mirror of
https://github.com/reactos/reactos.git
synced 2024-06-30 01:42:30 +00:00
[CSRSRV]: In CsrCaptureArguments, be sure that the number of captured pointers is at most equal to MAXUSHORT (and not the total length of the captured buffer).
svn path=/trunk/; revision=60561
This commit is contained in:
parent
46e2b227f2
commit
eb9d268653
|
@ -1153,7 +1153,7 @@ CsrCaptureArguments(IN PCSR_THREAD CsrThread,
|
||||||
/* Check if the Length is valid */
|
/* Check if the Length is valid */
|
||||||
if ((FIELD_OFFSET(CSR_CAPTURE_BUFFER, PointerOffsetsArray) +
|
if ((FIELD_OFFSET(CSR_CAPTURE_BUFFER, PointerOffsetsArray) +
|
||||||
(LocalCaptureBuffer->PointerCount * sizeof(PVOID)) > Length) ||
|
(LocalCaptureBuffer->PointerCount * sizeof(PVOID)) > Length) ||
|
||||||
(Length > MAXWORD))
|
(LocalCaptureBuffer->PointerCount > MAXUSHORT))
|
||||||
{
|
{
|
||||||
/* Return failure */
|
/* Return failure */
|
||||||
DPRINT1("*** CSRSS: CaptureBuffer %p has bad length\n", LocalCaptureBuffer);
|
DPRINT1("*** CSRSS: CaptureBuffer %p has bad length\n", LocalCaptureBuffer);
|
||||||
|
|
Loading…
Reference in a new issue