ApfelTeeSaft/reactos
1
0
Fork 0
mirror of https://github.com/ApfelTeeSaft/reactos.git synced 2026-08-29 19:26:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

[NPFS]

Browse Source 
- Do not fail for a valid buffer size in NpfsPeekPipe
- Do not read from an output buffer in NpfsPeekPipe

svn path=/trunk/; revision=57362
This commit is contained in:
Thomas Faber
2012-09-22 09:48:27 +00:00
parent 84deb4ab83
commit c721fa52d8
1 changed files with 18 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
reactos/drivers/filesystems/npfs/fsctrl.c
+18 -15
View File
@@ -581,14 +581,14 @@ NpfsPeekPipe(PIRP Irp,
DPRINT("OutputBufferLength: %lu\n", OutputBufferLength);
/* Validate parameters */
if (OutputBufferLength < sizeof(FILE_PIPE_PEEK_BUFFER))
if (OutputBufferLength < FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER, Data[0]))
{
DPRINT1("Buffer too small\n");
return STATUS_INVALID_PARAMETER;
}
Ccb = IoStack->FileObject->FsContext2;
Reply = (PFILE_PIPE_PEEK_BUFFER)Irp->AssociatedIrp.SystemBuffer;
Reply = Irp->AssociatedIrp.SystemBuffer;
//Fcb = Ccb->Fcb;
@@ -604,46 +604,49 @@ NpfsPeekPipe(PIRP Irp,
{
DPRINT("Byte Stream Mode\n");
Reply->MessageLength = Ccb->ReadDataAvailable;
DPRINT("Reply->MessageLength %lu\n",Reply->MessageLength );
DPRINT("Reply->MessageLength %lu\n", Reply->MessageLength);
MessageCount = 1;
if (Reply->Data[0] && (OutputBufferLength >= Ccb->ReadDataAvailable + FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER, Data[0])))
if (OutputBufferLength >= FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER, Data[Ccb->ReadDataAvailable]))
{
RtlCopyMemory(Reply->Data, BufferPtr, Ccb->ReadDataAvailable);
ReturnLength = Ccb->ReadDataAvailable;
memcpy(&Reply->Data[0], (PVOID)BufferPtr, Ccb->ReadDataAvailable);
}
}
else
{
DPRINT("Message Mode\n");
ReadDataAvailable=Ccb->ReadDataAvailable;
ReadDataAvailable = Ccb->ReadDataAvailable;
if (ReadDataAvailable > 0)
{
memcpy(&Reply->MessageLength, BufferPtr, sizeof(ULONG));
RtlCopyMemory(&Reply->MessageLength,
BufferPtr,
sizeof(Reply->MessageLength));
while ((ReadDataAvailable > 0) && (BufferPtr < Ccb->WritePtr))
{
memcpy(&MessageLength, BufferPtr, sizeof(MessageLength));
RtlCopyMemory(&MessageLength, BufferPtr, sizeof(MessageLength));
ASSERT(MessageLength > 0);
DPRINT("MessageLength = %lu\n",MessageLength);
DPRINT("MessageLength = %lu\n", MessageLength);
ReadDataAvailable -= MessageLength;
MessageCount++;
/* If its the first message, copy the Message if the size of buffer is large enough */
if (MessageCount==1)
if (MessageCount == 1)
{
if ((Reply->Data[0])
&& (OutputBufferLength >= (MessageLength + FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER, Data[0]))))
if (OutputBufferLength >= FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER, Data[MessageLength]))
{
memcpy(&Reply->Data[0], (PVOID)((ULONG_PTR)BufferPtr + sizeof(MessageLength)), MessageLength);
RtlCopyMemory(Reply->Data,
(PVOID)((ULONG_PTR)BufferPtr + sizeof(MessageLength)),
MessageLength);
ReturnLength = MessageLength;
}
}
BufferPtr =(PVOID)((ULONG_PTR)BufferPtr + MessageLength + sizeof(MessageLength));
BufferPtr = (PVOID)((ULONG_PTR)BufferPtr + sizeof(MessageLength) + MessageLength);
DPRINT("BufferPtr = %x\n", BufferPtr);
DPRINT("ReadDataAvailable: %lu\n", ReadDataAvailable);
}
@@ -659,7 +662,7 @@ NpfsPeekPipe(PIRP Irp,
Reply->NumberOfMessages = MessageCount;
Irp->IoStatus.Information = ReturnLength + FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER, Data[0]);
Irp->IoStatus.Information = FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER, Data[ReturnLength]);
Irp->IoStatus.Status = STATUS_SUCCESS;
Status = STATUS_SUCCESS;