ApfelTeeSaft/reactos
1
0
Fork 0
mirror of https://github.com/ApfelTeeSaft/reactos.git synced 2026-08-28 04:13:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

[NTOSKNRL]

Browse Source 
For both FsRtlIsNameInExpression() & FsRtlIsDbcsInExpression():
As both UNICODE_STRING & ANSI_STRING might not be NULL-termined, don't attempt to read null char.
This fixes potential buffer overruns.
Then it fixes some (all?) 'TempPte.u.Long != 0' assertion failure.
See issue #5923 for more details.

svn path=/trunk/; revision=50904
This commit is contained in:
Pierre Schweitzer
2011-02-25 20:15:51 +00:00
parent cd34e7ee1e
commit d6f4155e39
2 changed files with 25 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
reactos/ntoskrnl/fsrtl/dbcsname.c
+11 -6
View File
@@ -185,10 +185,15 @@ FsRtlIsDbcsInExpression(IN PANSI_STRING Expression,
break;
case '?':
ExpressionPosition++;
if (++ExpressionPosition == Expression->Length)
{
NamePosition = Name->Length;
break;
}
MatchingChars = NamePosition;
while (Name->Buffer[NamePosition] != Expression->Buffer[ExpressionPosition] &&
NamePosition < Name->Length)
while (NamePosition < Name->Length &&
Name->Buffer[NamePosition] != Expression->Buffer[ExpressionPosition])
{
NamePosition++;
}
@@ -200,7 +205,7 @@ FsRtlIsDbcsInExpression(IN PANSI_STRING Expression,
break;
case ANSI_DOS_DOT:
while (Name->Buffer[NamePosition] != '.' && NamePosition < Name->Length)
while (NamePosition < Name->Length && Name->Buffer[NamePosition] != '.')
{
NamePosition++;
}
@@ -246,8 +251,8 @@ FsRtlIsDbcsInExpression(IN PANSI_STRING Expression,
else if (StarFound != MAXUSHORT)
{
ExpressionPosition = StarFound + 1;
while (Name->Buffer[NamePosition] != Expression->Buffer[ExpressionPosition] &&
NamePosition < Name->Length)
while (NamePosition < Name->Length &&
Name->Buffer[NamePosition] != Expression->Buffer[ExpressionPosition])
{
NamePosition++;
}
reactos/ntoskrnl/fsrtl/name.c
+14 -9
View File
@@ -45,11 +45,16 @@ FsRtlIsNameInExpressionPrivate(IN PUNICODE_STRING Expression,
break;
case L'?':
ExpressionPosition++;
if (++ExpressionPosition == Expression->Length / sizeof(WCHAR))
{
NamePosition = Name->Length / sizeof(WCHAR);
break;
}
MatchingChars = NamePosition;
while ((IgnoreCase ? UpcaseTable[Name->Buffer[NamePosition]] :
Name->Buffer[NamePosition]) != Expression->Buffer[ExpressionPosition] &&
NamePosition < Name->Length / sizeof(WCHAR))
while (NamePosition < Name->Length / sizeof(WCHAR) &&
(IgnoreCase ? UpcaseTable[Name->Buffer[NamePosition]] :
Name->Buffer[NamePosition]) != Expression->Buffer[ExpressionPosition])
{
NamePosition++;
}
@@ -61,8 +66,8 @@ FsRtlIsNameInExpressionPrivate(IN PUNICODE_STRING Expression,
break;
case DOS_DOT:
while (Name->Buffer[NamePosition] != L'.' &&
NamePosition < Name->Length / sizeof(WCHAR))
while (NamePosition < Name->Length / sizeof(WCHAR) &&
Name->Buffer[NamePosition] != L'.')
{
NamePosition++;
}
@@ -108,9 +113,9 @@ FsRtlIsNameInExpressionPrivate(IN PUNICODE_STRING Expression,
else if (StarFound != MAXUSHORT)
{
ExpressionPosition = StarFound + 1;
while ((IgnoreCase ? UpcaseTable[Name->Buffer[NamePosition]] :
Name->Buffer[NamePosition]) != Expression->Buffer[ExpressionPosition] &&
NamePosition < Name->Length / sizeof(WCHAR))
while (NamePosition < Name->Length / sizeof(WCHAR) &&
(IgnoreCase ? UpcaseTable[Name->Buffer[NamePosition]] :
Name->Buffer[NamePosition]) != Expression->Buffer[ExpressionPosition])
{
NamePosition++;
}