Public/winfsp
1
0
Fork 0
mirror of https://github.com/winfsp/winfsp.git synced 2026-03-06 15:49:21 -06:00
Code Activity

sys: FspFastIoDeviceControl: add a couple of fixes

Browse Source 
- Check that the operation succeeded prior to copying to the output buffer.
- Avoid information leaks by only copying what is necessary to the output
buffer (suggestion by Tay Kiat Loong).
This commit is contained in:
Bill Zissimopoulos
2026-02-17 20:48:01 +02:00
parent 13d306f586
commit 7f82326454
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/sys/devctl.c
View File

@@ -80,6 +80,7 @@ BOOLEAN FspFastIoDeviceControl(
FSP_RETURN(IoStatus->Status = STATUS_BUFFER_TOO_SMALL); FSP_RETURN(IoStatus->Status = STATUS_BUFFER_TOO_SMALL);
PVOID SystemBuffer = 0; PVOID SystemBuffer = 0;
if (0 != InputBufferLength || 0 != OutputBufferLength) if (0 != InputBufferLength || 0 != OutputBufferLength)
{ {
SystemBuffer = FspAllocNonPaged( SystemBuffer = FspAllocNonPaged(
@@ -115,14 +116,15 @@ BOOLEAN FspFastIoDeviceControl(
if (0 != SystemBuffer) if (0 != SystemBuffer)
{ {
if (0 != OutputBuffer) if (NT_SUCCESS(IoStatus->Status) && 0 != OutputBuffer)
try try
{ {
RtlCopyMemory(OutputBuffer, SystemBuffer, OutputBufferLength); RtlCopyMemory(OutputBuffer, SystemBuffer, IoStatus->Information);
} }
except (EXCEPTION_EXECUTE_HANDLER) except (EXCEPTION_EXECUTE_HANDLER)
{ {
IoStatus->Status = GetExceptionCode(); IoStatus->Status = GetExceptionCode();
IoStatus->Information = 0;
} }
FspFree(SystemBuffer); FspFree(SystemBuffer);
} }