Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-02-22 16:36:33 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOS:MM] Some fixes for NtCreatePagingFile().

Browse source 
- Correctly probe the FileName user pointer before capturing its contents.
- A paging file name with zero length is invalid too.
- Remember (TODO!) in the code that the lower bounds of the Safe*Size values
  need to be checked too!
This commit is contained in:
Hermès Bélusca-Maïto 2019-01-27 22:49:50 +01:00
parent dda77704dd
commit 06d4fce5ee
No known key found for this signature in database
GPG key ID: 3B2539C65E7B93D0
1 changed files with 18 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
ntoskrnl/mm/pagefile.c
View file

@ -368,11 +368,11 @@ NtCreatePagingFile(IN PUNICODE_STRING FileName,
PWSTR Buffer; PWSTR Buffer;
DEVICE_TYPE DeviceType; DEVICE_TYPE DeviceType;
DPRINT("NtCreatePagingFile(FileName %wZ, MinimumSize %I64d)\n",
FileName, MinimumSize->QuadPart);
PAGED_CODE(); PAGED_CODE();
DPRINT("NtCreatePagingFile(FileName: '%wZ', MinimumSize: %I64d, MaximumSize: %I64d)\n",
FileName, MinimumSize->QuadPart, MaximumSize->QuadPart);
if (MmNumberOfPagingFiles >= MAX_PAGING_FILES) if (MmNumberOfPagingFiles >= MAX_PAGING_FILES)
{ {
return STATUS_TOO_MANY_PAGING_FILES; return STATUS_TOO_MANY_PAGING_FILES;
@ -391,10 +391,7 @@ NtCreatePagingFile(IN PUNICODE_STRING FileName,
{ {
SafeMinimumSize = ProbeForReadLargeInteger(MinimumSize); SafeMinimumSize = ProbeForReadLargeInteger(MinimumSize);
SafeMaximumSize = ProbeForReadLargeInteger(MaximumSize); SafeMaximumSize = ProbeForReadLargeInteger(MaximumSize);
PageFileName = ProbeForReadUnicodeString(FileName);
PageFileName.Length = FileName->Length;
PageFileName.MaximumLength = FileName->MaximumLength;
PageFileName.Buffer = FileName->Buffer;
} }
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{ {
@ -407,14 +404,14 @@ NtCreatePagingFile(IN PUNICODE_STRING FileName,
{ {
SafeMinimumSize = *MinimumSize; SafeMinimumSize = *MinimumSize;
SafeMaximumSize = *MaximumSize; SafeMaximumSize = *MaximumSize;
PageFileName = *FileName;
PageFileName.Length = FileName->Length;
PageFileName.MaximumLength = FileName->MaximumLength;
PageFileName.Buffer = FileName->Buffer;
} }
/* Pagefiles can't be larger than 4GB and ofcourse the minimum should be /*
smaller than the maximum */ * Pagefiles can't be larger than 4GB and of course
* the minimum should be smaller than the maximum.
*/
// TODO: Actually validate the lower bound of these sizes!
if (0 != SafeMinimumSize.u.HighPart) if (0 != SafeMinimumSize.u.HighPart)
{ {
return STATUS_INVALID_PARAMETER_2; return STATUS_INVALID_PARAMETER_2;
@ -428,31 +425,28 @@ NtCreatePagingFile(IN PUNICODE_STRING FileName,
return STATUS_INVALID_PARAMETER_MIX; return STATUS_INVALID_PARAMETER_MIX;
} }
/* Validate name length */ /* Validate the name length */
if (PageFileName.Length > 128 * sizeof(WCHAR)) if ((PageFileName.Length == 0) ||
(PageFileName.Length > 128 * sizeof(WCHAR)))
{ {
return STATUS_OBJECT_NAME_INVALID; return STATUS_OBJECT_NAME_INVALID;
} }
/* We won't care about any potential UNICODE_NULL */ /* We don't care about any potential UNICODE_NULL */
PageFileName.MaximumLength = PageFileName.Length; PageFileName.MaximumLength = PageFileName.Length;
/* Allocate a buffer to keep name copy */ /* Allocate a buffer to keep the name copy */
Buffer = ExAllocatePoolWithTag(PagedPool, PageFileName.Length, TAG_MM); Buffer = ExAllocatePoolWithTag(PagedPool, PageFileName.Length, TAG_MM);
if (Buffer == NULL) if (Buffer == NULL)
{ {
return STATUS_INSUFFICIENT_RESOURCES; return STATUS_INSUFFICIENT_RESOURCES;
} }
/* Copy name */ /* Copy the name */
if (PreviousMode != KernelMode) if (PreviousMode != KernelMode)
{ {
_SEH2_TRY _SEH2_TRY
{ {
if (PageFileName.Length != 0) ProbeForRead(PageFileName.Buffer, PageFileName.Length, sizeof(WCHAR));
{
ProbeForRead(PageFileName.Buffer, PageFileName.Length, sizeof(WCHAR));
}
RtlCopyMemory(Buffer, PageFileName.Buffer, PageFileName.Length); RtlCopyMemory(Buffer, PageFileName.Buffer, PageFileName.Length);
} }
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
@ -469,7 +463,7 @@ NtCreatePagingFile(IN PUNICODE_STRING FileName,
RtlCopyMemory(Buffer, PageFileName.Buffer, PageFileName.Length); RtlCopyMemory(Buffer, PageFileName.Buffer, PageFileName.Length);
} }
/* Erase caller's buffer with ours */ /* Replace caller's buffer with ours */
PageFileName.Buffer = Buffer; PageFileName.Buffer = Buffer;
/* Create the security descriptor for the page file */ /* Create the security descriptor for the page file */