From 8e98dcd42e13bfeb5a2397ff9bf1c7f63c224e23 Mon Sep 17 00:00:00 2001 From: Derek Lesho Date: Mon, 20 Jul 2020 11:20:15 -0500 Subject: [PATCH] mountmgr.sys: Use SystemBuffer output for IOCTL_STORAGE_QUERY_PROPERTY. In METHOD_BUFFERED ioctls, SystemBuffer must be used as both the input and output buffer. Using UserBuffer directly, without any checks is dangerous and non-functional, as it will be overwritten by the contents of SystemBuffer in a correct implementation. Signed-off-by: Derek Lesho Signed-off-by: Alexandre Julliard --- dlls/mountmgr.sys/device.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/dlls/mountmgr.sys/device.c b/dlls/mountmgr.sys/device.c index f7a1f1e9b55..97208da4819 100644 --- a/dlls/mountmgr.sys/device.c +++ b/dlls/mountmgr.sys/device.c @@ -1771,12 +1771,11 @@ static void query_property( struct disk_device *device, IRP *irp ) if (device->serial) len += strlen( device->serial ) + 1; - if (!irp->UserBuffer - || irpsp->Parameters.DeviceIoControl.OutputBufferLength < sizeof(STORAGE_DESCRIPTOR_HEADER)) + if (irpsp->Parameters.DeviceIoControl.OutputBufferLength < sizeof(STORAGE_DESCRIPTOR_HEADER)) irp->IoStatus.u.Status = STATUS_INVALID_PARAMETER; else if (irpsp->Parameters.DeviceIoControl.OutputBufferLength < len) { - descriptor = irp->UserBuffer; + descriptor = irp->AssociatedIrp.SystemBuffer; descriptor->Version = sizeof(STORAGE_DEVICE_DESCRIPTOR); descriptor->Size = len; irp->IoStatus.Information = sizeof(STORAGE_DESCRIPTOR_HEADER); @@ -1786,8 +1785,8 @@ static void query_property( struct disk_device *device, IRP *irp ) { FIXME( "Faking StorageDeviceProperty data\n" ); - memset( irp->UserBuffer, 0, irpsp->Parameters.DeviceIoControl.OutputBufferLength ); - descriptor = irp->UserBuffer; + memset( irp->AssociatedIrp.SystemBuffer, 0, irpsp->Parameters.DeviceIoControl.OutputBufferLength ); + descriptor = irp->AssociatedIrp.SystemBuffer; descriptor->Version = sizeof(STORAGE_DEVICE_DESCRIPTOR); descriptor->Size = len; descriptor->DeviceType = FILE_DEVICE_DISK;