From 1b2eeb23e0ddac8e6d95f4d9db6928aa84186beb Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Sat, 11 Dec 2021 15:41:30 -0500
Subject: [PATCH] [NTOS:EX] Fix BufferSize validation in NtCreateProfile.

See https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/bugdemo.htm
---
 ntoskrnl/ex/profile.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/ntoskrnl/ex/profile.c b/ntoskrnl/ex/profile.c
index a7e2e9b9fbe..2cdbdb6b1c6 100644
--- a/ntoskrnl/ex/profile.c
+++ b/ntoskrnl/ex/profile.c
@@ -104,6 +104,7 @@ NtCreateProfile(OUT PHANDLE ProfileHandle,
     NTSTATUS Status;
     ULONG Log2 = 0;
     ULONG_PTR Segment = 0;
+    ULONG BucketsRequired;
     PAGED_CODE();
 
     /* Easy way out */
@@ -136,7 +137,12 @@ NtCreateProfile(OUT PHANDLE ProfileHandle,
     }
 
     /* Make sure that the buckets can map the range */
-    if ((RangeSize >> (BucketSize - 2)) > BufferSize)
+    BucketsRequired = RangeSize >> BucketSize;
+    if (RangeSize & ((1 << BucketSize) - 1))
+    {
+        BucketsRequired++;
+    }
+    if (BucketsRequired > BufferSize / sizeof(ULONG))
     {
         DPRINT1("Bucket size too small\n");
         return STATUS_BUFFER_TOO_SMALL;