Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-06-05 01:10:26 +00:00
Code Issues Projects Releases Packages Wiki Activity

[TCPIP] Fix buffer sizes in ReadIpConfiguration.

Browse source
This commit is contained in:
Thomas Faber 2018-01-08 13:58:20 +01:00
parent d87786bf6c
commit f54fb980ba
No known key found for this signature in database
GPG key ID: 076E7C3D44720826
1 changed files with 12 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
drivers/network/tcpip/datalink/lan.c
View file

@ -570,6 +570,7 @@ BOOLEAN ReadIpConfiguration(PIP_INTERFACE Interface)
OBJECT_ATTRIBUTES ObjectAttributes; OBJECT_ATTRIBUTES ObjectAttributes;
HANDLE ParameterHandle; HANDLE ParameterHandle;
PKEY_VALUE_PARTIAL_INFORMATION KeyValueInfo; PKEY_VALUE_PARTIAL_INFORMATION KeyValueInfo;
ULONG KeyValueInfoLength;
WCHAR Buffer[150]; WCHAR Buffer[150];
UNICODE_STRING IPAddress = RTL_CONSTANT_STRING(L"IPAddress"); UNICODE_STRING IPAddress = RTL_CONSTANT_STRING(L"IPAddress");
UNICODE_STRING Netmask = RTL_CONSTANT_STRING(L"SubnetMask"); UNICODE_STRING Netmask = RTL_CONSTANT_STRING(L"SubnetMask");
@ -608,7 +609,10 @@ BOOLEAN ReadIpConfiguration(PIP_INTERFACE Interface)
} }
else else
{ {
KeyValueInfo = ExAllocatePoolWithTag(PagedPool, sizeof(KEY_VALUE_PARTIAL_INFORMATION) + 16 * sizeof(WCHAR), KEY_VALUE_TAG); KeyValueInfoLength = FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data) + 16 * sizeof(WCHAR);
KeyValueInfo = ExAllocatePoolWithTag(PagedPool,
KeyValueInfoLength,
KEY_VALUE_TAG);
if (!KeyValueInfo) if (!KeyValueInfo)
{ {
ZwClose(ParameterHandle); ZwClose(ParameterHandle);
@ -620,11 +624,11 @@ BOOLEAN ReadIpConfiguration(PIP_INTERFACE Interface)
&EnableDhcp, &EnableDhcp,
KeyValuePartialInformation, KeyValuePartialInformation,
KeyValueInfo, KeyValueInfo,
sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(ULONG), KeyValueInfoLength,
&Unused); &Unused);
if (NT_SUCCESS(Status) && KeyValueInfo->DataLength == sizeof(ULONG) && (*(PULONG)KeyValueInfo->Data) == 0) if (NT_SUCCESS(Status) && KeyValueInfo->DataLength == sizeof(ULONG) && (*(PULONG)KeyValueInfo->Data) == 0)
{ {
RegistryDataU.MaximumLength = 16 + sizeof(WCHAR); RegistryDataU.MaximumLength = KeyValueInfoLength - FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data);
RegistryDataU.Buffer = (PWCHAR)KeyValueInfo->Data; RegistryDataU.Buffer = (PWCHAR)KeyValueInfo->Data;
/* Read the IP address */ /* Read the IP address */
@ -632,7 +636,7 @@ BOOLEAN ReadIpConfiguration(PIP_INTERFACE Interface)
&IPAddress, &IPAddress,
KeyValuePartialInformation, KeyValuePartialInformation,
KeyValueInfo, KeyValueInfo,
sizeof(KEY_VALUE_PARTIAL_INFORMATION) + 16 * sizeof(WCHAR), KeyValueInfoLength,
&Unused); &Unused);
if (NT_SUCCESS(Status)) if (NT_SUCCESS(Status))
{ {
@ -653,7 +657,7 @@ BOOLEAN ReadIpConfiguration(PIP_INTERFACE Interface)
&Netmask, &Netmask,
KeyValuePartialInformation, KeyValuePartialInformation,
KeyValueInfo, KeyValueInfo,
sizeof(KEY_VALUE_PARTIAL_INFORMATION) + 16 * sizeof(WCHAR), KeyValueInfoLength,
&Unused); &Unused);
if (NT_SUCCESS(Status)) if (NT_SUCCESS(Status))
{ {
@ -682,7 +686,7 @@ BOOLEAN ReadIpConfiguration(PIP_INTERFACE Interface)
&Gateway, &Gateway,
KeyValuePartialInformation, KeyValuePartialInformation,
KeyValueInfo, KeyValueInfo,
sizeof(KEY_VALUE_PARTIAL_INFORMATION) + 16 * sizeof(WCHAR), KeyValueInfoLength,
&Unused); &Unused);
if (NT_SUCCESS(Status)) if (NT_SUCCESS(Status))
{ {