Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-07-10 07:34:13 +00:00
Code Issues Projects Releases Packages Wiki Activity

[SETUPAPI] CM_Request_Device_Eject_ExA/W: Fix pszVetoName buffer size validation (#5943)

Browse source 
- Return CR_INVALID_POINTER if pszVetoName is NULL and ulNameLength is not zero
- CM_Request_Device_Eject_ExA: Allow ulNameLength to be zero when pszVetoName is not NULL

Verified with Windows 2003 SP2.
This commit is contained in:
Thamatip Chitpong 2023-11-22 08:58:27 +07:00 • committed by GitHub
parent 9578bae858
commit 7f346b1aa3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

19
dll/win32/setupapi/cfgmgr.c
View file

@ -7483,22 +7483,25 @@ CM_Request_Device_Eject_ExA(
_In_ ULONG ulFlags, _In_ ULONG ulFlags,
_In_opt_ HMACHINE hMachine) _In_opt_ HMACHINE hMachine)
{ {
LPWSTR lpLocalVetoName; LPWSTR lpLocalVetoName = NULL;
CONFIGRET ret; CONFIGRET ret;
TRACE("CM_Request_Device_Eject_ExA(%lx %p %s %lu %lx %p)\n", TRACE("CM_Request_Device_Eject_ExA(%lx %p %s %lu %lx %p)\n",
dnDevInst, pVetoType, debugstr_a(pszVetoName), ulNameLength, ulFlags, hMachine); dnDevInst, pVetoType, debugstr_a(pszVetoName), ulNameLength, ulFlags, hMachine);
if (pszVetoName == NULL && ulNameLength == 0) if (ulNameLength != 0)
return CR_INVALID_POINTER; {
if (pszVetoName == NULL)
return CR_INVALID_POINTER;
lpLocalVetoName = HeapAlloc(GetProcessHeap(), 0, ulNameLength * sizeof(WCHAR)); lpLocalVetoName = HeapAlloc(GetProcessHeap(), 0, ulNameLength * sizeof(WCHAR));
if (lpLocalVetoName == NULL) if (lpLocalVetoName == NULL)
return CR_OUT_OF_MEMORY; return CR_OUT_OF_MEMORY;
}
ret = CM_Request_Device_Eject_ExW(dnDevInst, pVetoType, lpLocalVetoName, ret = CM_Request_Device_Eject_ExW(dnDevInst, pVetoType, lpLocalVetoName,
ulNameLength, ulFlags, hMachine); ulNameLength, ulFlags, hMachine);
if (ret == CR_REMOVE_VETOED) if (ret == CR_REMOVE_VETOED && ulNameLength != 0)
{ {
if (WideCharToMultiByte(CP_ACP, if (WideCharToMultiByte(CP_ACP,
0, 0,
@ -7544,7 +7547,7 @@ CM_Request_Device_Eject_ExW(
if (ulFlags != 0) if (ulFlags != 0)
return CR_INVALID_FLAG; return CR_INVALID_FLAG;
if (pszVetoName == NULL && ulNameLength == 0) if (pszVetoName == NULL && ulNameLength != 0)
return CR_INVALID_POINTER; return CR_INVALID_POINTER;
if (hMachine != NULL) if (hMachine != NULL)