diff --git a/reactos/drivers/filesystems/cdfs/dirctl.c b/reactos/drivers/filesystems/cdfs/dirctl.c index 92594b8a977..7bfbc2de6e6 100644 --- a/reactos/drivers/filesystems/cdfs/dirctl.c +++ b/reactos/drivers/filesystems/cdfs/dirctl.c @@ -290,9 +290,26 @@ CdfsFindFile(PDEVICE_EXTENSION DeviceExt, return Status; } + if (Record->RecordLength < Record->FileIdLength + FIELD_OFFSET(DIR_RECORD, FileId)) + { + DPRINT1("Found corrupted entry! %u - %u\n", Record->RecordLength, Record->FileIdLength + FIELD_OFFSET(DIR_RECORD, FileId)); + RtlFreeUnicodeString(&FileToFindUpcase); + CcUnpinData(Context); + return STATUS_DISK_CORRUPT_ERROR; + } + DPRINT("Name '%S'\n", name); RtlInitUnicodeString(&LongName, name); + /* Was the entry degenerated? */ + if (LongName.Length < sizeof(WCHAR)) + { + DPRINT1("Found entry with invalid name!\n"); + RtlFreeUnicodeString(&FileToFindUpcase); + CcUnpinData(Context); + return STATUS_DISK_CORRUPT_ERROR; + } + ShortName.Length = 0; ShortName.MaximumLength = 26; ShortName.Buffer = ShortNameBuffer; diff --git a/reactos/drivers/filesystems/cdfs/fcb.c b/reactos/drivers/filesystems/cdfs/fcb.c index 649900e3f8d..5986b9170f5 100644 --- a/reactos/drivers/filesystems/cdfs/fcb.c +++ b/reactos/drivers/filesystems/cdfs/fcb.c @@ -558,12 +558,29 @@ CdfsDirFindFile(PDEVICE_EXTENSION DeviceExt, DPRINT("RecordLength %u ExtAttrRecordLength %u NameLength %u\n", Record->RecordLength, Record->ExtAttrRecordLength, Record->FileIdLength); + if (Record->RecordLength < Record->FileIdLength + FIELD_OFFSET(DIR_RECORD, FileId)) + { + DPRINT1("Found corrupted entry! %u - %u\n", Record->RecordLength, Record->FileIdLength + FIELD_OFFSET(DIR_RECORD, FileId)); + RtlFreeUnicodeString(&FileToFindUpcase); + CcUnpinData(Context); + return STATUS_DISK_CORRUPT_ERROR; + } + CdfsGetDirEntryName(DeviceExt, Record, Name); DPRINT ("Name '%S'\n", Name); DPRINT ("Sector %lu\n", DirectoryFcb->Entry.ExtentLocationL); DPRINT ("Offset %lu\n", Offset); RtlInitUnicodeString(&LongName, Name); + /* Was the entry degenerated? */ + if (LongName.Length < sizeof(WCHAR)) + { + DPRINT1("Found entry with invalid name!\n"); + RtlFreeUnicodeString(&FileToFindUpcase); + CcUnpinData(Context); + return STATUS_DISK_CORRUPT_ERROR; + } + RtlInitEmptyUnicodeString(&ShortName, ShortNameBuffer, sizeof(ShortNameBuffer)); RtlZeroMemory(ShortNameBuffer, sizeof(ShortNameBuffer));