From b927ee449604ad2186b85987803c813622fc0cb4 Mon Sep 17 00:00:00 2001
From: Bill Zissimopoulos <billziss@navimatics.com>
Date: Tue, 13 Oct 2026 16:16:52 +0300
Subject: [PATCH] sys: FspFsvolQueryVolumeInformationComplete,
 FspFsvolSetFsLabelInformation:

fix vulnerability reported by Johan von Konow
---
 src/sys/device.c  |  2 ++
 src/sys/volinfo.c | 14 ++++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/src/sys/device.c b/src/sys/device.c
index b9aa587c..24af925c 100644
--- a/src/sys/device.c
+++ b/src/sys/device.c
@@ -834,6 +834,8 @@ VOID FspFsvolDeviceSetVolumeInfo(PDEVICE_OBJECT DeviceObject, const FSP_FSCTL_VO
 {
     // !PAGED_CODE();
 
+    ASSERT(VolumeInfo->VolumeLabelLength <= sizeof VolumeInfo->VolumeLabel);
+
     FSP_FSVOL_DEVICE_EXTENSION *FsvolDeviceExtension = FspFsvolDeviceExtension(DeviceObject);
     FSP_FSCTL_VOLUME_INFO VolumeInfoNp = *VolumeInfo;
     KIRQL Irql;
diff --git a/src/sys/volinfo.c b/src/sys/volinfo.c
index 21866380..6fa0d9dc 100644
--- a/src/sys/volinfo.c
+++ b/src/sys/volinfo.c
@@ -350,6 +350,14 @@ NTSTATUS FspFsvolQueryVolumeInformationComplete(
         FSP_RETURN();
     }
 
+    if (Response->Rsp.QueryVolumeInformation.VolumeInfo.VolumeLabelLength >
+        sizeof Response->Rsp.QueryVolumeInformation.VolumeInfo.VolumeLabel)
+    {
+        Irp->IoStatus.Information = 0;
+        Result = STATUS_INTERNAL_ERROR;
+        FSP_RETURN();
+    }
+
     PDEVICE_OBJECT FsvolDeviceObject = IrpSp->DeviceObject;
     PUINT8 Buffer = Irp->AssociatedIrp.SystemBuffer;
     PUINT8 BufferEnd = Buffer + IrpSp->Parameters.QueryVolume.Length;
@@ -410,7 +418,13 @@ static NTSTATUS FspFsvolSetFsLabelInformation(
         ((PWSTR)Request->Buffer)[Info->VolumeLabelLength / sizeof(WCHAR)] = L'\0';
     }
     else
+    {
+        if (Response->Rsp.SetVolumeInformation.VolumeInfo.VolumeLabelLength >
+            sizeof Response->Rsp.SetVolumeInformation.VolumeInfo.VolumeLabel)
+            return STATUS_INTERNAL_ERROR;
+
         FspFsvolDeviceSetVolumeInfo(FsvolDeviceObject, &Response->Rsp.SetVolumeInformation.VolumeInfo);
+    }
 
     return STATUS_SUCCESS;
 }