Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-08-04 09:16:17 +00:00
Code Issues Projects Releases Packages Wiki Activity

[FILESYSTEMS] Fix pool memory disclosure in filesystem drivers supporting FS_INFORMATION_CLASS.FileFsVolumeInformation (#2975)

Browse source 
* FileFsVolumeInformation-memory-disclosure

* remove unnecessary assignment to 0

* fix
This commit is contained in:
Nguyen Trung Khanh 2020-09-11 19:51:35 +07:00 • committed by GitHub
parent ede7a20a17
commit 166f815e7b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 15 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
drivers/filesystems/cdfs/volinfo.c
View file

@ -160,6 +160,10 @@ Return Value:
// and false if it couldn't wait for any I/O to complete. // and false if it couldn't wait for any I/O to complete.
// //
#ifdef __REACTOS__
RtlZeroMemory(Irp->AssociatedIrp.SystemBuffer, Length);
#endif // __REACTOS__
switch (IrpSp->Parameters.QueryVolume.FsInformationClass) { switch (IrpSp->Parameters.QueryVolume.FsInformationClass) {
case FileFsSizeInformation: case FileFsSizeInformation:

3
drivers/filesystems/fastfat/volume.c
View file

@ -48,7 +48,6 @@ FsdGetFsVolumeInformation(
RtlCopyMemory(FsVolumeInfo->VolumeLabel, RtlCopyMemory(FsVolumeInfo->VolumeLabel,
DeviceObject->Vpb->VolumeLabel, DeviceObject->Vpb->VolumeLabel,
*BufferLength); *BufferLength);
*BufferLength = 0;
} }
else else
{ {
@ -457,6 +456,8 @@ VfatQueryVolumeInformation(
DPRINT("FsInformationClass %d\n", FsInformationClass); DPRINT("FsInformationClass %d\n", FsInformationClass);
DPRINT("SystemBuffer %p\n", SystemBuffer); DPRINT("SystemBuffer %p\n", SystemBuffer);
RtlZeroMemory(SystemBuffer, BufferLength);
switch (FsInformationClass) switch (FsInformationClass)
{ {
case FileFsVolumeInformation: case FileFsVolumeInformation:

4
drivers/filesystems/nfs/nfs41_driver.c
View file

@ -4546,6 +4546,10 @@ NTSTATUS nfs41_QueryVolumeInformation(
status = check_nfs41_dirquery_args(RxContext); status = check_nfs41_dirquery_args(RxContext);
if (status) goto out; if (status) goto out;
#ifdef __REACTOS__
RtlZeroMemory(RxContext->Info.Buffer, RxContext->Info.LengthRemaining);
#endif // __REACTOS__
switch (InfoClass) { switch (InfoClass) {
case FileFsVolumeInformation: case FileFsVolumeInformation:
if ((ULONG)RxContext->Info.LengthRemaining >= DevExt->VolAttrsLen) { if ((ULONG)RxContext->Info.LengthRemaining >= DevExt->VolAttrsLen) {

8
drivers/filesystems/npfs/volinfo.c
View file

@ -27,8 +27,6 @@ NpQueryFsVolumeInfo(IN PVOID Buffer,
*Length -= FIELD_OFFSET(FILE_FS_VOLUME_INFORMATION, VolumeLabel); *Length -= FIELD_OFFSET(FILE_FS_VOLUME_INFORMATION, VolumeLabel);
InfoBuffer->VolumeCreationTime.QuadPart = 0;
InfoBuffer->VolumeSerialNumber = 0;
InfoBuffer->SupportsObjects = 0; InfoBuffer->SupportsObjects = 0;
NameLength = 18; NameLength = 18;
@ -61,8 +59,6 @@ NpQueryFsSizeInfo(IN PVOID Buffer,
*Length -= sizeof(*InfoBuffer); *Length -= sizeof(*InfoBuffer);
InfoBuffer->TotalAllocationUnits.QuadPart = 0;
InfoBuffer->AvailableAllocationUnits.QuadPart = 0;
InfoBuffer->SectorsPerAllocationUnit = 1; InfoBuffer->SectorsPerAllocationUnit = 1;
InfoBuffer->BytesPerSector = 1; InfoBuffer->BytesPerSector = 1;
@ -78,8 +74,6 @@ NpQueryFsDeviceInfo(IN PVOID Buffer,
PFILE_FS_DEVICE_INFORMATION InfoBuffer = Buffer; PFILE_FS_DEVICE_INFORMATION InfoBuffer = Buffer;
TRACE("Entered\n"); TRACE("Entered\n");
InfoBuffer->DeviceType = 0;
InfoBuffer->Characteristics = 0;
InfoBuffer->DeviceType = FILE_DEVICE_NAMED_PIPE; InfoBuffer->DeviceType = FILE_DEVICE_NAMED_PIPE;
*Length -= sizeof(*InfoBuffer); *Length -= sizeof(*InfoBuffer);
@ -153,6 +147,8 @@ NpCommonQueryVolumeInformation(IN PDEVICE_OBJECT DeviceObject,
Length = IoStack->Parameters.QueryVolume.Length; Length = IoStack->Parameters.QueryVolume.Length;
InfoClass = IoStack->Parameters.QueryVolume.FsInformationClass; InfoClass = IoStack->Parameters.QueryVolume.FsInformationClass;
RtlZeroMemory(Buffer, Length);
switch (InfoClass) switch (InfoClass)
{ {
case FileFsVolumeInformation: case FileFsVolumeInformation:

3
drivers/filesystems/udfs/volinfo.cpp
View file

@ -197,6 +197,9 @@ UDFCommonQueryVolInfo(
try_return(RC); try_return(RC);
} }
#endif //UDF_ENABLE_SECURITY #endif //UDF_ENABLE_SECURITY
RtlZeroMemory(Irp->AssociatedIrp.SystemBuffer, Length);
switch (IrpSp->Parameters.QueryVolume.FsInformationClass) { switch (IrpSp->Parameters.QueryVolume.FsInformationClass) {
case FileFsVolumeInformation: case FileFsVolumeInformation: