hidclass.sys: Return error on invalid read buffer size.
Signed-off-by: Rémi Bernon <rbernon@codeweavers.com> Signed-off-by: Zebediah Figura <zfigura@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
parent
d9d982df86
commit
5a62d0dbca
|
@ -597,6 +597,7 @@ NTSTATUS WINAPI pdo_read(DEVICE_OBJECT *device, IRP *irp)
|
||||||
{
|
{
|
||||||
HID_XFER_PACKET *packet;
|
HID_XFER_PACKET *packet;
|
||||||
BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
|
BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
|
||||||
|
const WINE_HIDP_PREPARSED_DATA *data = ext->u.pdo.preparsed_data;
|
||||||
UINT buffer_size = RingBuffer_GetBufferSize(ext->u.pdo.ring_buffer);
|
UINT buffer_size = RingBuffer_GetBufferSize(ext->u.pdo.ring_buffer);
|
||||||
NTSTATUS rc = STATUS_SUCCESS;
|
NTSTATUS rc = STATUS_SUCCESS;
|
||||||
IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation(irp);
|
IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation(irp);
|
||||||
|
@ -615,6 +616,13 @@ NTSTATUS WINAPI pdo_read(DEVICE_OBJECT *device, IRP *irp)
|
||||||
return STATUS_DELETE_PENDING;
|
return STATUS_DELETE_PENDING;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (irpsp->Parameters.Read.Length < data->caps.InputReportByteLength)
|
||||||
|
{
|
||||||
|
irp->IoStatus.Status = STATUS_INVALID_BUFFER_SIZE;
|
||||||
|
IoCompleteRequest( irp, IO_NO_INCREMENT );
|
||||||
|
return STATUS_INVALID_BUFFER_SIZE;
|
||||||
|
}
|
||||||
|
|
||||||
packet = malloc(buffer_size);
|
packet = malloc(buffer_size);
|
||||||
ptr = PtrToUlong( irp->Tail.Overlay.OriginalFileObject->FsContext );
|
ptr = PtrToUlong( irp->Tail.Overlay.OriginalFileObject->FsContext );
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue