
         FileName.MaximumLength = (USHORT)(NotifyInfoSize - sizeof(FSP_FSCTL_NOTIFY_INFO));