Author: pschweitzer
Date: Wed Dec 22 00:13:03 2010
New Revision: 50090
URL: http://svn.reactos.org/svn/reactos?rev=50090&view=rev
Log:
[FASTFAT]
Fix for a buffer overflow and then a buffer overrun (if ever it fixes something)
The way filenames are handled for FAT entries should be REALLY simplified. This would prevent such errors.
Thus, there are more magic values in fastfat driver than everywhere else in ReactOS which makes proper fixing hard (impossible?).
Finally, the code for that fix is crappy, but I don't care, it fits the rest of the fastfat driver code.
*pissed off*
Fixes CID #2502
Modified:
trunk/reactos/drivers/filesystems/fastfat/volume.c
Modified: trunk/reactos/drivers/filesystems/fastfat/volume.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/filesystems/fastfa…
==============================================================================
--- trunk/reactos/drivers/filesystems/fastfat/volume.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/filesystems/fastfat/volume.c [iso-8859-1] Wed Dec 22 00:13:03 2010
@@ -220,8 +220,16 @@
}
else
{
- RtlCopyMemory(VolumeLabelDirEntry.Fat.Filename, cString, LabelLen);
- memset(&VolumeLabelDirEntry.Fat.Filename[LabelLen], ' ', 11 - LabelLen);
+ RtlCopyMemory(VolumeLabelDirEntry.Fat.Filename, cString, max(sizeof(VolumeLabelDirEntry.Fat.Filename), LabelLen));
+ if (LabelLen > sizeof(VolumeLabelDirEntry.Fat.Filename))
+ {
+ memset(VolumeLabelDirEntry.Fat.Ext, ' ', sizeof(VolumeLabelDirEntry.Fat.Ext));
+ RtlCopyMemory(VolumeLabelDirEntry.Fat.Ext, cString + sizeof(VolumeLabelDirEntry.Fat.Filename), LabelLen - sizeof(VolumeLabelDirEntry.Fat.Filename));
+ }
+ else
+ {
+ memset(&VolumeLabelDirEntry.Fat.Filename[LabelLen], ' ', sizeof(VolumeLabelDirEntry.Fat.Filename) - LabelLen);
+ }
VolumeLabelDirEntry.Fat.Attrib = 0x08;
}
Author: pschweitzer
Date: Tue Dec 21 21:35:04 2010
New Revision: 50083
URL: http://svn.reactos.org/svn/reactos?rev=50083&view=rev
Log:
[NTOSKRNL]
Actually, code was correct, but ugly (who said "normal, that's a hack).
So, when that code is called from SetupLDR, KeyHandle is required to be to 1. This what code does. Thing we do in the if condition when it appears we are called from SetupLDR.
To avoid any further question, or warning, adding more parenthesis to show that we know what we do.
So, to sum up, there's no comparaison for KeyHandle
Modified:
trunk/reactos/ntoskrnl/io/iomgr/driver.c
Modified: trunk/reactos/ntoskrnl/io/iomgr/driver.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/io/iomgr/driver.c…
==============================================================================
--- trunk/reactos/ntoskrnl/io/iomgr/driver.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/io/iomgr/driver.c [iso-8859-1] Tue Dec 21 21:35:04 2010
@@ -932,16 +932,16 @@
/* Get highest group order index */
IopGroupIndex = PpInitGetGroupOrderIndex(NULL);
if (IopGroupIndex == 0xFFFF) ASSERT(FALSE);
-
+
/* Allocate the group table */
IopGroupTable = ExAllocatePoolWithTag(PagedPool,
IopGroupIndex * sizeof(LIST_ENTRY),
TAG_IO);
if (IopGroupTable == NULL) ASSERT(FALSE);
-
+
/* Initialize the group table lists */
for (i = 0; i < IopGroupIndex; i++) InitializeListHead(&IopGroupTable[i]);
-
+
/* Loop the boot modules */
ListHead = &KeLoaderBlock->LoadOrderListHead;
NextEntry = ListHead->Flink;
@@ -951,18 +951,18 @@
LdrEntry = CONTAINING_RECORD(NextEntry,
LDR_DATA_TABLE_ENTRY,
InLoadOrderLinks);
-
+
/* Check if the DLL needs to be initialized */
if (LdrEntry->Flags & LDRP_DRIVER_DEPENDENT_DLL)
{
/* Call its entrypoint */
MmCallDllInitialize(LdrEntry, NULL);
}
-
+
/* Go to the next driver */
NextEntry = NextEntry->Flink;
}
-
+
/* Loop the boot drivers */
ListHead = &KeLoaderBlock->BootDriverListHead;
NextEntry = ListHead->Flink;
@@ -972,10 +972,10 @@
BootEntry = CONTAINING_RECORD(NextEntry,
BOOT_DRIVER_LIST_ENTRY,
Link);
-
+
/* Get the driver loader entry */
LdrEntry = BootEntry->LdrEntry;
-
+
/* Allocate our internal accounting structure */
DriverInfo = ExAllocatePoolWithTag(PagedPool,
sizeof(DRIVER_INFORMATION),
@@ -986,24 +986,24 @@
RtlZeroMemory(DriverInfo, sizeof(DRIVER_INFORMATION));
InitializeListHead(&DriverInfo->Link);
DriverInfo->DataTableEntry = BootEntry;
-
+
/* Open the registry key */
Status = IopOpenRegistryKeyEx(&KeyHandle,
NULL,
&BootEntry->RegistryPath,
KEY_READ);
if ((NT_SUCCESS(Status)) || /* ReactOS HACK for SETUPLDR */
- ((KeLoaderBlock->SetupLdrBlock) && (KeyHandle == (PVOID)1)))
+ ((KeLoaderBlock->SetupLdrBlock) && ((KeyHandle = (PVOID)1))))
{
/* Save the handle */
DriverInfo->ServiceHandle = KeyHandle;
-
+
/* Get the group oder index */
Index = PpInitGetGroupOrderIndex(KeyHandle);
-
+
/* Get the tag position */
DriverInfo->TagPosition = PipGetDriverTagPriority(KeyHandle);
-
+
/* Insert it into the list, at the right place */
ASSERT(Index < IopGroupIndex);
NextEntry2 = IopGroupTable[Index].Flink;
@@ -1013,18 +1013,18 @@
DriverInfoTag = CONTAINING_RECORD(NextEntry2,
DRIVER_INFORMATION,
Link);
-
+
/* Check if we found the right tag position */
if (DriverInfoTag->TagPosition > DriverInfo->TagPosition)
{
/* We're done */
break;
}
-
+
/* Next entry */
NextEntry2 = NextEntry2->Flink;
}
-
+
/* Insert us right before the next entry */
NextEntry2 = NextEntry2->Blink;
InsertHeadList(NextEntry2, &DriverInfo->Link);
@@ -1046,18 +1046,18 @@
DriverInfo = CONTAINING_RECORD(NextEntry,
DRIVER_INFORMATION,
Link);
-
+
/* Get the driver loader entry */
LdrEntry = DriverInfo->DataTableEntry->LdrEntry;
-
+
/* Initialize it */
IopInitializeBuiltinDriver(LdrEntry);
-
+
/* Next entry */
NextEntry = NextEntry->Flink;
}
}
-
+
/* In old ROS, the loader list became empty after this point. Simulate. */
InitializeListHead(&KeLoaderBlock->LoadOrderListHead);
}