Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-07-21 11:48:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

[PORTCLS]

Browse source 
- Fix buffer overflow

svn path=/trunk/; revision=47805
This commit is contained in:
Johannes Anderwald 2010-06-19 07:43:45 +00:00
parent 4da45c3ff1
commit bb28f2cb1a
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
reactos/drivers/wdm/audio/backpln/portcls/connection.cpp
View file

@ -207,7 +207,7 @@ RegisterConnection(
if (FromSubDeviceDescriptor) if (FromSubDeviceDescriptor)
{ {
FromEntry = (PPHYSICAL_CONNECTION_ENTRY)AllocateItem(NonPagedPool, sizeof(PHYSICAL_CONNECTION_ENTRY) + ToString->MaximumLength, TAG_PORTCLASS); FromEntry = (PPHYSICAL_CONNECTION_ENTRY)AllocateItem(NonPagedPool, sizeof(PHYSICAL_CONNECTION_ENTRY) + ToString->MaximumLength + sizeof(WCHAR), TAG_PORTCLASS);
if (!FromEntry) if (!FromEntry)
{ {
Status = STATUS_INSUFFICIENT_RESOURCES; Status = STATUS_INSUFFICIENT_RESOURCES;
@ -217,7 +217,7 @@ RegisterConnection(
if (ToSubDeviceDescriptor) if (ToSubDeviceDescriptor)
{ {
ToEntry = (PPHYSICAL_CONNECTION_ENTRY)AllocateItem(NonPagedPool, sizeof(PHYSICAL_CONNECTION_ENTRY) + FromString->MaximumLength, TAG_PORTCLASS); ToEntry = (PPHYSICAL_CONNECTION_ENTRY)AllocateItem(NonPagedPool, sizeof(PHYSICAL_CONNECTION_ENTRY) + FromString->MaximumLength + sizeof(WCHAR), TAG_PORTCLASS);
if (!ToEntry) if (!ToEntry)
{ {
Status = STATUS_INSUFFICIENT_RESOURCES; Status = STATUS_INSUFFICIENT_RESOURCES;
@ -229,9 +229,9 @@ RegisterConnection(
{ {
FromEntry->FromPin = FromPin; FromEntry->FromPin = FromPin;
FromEntry->Connection.Pin = ToPin; FromEntry->Connection.Pin = ToPin;
FromEntry->Connection.Size = sizeof(KSPIN_PHYSICALCONNECTION) + ToString->MaximumLength; FromEntry->Connection.Size = sizeof(KSPIN_PHYSICALCONNECTION) + ToString->MaximumLength + sizeof(WCHAR);
RtlMoveMemory(&FromEntry->Connection.SymbolicLinkName, ToString->Buffer, ToString->MaximumLength); RtlMoveMemory(&FromEntry->Connection.SymbolicLinkName, ToString->Buffer, ToString->MaximumLength);
FromEntry->Connection.SymbolicLinkName[ToString->Length / sizeof(WCHAR)] = L'\0'; FromEntry->Connection.SymbolicLinkName[ToString->Length / sizeof(WCHAR)] = UNICODE_NULL;
InsertTailList(&FromSubDeviceDescriptor->PhysicalConnectionList, &FromEntry->Entry); InsertTailList(&FromSubDeviceDescriptor->PhysicalConnectionList, &FromEntry->Entry);
} }
@ -241,9 +241,9 @@ RegisterConnection(
{ {
ToEntry->FromPin = ToPin; ToEntry->FromPin = ToPin;
ToEntry->Connection.Pin = FromPin; ToEntry->Connection.Pin = FromPin;
ToEntry->Connection.Size = sizeof(KSPIN_PHYSICALCONNECTION) + FromString->MaximumLength; ToEntry->Connection.Size = sizeof(KSPIN_PHYSICALCONNECTION) + FromString->MaximumLength + sizeof(WCHAR);
RtlMoveMemory(&ToEntry->Connection.SymbolicLinkName, FromString->Buffer, FromString->MaximumLength); RtlMoveMemory(&ToEntry->Connection.SymbolicLinkName, FromString->Buffer, FromString->MaximumLength);
ToEntry->Connection.SymbolicLinkName[FromString->Length / sizeof(WCHAR)] = L'\0'; ToEntry->Connection.SymbolicLinkName[FromString->Length / sizeof(WCHAR)] = UNICODE_NULL;
InsertTailList(&ToSubDeviceDescriptor->PhysicalConnectionList, &ToEntry->Entry); InsertTailList(&ToSubDeviceDescriptor->PhysicalConnectionList, &ToEntry->Entry);