From e8062e7d291cad1939af052358f5faed5efb571b Mon Sep 17 00:00:00 2001
From: Dmitry Chapyshev <dmitry@reactos.org>
Date: Thu, 11 Jun 2009 15:21:58 +0000
Subject: [PATCH] - Add missed checks of the buffer length

svn path=/trunk/; revision=41383
---
 reactos/ntoskrnl/ps/query.c | 84 +++++++++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)

diff --git a/reactos/ntoskrnl/ps/query.c b/reactos/ntoskrnl/ps/query.c
index f856e47b689..511ffe11dbc 100644
--- a/reactos/ntoskrnl/ps/query.c
+++ b/reactos/ntoskrnl/ps/query.c
@@ -782,6 +782,13 @@ NtSetInformationProcess(IN HANDLE ProcessHandle,
         /* Error/Exception Port */
         case ProcessExceptionPort:
 
+            /* Check buffer length */
+            if (ProcessInformationLength != sizeof(HANDLE))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Use SEH for capture */
             _SEH2_TRY
             {
@@ -819,6 +826,13 @@ NtSetInformationProcess(IN HANDLE ProcessHandle,
         /* Security Token */
         case ProcessAccessToken:
 
+            /* Check buffer length */
+            if (ProcessInformationLength != sizeof(PROCESS_ACCESS_TOKEN))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Use SEH for capture */
             _SEH2_TRY
             {
@@ -841,6 +855,13 @@ NtSetInformationProcess(IN HANDLE ProcessHandle,
         /* Hard error processing */
         case ProcessDefaultHardErrorMode:
 
+            /* Check buffer length */
+            if (ProcessInformationLength != sizeof(ULONG))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Enter SEH for direct buffer read */
             _SEH2_TRY
             {
@@ -859,6 +880,13 @@ NtSetInformationProcess(IN HANDLE ProcessHandle,
         /* Session ID */
         case ProcessSessionInformation:
 
+            /* Check buffer length */
+            if (ProcessInformationLength != sizeof(PROCESS_SESSION_INFORMATION))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Enter SEH for capture */
             _SEH2_TRY
             {
@@ -1062,6 +1090,13 @@ NtSetInformationThread(IN HANDLE ThreadHandle,
         /* Thread priority */
         case ThreadPriority:
 
+            /* Check buffer length */
+            if (ThreadInformationLength != sizeof(KPRIORITY))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Use SEH for capture */
             _SEH2_TRY
             {
@@ -1091,6 +1126,13 @@ NtSetInformationThread(IN HANDLE ThreadHandle,
 
         case ThreadBasePriority:
 
+            /* Check buffer length */
+            if (ThreadInformationLength != sizeof(LONG))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Use SEH for capture */
             _SEH2_TRY
             {
@@ -1130,6 +1172,13 @@ NtSetInformationThread(IN HANDLE ThreadHandle,
 
         case ThreadAffinityMask:
 
+            /* Check buffer length */
+            if (ThreadInformationLength != sizeof(ULONG_PTR))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Use SEH for capture */
             _SEH2_TRY
             {
@@ -1191,6 +1240,13 @@ NtSetInformationThread(IN HANDLE ThreadHandle,
 
         case ThreadImpersonationToken:
 
+            /* Check buffer length */
+            if (ThreadInformationLength != sizeof(HANDLE))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Use SEH for capture */
             _SEH2_TRY
             {
@@ -1211,6 +1267,13 @@ NtSetInformationThread(IN HANDLE ThreadHandle,
 
         case ThreadQuerySetWin32StartAddress:
 
+            /* Check buffer length */
+            if (ThreadInformationLength != sizeof(ULONG_PTR))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Use SEH for capture */
             _SEH2_TRY
             {
@@ -1231,6 +1294,13 @@ NtSetInformationThread(IN HANDLE ThreadHandle,
 
         case ThreadIdealProcessor:
 
+            /* Check buffer length */
+            if (ThreadInformationLength != sizeof(ULONG_PTR))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Use SEH for capture */
             _SEH2_TRY
             {
@@ -1272,6 +1342,13 @@ NtSetInformationThread(IN HANDLE ThreadHandle,
 
         case ThreadPriorityBoost:
 
+            /* Check buffer length */
+            if (ThreadInformationLength != sizeof(ULONG_PTR))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Use SEH for capture */
             _SEH2_TRY
             {
@@ -1292,6 +1369,13 @@ NtSetInformationThread(IN HANDLE ThreadHandle,
 
         case ThreadZeroTlsCell:
 
+            /* Check buffer length */
+            if (ThreadInformationLength != sizeof(ULONG_PTR))
+            {
+                Status = STATUS_INFO_LENGTH_MISMATCH;
+                break;
+            }
+
             /* Use SEH for capture */
             _SEH2_TRY
             {