Hesham/wintun
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Check buffer for oversize after MDL size consultation

Browse Source 
Signed-off-by: Simon Rozman <simon@rozman.si>
This commit is contained in:
Simon Rozman 2019-03-28 11:47:30 +01:00
parent 69d6f003e4
commit 6085957d9d
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
wintun.c
View File

@ -288,8 +288,6 @@ static NTSTATUS TunGetIrpBuffer(_In_ IRP *Irp, _Out_ UCHAR **buffer, _Out_ ULONG
default: default:
return STATUS_INVALID_PARAMETER; return STATUS_INVALID_PARAMETER;
} }
if (*size > TUN_EXCH_MAX_BUFFER_SIZE)
return STATUS_INVALID_USER_BUFFER;
/* Get buffer size and address. */ /* Get buffer size and address. */
if (!Irp->MdlAddress) if (!Irp->MdlAddress)
@ -301,6 +299,9 @@ static NTSTATUS TunGetIrpBuffer(_In_ IRP *Irp, _Out_ UCHAR **buffer, _Out_ ULONG
if (size_mdl < *size) if (size_mdl < *size)
*size = size_mdl; *size = size_mdl;
if (*size > TUN_EXCH_MAX_BUFFER_SIZE)
return STATUS_INVALID_USER_BUFFER;
return STATUS_SUCCESS; return STATUS_SUCCESS;
} }