ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

hidclass.sys: Don't crash when no buffer was provided. 

Signed-off-by: Rémi Bernon <rbernon@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Rémi Bernon 2021-06-07 11:11:37 +02:00 committed by Alexandre Julliard
parent 40b418bd1f
commit f43c01fa82
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
dlls/hidclass.sys/device.c
View File

@ -345,6 +345,12 @@ static NTSTATUS HID_get_feature(BASE_DEVICE_EXTENSION *ext, IRP *irp)
out_buffer = MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);
TRACE_(hid_report)("Device %p Buffer length %i Buffer %p\n", ext, irpsp->Parameters.DeviceIoControl.OutputBufferLength, out_buffer);
if (!irpsp->Parameters.DeviceIoControl.OutputBufferLength || !out_buffer)
{
irp->IoStatus.Status = STATUS_BUFFER_TOO_SMALL;
return rc;
}
len = sizeof(*packet) + irpsp->Parameters.DeviceIoControl.OutputBufferLength;
packet = malloc(len);
packet->reportBufferLen = irpsp->Parameters.DeviceIoControl.OutputBufferLength;
@ -495,6 +501,12 @@ NTSTATUS WINAPI pdo_ioctl(DEVICE_OBJECT *device, IRP *irp)
BYTE *buffer = MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);
ULONG out_length;
if (!irpsp->Parameters.DeviceIoControl.OutputBufferLength || !buffer)
{
irp->IoStatus.Status = STATUS_BUFFER_TOO_SMALL;
break;
}
packet = malloc(packet_size);
if (ext->u.pdo.preparsed_data->reports[0].reportID)