ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

hidclass.sys: Return error on invalid read buffer size. 

Signed-off-by: Rémi Bernon <rbernon@codeweavers.com>
Signed-off-by: Zebediah Figura <zfigura@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Rémi Bernon 2021-07-06 11:00:52 +02:00 committed by Alexandre Julliard
parent d9d982df86
commit 5a62d0dbca
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
dlls/hidclass.sys/device.c
View File

@ -597,6 +597,7 @@ NTSTATUS WINAPI pdo_read(DEVICE_OBJECT *device, IRP *irp)
{
HID_XFER_PACKET *packet;
BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
const WINE_HIDP_PREPARSED_DATA *data = ext->u.pdo.preparsed_data;
UINT buffer_size = RingBuffer_GetBufferSize(ext->u.pdo.ring_buffer);
NTSTATUS rc = STATUS_SUCCESS;
IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation(irp);
@ -615,6 +616,13 @@ NTSTATUS WINAPI pdo_read(DEVICE_OBJECT *device, IRP *irp)
return STATUS_DELETE_PENDING;
}
if (irpsp->Parameters.Read.Length < data->caps.InputReportByteLength)
{
irp->IoStatus.Status = STATUS_INVALID_BUFFER_SIZE;
IoCompleteRequest( irp, IO_NO_INCREMENT );
return STATUS_INVALID_BUFFER_SIZE;
}
packet = malloc(buffer_size);
ptr = PtrToUlong( irp->Tail.Overlay.OriginalFileObject->FsContext );