mirror of
https://github.com/reactos/reactos.git
synced 2024-06-30 01:42:30 +00:00
[CSRSRV]: In CsrCaptureArguments, be sure that the number of captured pointers is at most equal to MAXUSHORT (and not the total length of the captured buffer).
svn path=/trunk/; revision=60561
This commit is contained in:
parent
46e2b227f2
commit
eb9d268653
|
@ -1153,7 +1153,7 @@ CsrCaptureArguments(IN PCSR_THREAD CsrThread,
|
|||
/* Check if the Length is valid */
|
||||
if ((FIELD_OFFSET(CSR_CAPTURE_BUFFER, PointerOffsetsArray) +
|
||||
(LocalCaptureBuffer->PointerCount * sizeof(PVOID)) > Length) ||
|
||||
(Length > MAXWORD))
|
||||
(LocalCaptureBuffer->PointerCount > MAXUSHORT))
|
||||
{
|
||||
/* Return failure */
|
||||
DPRINT1("*** CSRSS: CaptureBuffer %p has bad length\n", LocalCaptureBuffer);
|
||||
|
|
Loading…
Reference in a new issue