From a744d6f24c06a744f2635f14802fbe46602589e1 Mon Sep 17 00:00:00 2001
From: Bill Zissimopoulos <billziss@navimatics.com>
Date: Mon, 27 Jul 2026 16:19:10 +0300
Subject: [PATCH] sys: FspFsvolQueryStreamInformationCopy: fix vulnerability
 reported by Abhinav Agarwal (GitHub @abhinavagarwal07)

Correct bounds checking on FSP_FSCTL_STREAM_INFO records.
---
 src/sys/fileinfo.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/sys/fileinfo.c b/src/sys/fileinfo.c
index 8bd4709a..7a9eea00 100644
--- a/src/sys/fileinfo.c
+++ b/src/sys/fileinfo.c
@@ -669,7 +669,8 @@ static NTSTATUS FspFsvolQueryStreamInformationCopy(
     {
         StreamInfoSize = StreamInfo->Size;
 
-        if (sizeof(FSP_FSCTL_STREAM_INFO) > StreamInfoSize)
+        if (sizeof(FSP_FSCTL_STREAM_INFO) > StreamInfoSize ||
+            (SIZE_T)(StreamInfoEnd - (PUINT8)StreamInfo) < StreamInfoSize)
             break;
 
         StreamNameLength = StreamInfoSize - sizeof(FSP_FSCTL_STREAM_INFO) + STREAM_EXTRA_LENGTH;