sys: FspFsvolReadNonCached: trim ReadLength

During CreateProcess/CreateSection Windows locks the image file (using AcquireFileForNtCreateSection),
gets the image file size and then reads the image file. Unfortunately if the file system (erroneously) reads
past the file size, Windows can bugcheck. This allows a faulty or malicious file system to crash Windows.

This commit adds a check in WinFsp to mitigate this problem.
This commit is contained in:
Bill Zissimopoulos
2020-04-10 19:24:43 -07:00
parent 9d69ae7503
commit 42fd57904a
3 changed files with 20 additions and 0 deletions

View File

@ -1392,6 +1392,7 @@ typedef struct FSP_FILE_NODE
PIRP TopLevelIrp;
UINT32 TopFlags;
} CcFlush;
BOOLEAN CreateSection;
} Tls;
/* read-only after creation (and insertion in the ContextTable) */
PDEVICE_OBJECT FsvolDeviceObject;