Public/winfsp
1
0 Fork 0
mirror of https://github.com/winfsp/winfsp.git synced 2026-10-15 17:09:54 -05:00
Code Activity

sys: FspFsvolQueryVolumeInformationComplete, FspFsvolSetFsLabelInformation:

Browse Source 
fix vulnerability reported by Johan von Konow
This commit is contained in:
Bill Zissimopoulos committed 2026-10-13 16:16:52 +03:00
1 parent 4c3cf58fe7
commit b927ee4496
2 files changed
+16
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/sys/device.c
+2
View File
@@ -834,6 +834,8 @@ VOID FspFsvolDeviceSetVolumeInfo(PDEVICE_OBJECT DeviceObject, const FSP_FSCTL_VO
{ {
// !PAGED_CODE(); // !PAGED_CODE();
ASSERT(VolumeInfo->VolumeLabelLength <= sizeof VolumeInfo->VolumeLabel);
FSP_FSVOL_DEVICE_EXTENSION *FsvolDeviceExtension = FspFsvolDeviceExtension(DeviceObject); FSP_FSVOL_DEVICE_EXTENSION *FsvolDeviceExtension = FspFsvolDeviceExtension(DeviceObject);
FSP_FSCTL_VOLUME_INFO VolumeInfoNp = *VolumeInfo; FSP_FSCTL_VOLUME_INFO VolumeInfoNp = *VolumeInfo;
KIRQL Irql; KIRQL Irql;
src/sys/volinfo.c
+14
View File
@@ -350,6 +350,14 @@ NTSTATUS FspFsvolQueryVolumeInformationComplete(
FSP_RETURN(); FSP_RETURN();
} }
if (Response->Rsp.QueryVolumeInformation.VolumeInfo.VolumeLabelLength >
sizeof Response->Rsp.QueryVolumeInformation.VolumeInfo.VolumeLabel)
{
Irp->IoStatus.Information = 0;
Result = STATUS_INTERNAL_ERROR;
FSP_RETURN();
}
PDEVICE_OBJECT FsvolDeviceObject = IrpSp->DeviceObject; PDEVICE_OBJECT FsvolDeviceObject = IrpSp->DeviceObject;
PUINT8 Buffer = Irp->AssociatedIrp.SystemBuffer; PUINT8 Buffer = Irp->AssociatedIrp.SystemBuffer;
PUINT8 BufferEnd = Buffer + IrpSp->Parameters.QueryVolume.Length; PUINT8 BufferEnd = Buffer + IrpSp->Parameters.QueryVolume.Length;
@@ -410,7 +418,13 @@ static NTSTATUS FspFsvolSetFsLabelInformation(
((PWSTR)Request->Buffer)[Info->VolumeLabelLength / sizeof(WCHAR)] = L'\0'; ((PWSTR)Request->Buffer)[Info->VolumeLabelLength / sizeof(WCHAR)] = L'\0';
} }
else else
{
if (Response->Rsp.SetVolumeInformation.VolumeInfo.VolumeLabelLength >
sizeof Response->Rsp.SetVolumeInformation.VolumeInfo.VolumeLabel)
return STATUS_INTERNAL_ERROR;
FspFsvolDeviceSetVolumeInfo(FsvolDeviceObject, &Response->Rsp.SetVolumeInformation.VolumeInfo); FspFsvolDeviceSetVolumeInfo(FsvolDeviceObject, &Response->Rsp.SetVolumeInformation.VolumeInfo);
}
return STATUS_SUCCESS; return STATUS_SUCCESS;
} }