Public/winfsp
1
0
Fork 0
mirror of https://github.com/winfsp/winfsp.git synced 2026-03-16 13:20:33 -05:00
Code Activity

sys: FspFsvolReadNonCached: trim ReadLength

Browse Source 
During CreateProcess/CreateSection Windows locks the image file (using AcquireFileForNtCreateSection),
gets the image file size and then reads the image file. Unfortunately if the file system (erroneously) reads
past the file size, Windows can bugcheck. This allows a faulty or malicious file system to crash Windows.

This commit adds a check in WinFsp to mitigate this problem.
This commit is contained in:
Bill Zissimopoulos
2020-04-10 19:24:43 -07:00
parent 9d69ae7503
commit 42fd57904a
3 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/sys/read.c
View File

@@ -234,6 +234,7 @@ static NTSTATUS FspFsvolReadNonCached(
ULONG ReadLength = IrpSp->Parameters.Read.Length;
ULONG ReadKey = IrpSp->Parameters.Read.Key;
BOOLEAN PagingIo = BooleanFlagOn(Irp->Flags, IRP_PAGING_IO);
FSP_FSCTL_FILE_INFO FileInfo;
FSP_FSCTL_TRANSACT_REQ *Request;
BOOLEAN Success;
@@ -296,6 +297,19 @@ static NTSTATUS FspFsvolReadNonCached(
}
}
/* trim ReadLength during CreateProcess; resolve bugcheck for filesystem that reports incorrect size */
if (FileNode->Tls.CreateSection)
{
FspFileNodeGetFileInfo(FileNode, &FileInfo);
if ((UINT64)ReadOffset.QuadPart >= FileInfo.FileSize)
{
FspFileNodeRelease(FileNode, Full);
return STATUS_END_OF_FILE;
}
if ((UINT64)ReadLength > FileInfo.FileSize - ReadOffset.QuadPart)
ReadLength = (ULONG)(FileInfo.FileSize - ReadOffset.QuadPart);
}
/* convert FileNode to shared */
FspFileNodeConvertExclusiveToShared(FileNode, Full);