Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-06-07 02:10:36 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOS:PNP] Avoid a fixed-length stack buffer in IopActionConfigureChildServices. CORE-15882

Browse source
This commit is contained in:
Thomas Faber 2019-03-24 15:04:37 +01:00
parent e1b20681f5
commit ccb91bebbe
No known key found for this signature in database
GPG key ID: 076E7C3D44720826
1 changed files with 14 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
ntoskrnl/io/pnpmgr/pnpmgr.c
View file

@ -2854,16 +2854,11 @@ IopActionConfigureChildServices(PDEVICE_NODE DeviceNode,
if (!(DeviceNode->Flags & (DNF_DISABLED | DNF_STARTED | DNF_ADDED))) if (!(DeviceNode->Flags & (DNF_DISABLED | DNF_STARTED | DNF_ADDED)))
{ {
WCHAR RegKeyBuffer[MAX_PATH];
UNICODE_STRING RegKey; UNICODE_STRING RegKey;
/* Install the service for this if it's in the CDDB */ /* Install the service for this if it's in the CDDB */
IopInstallCriticalDevice(DeviceNode); IopInstallCriticalDevice(DeviceNode);
RegKey.Length = 0;
RegKey.MaximumLength = sizeof(RegKeyBuffer);
RegKey.Buffer = RegKeyBuffer;
/* /*
* Retrieve configuration from Enum key * Retrieve configuration from Enum key
*/ */
@ -2885,11 +2880,24 @@ IopActionConfigureChildServices(PDEVICE_NODE DeviceNode,
QueryTable[1].DefaultData = L""; QueryTable[1].DefaultData = L"";
QueryTable[1].DefaultLength = 0; QueryTable[1].DefaultLength = 0;
RtlAppendUnicodeToString(&RegKey, L"\\Registry\\Machine\\System\\CurrentControlSet\\Enum\\"); RegKey.Length = 0;
RegKey.MaximumLength = sizeof(ENUM_ROOT) + sizeof(WCHAR) + DeviceNode->InstancePath.Length;
RegKey.Buffer = ExAllocatePoolWithTag(PagedPool,
RegKey.MaximumLength,
TAG_IO);
if (RegKey.Buffer == NULL)
{
IopDeviceNodeSetFlag(DeviceNode, DNF_DISABLED);
return STATUS_INSUFFICIENT_RESOURCES;
}
RtlAppendUnicodeToString(&RegKey, ENUM_ROOT);
RtlAppendUnicodeToString(&RegKey, L"\\");
RtlAppendUnicodeStringToString(&RegKey, &DeviceNode->InstancePath); RtlAppendUnicodeStringToString(&RegKey, &DeviceNode->InstancePath);
Status = RtlQueryRegistryValues(RTL_REGISTRY_ABSOLUTE, Status = RtlQueryRegistryValues(RTL_REGISTRY_ABSOLUTE,
RegKey.Buffer, QueryTable, NULL, NULL); RegKey.Buffer, QueryTable, NULL, NULL);
ExFreePoolWithTag(RegKey.Buffer, TAG_IO);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {