[NTOSKRNL_VISTA]

Bug fixes to FsRtlRemoveDotsFromPath() (buffer overrun, buffer underrun, etc.).

This fixes the failing test

svn path=/trunk/; revision=71047
This commit is contained in:
Pierre Schweitzer 2016-03-25 22:12:08 +00:00
parent ef0b98d6fb
commit de0bb0d228

View file

@ -16,7 +16,7 @@ FsRtlRemoveDotsFromPath(IN PWSTR OriginalString,
IN USHORT PathLength,
OUT USHORT *NewLength)
{
USHORT Length, ReadPos, WritePos = 0;
USHORT Length, ReadPos, WritePos;
Length = PathLength / sizeof(WCHAR);
@ -35,13 +35,9 @@ FsRtlRemoveDotsFromPath(IN PWSTR OriginalString,
return STATUS_IO_REPARSE_DATA_INVALID;
}
if (Length > 0)
for (ReadPos = 0, WritePos = 0; ReadPos < Length; ++WritePos)
{
ReadPos = 0;
for (; ReadPos < Length; ++WritePos)
{
for (; ReadPos < Length; ++ReadPos)
for (; ReadPos > 0 && ReadPos < Length; ++ReadPos)
{
if (ReadPos < Length - 1 && OriginalString[ReadPos] == '\\' && OriginalString[ReadPos + 1] == '\\')
{
@ -105,10 +101,14 @@ FsRtlRemoveDotsFromPath(IN PWSTR OriginalString,
++ReadPos;
}
if (ReadPos >= Length)
{
break;
}
OriginalString[WritePos] = OriginalString[ReadPos];
++ReadPos;
}
}
*NewLength = WritePos * sizeof(WCHAR);