Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-08-05 17:12:57 +00:00
Code Issues Projects Releases Packages Wiki Activity

[BASESRV] Re-enable and actually fix the CsrValidateMessageBuffer() checks in BaseSrvDefineDosDevice(). (#3304)

Browse source 
Addendum to commit 0a392b18.

The actual problem that existed all along was that the buffers being
validated with CsrValidateMessageBuffer() were not the correct ones!

What had to be checked is the string buffer **INSIDE** the UNICODE_STRING
structures! Indeed, it is these buffers that we are allocating on client side,
see 9b421af1/dll/win32/kernel32/client/dosdev.c (L324-L336)

Dedicated to Pierre Schweitzer.
This commit is contained in:
Hermès Bélusca-Maïto 2020-10-17 16:40:50 +02:00
parent f4279fc356
commit 731eddfe40
No known key found for this signature in database
GPG key ID: 3B2539C65E7B93D0
1 changed files with 7 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

15
subsystems/win/basesrv/dosdev.c
View file

@ -514,22 +514,21 @@ CSR_API(BaseSrvDefineDosDevice)
PWSTR InterPtr; PWSTR InterPtr;
BOOLEAN RemoveFound; BOOLEAN RemoveFound;
#if 0
/* FIXME: Check why it fails.... */
if (!CsrValidateMessageBuffer(ApiMessage, if (!CsrValidateMessageBuffer(ApiMessage,
(PVOID*)&DefineDosDeviceRequest->DeviceName, (PVOID*)&DefineDosDeviceRequest->DeviceName.Buffer,
DefineDosDeviceRequest->DeviceName.Length, DefineDosDeviceRequest->DeviceName.Length,
1) || sizeof(BYTE)) ||
(DefineDosDeviceRequest->DeviceName.Length & 1) != 0 || (DefineDosDeviceRequest->DeviceName.Length & 1) != 0 ||
!CsrValidateMessageBuffer(ApiMessage, !CsrValidateMessageBuffer(ApiMessage,
(PVOID*)&DefineDosDeviceRequest->TargetPath, (PVOID*)&DefineDosDeviceRequest->TargetPath.Buffer,
(DefineDosDeviceRequest->TargetPath.Length != 0 ? sizeof(UNICODE_NULL) : 0) + DefineDosDeviceRequest->TargetPath.Length, DefineDosDeviceRequest->TargetPath.Length +
1) || (DefineDosDeviceRequest->TargetPath.Length != 0
? sizeof(UNICODE_NULL) : 0),
sizeof(BYTE)) ||
(DefineDosDeviceRequest->TargetPath.Length & 1) != 0) (DefineDosDeviceRequest->TargetPath.Length & 1) != 0)
{ {
return STATUS_INVALID_PARAMETER; return STATUS_INVALID_PARAMETER;
} }
#endif
DPRINT("BaseSrvDefineDosDevice entered, Flags:%d, DeviceName:%wZ (%d), TargetPath:%wZ (%d)\n", DPRINT("BaseSrvDefineDosDevice entered, Flags:%d, DeviceName:%wZ (%d), TargetPath:%wZ (%d)\n",
DefineDosDeviceRequest->Flags, DefineDosDeviceRequest->Flags,