Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-28 10:04:49 +00:00
Code Issues Projects Releases Packages Wiki Activity

- Check buffer sizes and color counts for IOCTL_VIDEO_SET_COLOR_REGISTERS request.

Browse source 
svn path=/trunk/; revision=9464
This commit is contained in:
Filip Navara 2004-05-22 08:53:26 +00:00
parent 1c1f4e3945
commit ed16c950dc
1 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
reactos/drivers/video/miniport/vbe/vbemp.c
View file

@ -473,9 +473,14 @@ VBEStartIO(
break; break;
case IOCTL_VIDEO_SET_COLOR_REGISTERS: case IOCTL_VIDEO_SET_COLOR_REGISTERS:
/* if (RequestPacket->InputBufferLength < sizeof(VIDEO_CLUT) ||
* FIXME: Check buffer size! RequestPacket->InputBufferLength <
*/ (((PVIDEO_CLUT)RequestPacket->InputBuffer)->NumEntries * sizeof(ULONG)) +
sizeof(VIDEO_CLUT))
{
RequestPacket->StatusBlock->Status = ERROR_INSUFFICIENT_BUFFER;
return TRUE;
}
Result = VBESetColorRegisters( Result = VBESetColorRegisters(
(PVBE_DEVICE_EXTENSION)HwDeviceExtension, (PVBE_DEVICE_EXTENSION)HwDeviceExtension,
(PVIDEO_CLUT)RequestPacket->InputBuffer, (PVIDEO_CLUT)RequestPacket->InputBuffer,
@ -797,6 +802,9 @@ VBESetColorRegisters(
ULONG Entry; ULONG Entry;
PULONG OutputEntry; PULONG OutputEntry;
if (ColorLookUpTable->NumEntries + ColorLookUpTable->FirstEntry > 256)
return FALSE;
if (DeviceExtension->VGACompatible) if (DeviceExtension->VGACompatible)
{ {
for (Entry = ColorLookUpTable->FirstEntry; for (Entry = ColorLookUpTable->FirstEntry;