mirror of
https://github.com/reactos/reactos.git
synced 2025-07-10 07:34:13 +00:00
[SETUPAPI] CM_Request_Device_Eject_ExA/W: Fix pszVetoName buffer size validation (#5943)
- Return CR_INVALID_POINTER if pszVetoName is NULL and ulNameLength is not zero - CM_Request_Device_Eject_ExA: Allow ulNameLength to be zero when pszVetoName is not NULL Verified with Windows 2003 SP2.
This commit is contained in:
parent
9578bae858
commit
7f346b1aa3
1 changed files with 11 additions and 8 deletions
|
@ -7483,22 +7483,25 @@ CM_Request_Device_Eject_ExA(
|
||||||
_In_ ULONG ulFlags,
|
_In_ ULONG ulFlags,
|
||||||
_In_opt_ HMACHINE hMachine)
|
_In_opt_ HMACHINE hMachine)
|
||||||
{
|
{
|
||||||
LPWSTR lpLocalVetoName;
|
LPWSTR lpLocalVetoName = NULL;
|
||||||
CONFIGRET ret;
|
CONFIGRET ret;
|
||||||
|
|
||||||
TRACE("CM_Request_Device_Eject_ExA(%lx %p %s %lu %lx %p)\n",
|
TRACE("CM_Request_Device_Eject_ExA(%lx %p %s %lu %lx %p)\n",
|
||||||
dnDevInst, pVetoType, debugstr_a(pszVetoName), ulNameLength, ulFlags, hMachine);
|
dnDevInst, pVetoType, debugstr_a(pszVetoName), ulNameLength, ulFlags, hMachine);
|
||||||
|
|
||||||
if (pszVetoName == NULL && ulNameLength == 0)
|
if (ulNameLength != 0)
|
||||||
return CR_INVALID_POINTER;
|
{
|
||||||
|
if (pszVetoName == NULL)
|
||||||
|
return CR_INVALID_POINTER;
|
||||||
|
|
||||||
lpLocalVetoName = HeapAlloc(GetProcessHeap(), 0, ulNameLength * sizeof(WCHAR));
|
lpLocalVetoName = HeapAlloc(GetProcessHeap(), 0, ulNameLength * sizeof(WCHAR));
|
||||||
if (lpLocalVetoName == NULL)
|
if (lpLocalVetoName == NULL)
|
||||||
return CR_OUT_OF_MEMORY;
|
return CR_OUT_OF_MEMORY;
|
||||||
|
}
|
||||||
|
|
||||||
ret = CM_Request_Device_Eject_ExW(dnDevInst, pVetoType, lpLocalVetoName,
|
ret = CM_Request_Device_Eject_ExW(dnDevInst, pVetoType, lpLocalVetoName,
|
||||||
ulNameLength, ulFlags, hMachine);
|
ulNameLength, ulFlags, hMachine);
|
||||||
if (ret == CR_REMOVE_VETOED)
|
if (ret == CR_REMOVE_VETOED && ulNameLength != 0)
|
||||||
{
|
{
|
||||||
if (WideCharToMultiByte(CP_ACP,
|
if (WideCharToMultiByte(CP_ACP,
|
||||||
0,
|
0,
|
||||||
|
@ -7544,7 +7547,7 @@ CM_Request_Device_Eject_ExW(
|
||||||
if (ulFlags != 0)
|
if (ulFlags != 0)
|
||||||
return CR_INVALID_FLAG;
|
return CR_INVALID_FLAG;
|
||||||
|
|
||||||
if (pszVetoName == NULL && ulNameLength == 0)
|
if (pszVetoName == NULL && ulNameLength != 0)
|
||||||
return CR_INVALID_POINTER;
|
return CR_INVALID_POINTER;
|
||||||
|
|
||||||
if (hMachine != NULL)
|
if (hMachine != NULL)
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue