From 97e6d92b5b77c699153ca73c3e97e61aa40bca79 Mon Sep 17 00:00:00 2001
From: Bill Zissimopoulos <billziss@navimatics.com>
Date: Mon, 27 Jul 2026 16:23:45 +0300
Subject: [PATCH] sys: FspFsvolQueryDirectoryCopy

Correct bounds checking on FSP_FSCTL_DIR_INFO records.
---
 src/sys/dirctl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/sys/dirctl.c b/src/sys/dirctl.c
index 42f32604..fc107efa 100644
--- a/src/sys/dirctl.c
+++ b/src/sys/dirctl.c
@@ -179,7 +179,8 @@ static NTSTATUS FspFsvolQueryDirectoryCopy(
         {
             DirInfoSize = DirInfo->Size;
 
-            if (sizeof(FSP_FSCTL_DIR_INFO) > DirInfoSize)
+            if (sizeof(FSP_FSCTL_DIR_INFO) > DirInfoSize ||
+                (SIZE_T)(DirInfoEnd - (PUINT8)DirInfo) < DirInfoSize)
             {
                 if (0 == *PDestLen)
                     return STATUS_NO_MORE_FILES;