Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-01-01 03:54:02 +00:00
Code Issues Projects Releases Packages Wiki Activity

[RTL]

Browse source 
- Fix a buffer overflow in RtlSetBits/RtlClearBits

svn path=/trunk/; revision=64867
This commit is contained in:
Thomas Faber 2014-10-21 14:22:28 +00:00
parent dfde71668b
commit 268d1c62fe
2 changed files with 20 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
reactos/lib/rtl/bitmap.c
View file

@ -362,8 +362,11 @@ RtlClearBits(
/* Clear what's left */
NumberToClear &= (_BITCOUNT - 1);
Mask = MAXINDEX << NumberToClear;
*Buffer &= Mask;
if (NumberToClear)
{
Mask = MAXINDEX << NumberToClear;
*Buffer &= Mask;
}
}
VOID
@ -419,8 +422,11 @@ RtlSetBits(
/* Set what's left */
NumberToSet &= (_BITCOUNT - 1);
Mask = MAXINDEX << NumberToSet;
*Buffer |= ~Mask;
if (NumberToSet)
{
Mask = MAXINDEX << NumberToSet;
*Buffer |= ~Mask;
}
}
BOOLEAN

10
rostests/apitests/ntdll/RtlBitmap.c
View file

@ -200,6 +200,11 @@ Test_RtlClearBits(void)
ok_hex(Buffer[0], 0x00001fff);
ok_hex(Buffer[1], 0xfffffff8);
memset(Buffer, 0xff, BufferSize);
RtlClearBits(&BitMapHeader, 63, 1);
ok_hex(Buffer[0], 0xffffffff);
ok_hex(Buffer[1], 0x7fffffff);
memset(Buffer, 0xcc, BufferSize);
RtlClearBits(&BitMapHeader, 3, 6);
RtlClearBits(&BitMapHeader, 11, 5);
@ -245,6 +250,11 @@ Test_RtlSetBits(void)
ok_hex(Buffer[0], 0xffffe000);
ok_hex(Buffer[1], 0x00000007);
memset(Buffer, 0x00, BufferSize);
RtlSetBits(&BitMapHeader, 63, 1);
ok_hex(Buffer[0], 0x00000000);
ok_hex(Buffer[1], 0x80000000);
memset(Buffer, 0xcc, BufferSize);
RtlSetBits(&BitMapHeader, 3, 6);
RtlSetBits(&BitMapHeader, 11, 5);