Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-06-27 16:31:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

[NTOSKRNL] Avoid integer overflow when computing VACB read/write size

Browse source 
This could be triggered when attempting to read/write to really big
files. It was causing an attempt to read 0 bytes in Cc, leading to
asserts failure in the kernel (and corrupted file).

CORE-15067
This commit is contained in:
Pierre Schweitzer 2018-09-21 08:31:05 +02:00
parent ef016bfe0a
commit 15a3ca08b0
No known key found for this signature in database
GPG key ID: 7545556C3D585B0B
1 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
ntoskrnl/cc/copy.c
View file

@ -86,12 +86,14 @@ CcReadVirtualAddress (
NTSTATUS Status;
IO_STATUS_BLOCK IoStatus;
KEVENT Event;
ULARGE_INTEGER LargeSize;
Size = (ULONG)(Vacb->SharedCacheMap->SectionSize.QuadPart - Vacb->FileOffset.QuadPart);
if (Size > VACB_MAPPING_GRANULARITY)
LargeSize.QuadPart = Vacb->SharedCacheMap->SectionSize.QuadPart - Vacb->FileOffset.QuadPart;
if (LargeSize.QuadPart > VACB_MAPPING_GRANULARITY)
{
Size = VACB_MAPPING_GRANULARITY;
LargeSize.QuadPart = VACB_MAPPING_GRANULARITY;
}
Size = LargeSize.LowPart;
Pages = BYTES_TO_PAGES(Size);
ASSERT(Pages * PAGE_SIZE <= VACB_MAPPING_GRANULARITY);
@ -155,12 +157,14 @@ CcWriteVirtualAddress (
NTSTATUS Status;
IO_STATUS_BLOCK IoStatus;
KEVENT Event;
ULARGE_INTEGER LargeSize;
Size = (ULONG)(Vacb->SharedCacheMap->SectionSize.QuadPart - Vacb->FileOffset.QuadPart);
if (Size > VACB_MAPPING_GRANULARITY)
LargeSize.QuadPart = Vacb->SharedCacheMap->SectionSize.QuadPart - Vacb->FileOffset.QuadPart;
if (LargeSize.QuadPart > VACB_MAPPING_GRANULARITY)
{
Size = VACB_MAPPING_GRANULARITY;
LargeSize.QuadPart = VACB_MAPPING_GRANULARITY;
}
Size = LargeSize.LowPart;
//
// Nonpaged pool PDEs in ReactOS must actually be synchronized between the
// MmGlobalPageDirectory and the real system PDE directory. What a mess...