ApfelTeeSaft/reactos
1
0
Fork 0
mirror of https://github.com/ApfelTeeSaft/reactos.git synced 2026-09-02 04:13:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Andrey Korotaev <[email protected]>:

Browse Source 
- Never trust MaximumLength passed from usermode when copying a unicode string (fixes a wide amount of crashes, tested with CdrLabel 4.1).

svn path=/trunk/; revision=31010
This commit is contained in:
Aleksey Bragin
2007-12-04 22:52:05 +00:00
parent 98a17200e4
commit 729df301cd
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
reactos/subsystems/win32/win32k/ntuser/misc.c
+2 -1
View File
@@ -2397,10 +2397,10 @@ IntSafeCopyUnicodeString(PUNICODE_STRING Dest,
Src = Dest->Buffer;
Dest->Buffer = NULL;
Dest->MaximumLength = Dest->Length;
if(Dest->Length > 0 && Src)
{
Dest->MaximumLength = Dest->Length;
Dest->Buffer = ExAllocatePoolWithTag(PagedPool, Dest->MaximumLength, TAG_STRING);
if(!Dest->Buffer)
{
@@ -2443,6 +2443,7 @@ IntSafeCopyUnicodeStringTerminateNULL(PUNICODE_STRING Dest,
Src = Dest->Buffer;
Dest->Buffer = NULL;
Dest->MaximumLength = 0;
if(Dest->Length > 0 && Src)
{