Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-02-22 08:25:03 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOSKRNL] Guard against negative InformationClass enum values. CORE-15651

Browse source
This commit is contained in:
Thomas Faber 2019-01-19 11:35:18 +01:00
parent 1a14dcb53f
commit 63977328b1
No known key found for this signature in database
GPG key ID: 076E7C3D44720826
2 changed files with 16 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ntoskrnl/ex/sysinfo.c
View file

@ -2847,7 +2847,8 @@ NtQuerySystemInformation(
/*
* Check if the request is valid.
*/
if (SystemInformationClass >= MAX_SYSTEM_INFO_CLASS)
if (SystemInformationClass < MIN_SYSTEM_INFO_CLASS ||
SystemInformationClass >= MAX_SYSTEM_INFO_CLASS)
{
_SEH2_YIELD(return STATUS_INVALID_INFO_CLASS);
}
@ -2871,7 +2872,8 @@ NtQuerySystemInformation(
/*
* Check if the request is valid.
*/
if (SystemInformationClass >= MAX_SYSTEM_INFO_CLASS)
if (SystemInformationClass < MIN_SYSTEM_INFO_CLASS ||
SystemInformationClass >= MAX_SYSTEM_INFO_CLASS)
{
_SEH2_YIELD(return STATUS_INVALID_INFO_CLASS);
}

18
ntoskrnl/io/iomgr/iofunc.c
View file

@ -2158,7 +2158,8 @@ NtQueryInformationFile(IN HANDLE FileHandle,
if (PreviousMode != KernelMode)
{
/* Validate the information class */
if ((FileInformationClass >= FileMaximumInformation) ||
if ((FileInformationClass < 0) ||
(FileInformationClass >= FileMaximumInformation) ||
!(IopQueryOperationLength[FileInformationClass]))
{
/* Invalid class */
@ -2192,7 +2193,8 @@ NtQueryInformationFile(IN HANDLE FileHandle,
else
{
/* Validate the information class */
if ((FileInformationClass >= FileMaximumInformation) ||
if ((FileInformationClass < 0) ||
(FileInformationClass >= FileMaximumInformation) ||
!(IopQueryOperationLength[FileInformationClass]))
{
/* Invalid class */
@ -2959,7 +2961,8 @@ NtSetInformationFile(IN HANDLE FileHandle,
if (PreviousMode != KernelMode)
{
/* Validate the information class */
if ((FileInformationClass >= FileMaximumInformation) ||
if ((FileInformationClass < 0) ||
(FileInformationClass >= FileMaximumInformation) ||
!(IopSetOperationLength[FileInformationClass]))
{
/* Invalid class */
@ -2995,7 +2998,8 @@ NtSetInformationFile(IN HANDLE FileHandle,
else
{
/* Validate the information class */
if ((FileInformationClass >= FileMaximumInformation) ||
if ((FileInformationClass < 0) ||
(FileInformationClass >= FileMaximumInformation) ||
!(IopSetOperationLength[FileInformationClass]))
{
/* Invalid class */
@ -3991,7 +3995,8 @@ NtQueryVolumeInformationFile(IN HANDLE FileHandle,
if (PreviousMode != KernelMode)
{
/* Validate the information class */
if ((FsInformationClass >= FileFsMaximumInformation) ||
if ((FsInformationClass < 0) ||
(FsInformationClass >= FileFsMaximumInformation) ||
!(IopQueryFsOperationLength[FsInformationClass]))
{
/* Invalid class */
@ -4163,7 +4168,8 @@ NtSetVolumeInformationFile(IN HANDLE FileHandle,
if (PreviousMode != KernelMode)
{
/* Validate the information class */
if ((FsInformationClass >= FileFsMaximumInformation) ||
if ((FsInformationClass < 0) ||
(FsInformationClass >= FileFsMaximumInformation) ||
!(IopSetFsOperationLength[FsInformationClass]))
{
/* Invalid class */