From d58e76d5dc67b6fd0de663da8d2c913453fa9d37 Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Sun, 24 Jun 2012 13:39:32 +0000
Subject: [PATCH] [RTL] Fix a mistake in RtlNumberOfSetBits, check for index
 out of range in RtlFindNextForwardRun*

svn path=/trunk/; revision=56794
---
 reactos/lib/rtl/bitmap.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/reactos/lib/rtl/bitmap.c b/reactos/lib/rtl/bitmap.c
index 871556af411..f0e1bafa364 100644
--- a/reactos/lib/rtl/bitmap.c
+++ b/reactos/lib/rtl/bitmap.c
@@ -421,7 +421,7 @@ RtlNumberOfSetBits(
     }
 
     Shift = 8 - (BitMapHeader->SizeOfBitMap & 7);
-    BitCount += BitCountTable[(*Byte) << Shift];
+    BitCount += BitCountTable[((*Byte) << Shift) & 0xFF];
 
     return BitCount;
 }
@@ -618,6 +618,13 @@ RtlFindNextForwardRunClear(
 {
     ULONG Length;
 
+    /* Check for buffer overrun */
+    if (FromIndex >= BitMapHeader->SizeOfBitMap)
+    {
+        *StartingRunIndex = FromIndex;
+        return 0;
+    }
+
     /* Assume a set run first, count it's length */
     Length = RtlpGetLengthOfRunSet(BitMapHeader, FromIndex, MAXULONG);
     *StartingRunIndex = FromIndex + Length;
@@ -635,6 +642,13 @@ RtlFindNextForwardRunSet(
 {
     ULONG Length;
 
+    /* Check for buffer overrun */
+    if (FromIndex >= BitMapHeader->SizeOfBitMap)
+    {
+        *StartingRunIndex = FromIndex;
+        return 0;
+    }
+
     /* Assume a clear run first, count it's length */
     Length = RtlpGetLengthOfRunClear(BitMapHeader, FromIndex, MAXULONG);
     *StartingRunIndex = FromIndex + Length;