[janderwald] 47763: [WDMAUD_KERNEL] - Fix possible buffer overflow [MMIXER] - Add sanity checks
Author: janderwald Date: Sat Jun 12 10:21:03 2010 New Revision: 47763
URL: http://svn.reactos.org/svn/reactos?rev=47763&view=rev Log: [WDMAUD_KERNEL] - Fix possible buffer overflow [MMIXER] - Add sanity checks
Modified: trunk/reactos/drivers/wdm/audio/legacy/wdmaud/deviface.c trunk/reactos/lib/drivers/sound/mmixer/controls.c trunk/reactos/lib/drivers/sound/mmixer/filter.c trunk/reactos/lib/drivers/sound/mmixer/mixer.c trunk/reactos/lib/drivers/sound/mmixer/priv.h trunk/reactos/lib/drivers/sound/mmixer/sup.c trunk/reactos/lib/drivers/sound/mmixer/wave.c
Modified: trunk/reactos/drivers/wdm/audio/legacy/wdmaud/deviface.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/wdm/audio/legacy/wd... ============================================================================== --- trunk/reactos/drivers/wdm/audio/legacy/wdmaud/deviface.c [iso-8859-1] (original) +++ trunk/reactos/drivers/wdm/audio/legacy/wdmaud/deviface.c [iso-8859-1] Sat Jun 12 10:21:03 2010 @@ -122,18 +122,32 @@ } else { + Entry = (SYSAUDIO_ENTRY*)AllocateItem(NonPagedPool, sizeof(SYSAUDIO_ENTRY)); + if (!Entry) + { + return STATUS_INSUFFICIENT_RESOURCES; + } + + Length = wcslen(DeviceName.Buffer) + 1; - Entry = (SYSAUDIO_ENTRY*)AllocateItem(NonPagedPool, sizeof(SYSAUDIO_ENTRY) + Length * sizeof(WCHAR)); - if (!Entry) - { + Entry->SymbolicLink.Length = 0; + Entry->SymbolicLink.MaximumLength = Length * sizeof(WCHAR); + Entry->SymbolicLink.Buffer = AllocateItem(NonPagedPool, Entry->SymbolicLink.MaximumLength); + + if (!Entry->SymbolicLink.Buffer) + { + FreeItem(Entry); return STATUS_INSUFFICIENT_RESOURCES; }
- Entry->SymbolicLink.Length = Entry->SymbolicLink.MaximumLength = Length * sizeof(WCHAR); - Entry->SymbolicLink.MaximumLength += sizeof(WCHAR); - Entry->SymbolicLink.Buffer = (LPWSTR) (Entry + 1); - - wcscpy(Entry->SymbolicLink.Buffer, DeviceName.Buffer); + Status = RtlAppendUnicodeStringToString(&Entry->SymbolicLink, &DeviceName); + + if (!NT_SUCCESS(Status)) + { + FreeItem(Entry->SymbolicLink.Buffer); + FreeItem(Entry); + return Status; + }
InsertTailList(&DeviceExtension->SysAudioDeviceList, &Entry->Entry); DeviceExtension->NumSysAudioDevices++;
Modified: trunk/reactos/lib/drivers/sound/mmixer/controls.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/lib/drivers/sound/mmixer/co... ============================================================================== --- trunk/reactos/lib/drivers/sound/mmixer/controls.c [iso-8859-1] (original) +++ trunk/reactos/lib/drivers/sound/mmixer/controls.c [iso-8859-1] Sat Jun 12 10:21:03 2010 @@ -15,6 +15,7 @@ IN PKSMULTIPLE_ITEM NodeTypes, IN ULONG bUpDirection, IN ULONG NodeConnectionIndex, + IN ULONG PinCount, OUT PULONG Pins) { PKSTOPOLOGY_CONNECTION Connection; @@ -41,6 +42,9 @@
//DPRINT("GetTargetPinsByNodeIndex FOUND Target Pin %u Parsed %u\n", PinId, Pins[PinId]);
+ // sanity check + ASSERT(PinId < PinCount); + /* mark pin index as a target pin */ Pins[PinId] = TRUE; return MM_STATUS_SUCCESS; @@ -61,7 +65,7 @@ for(Index = 0; Index < NodeConnectionCount; Index++) { // iterate recursively into the nodes - Status = MMixerGetTargetPinsByNodeConnectionIndex(MixerContext, NodeConnections, NodeTypes, bUpDirection, NodeConnection[Index], Pins); + Status = MMixerGetTargetPinsByNodeConnectionIndex(MixerContext, NodeConnections, NodeTypes, bUpDirection, NodeConnection[Index], PinCount, Pins); ASSERT(Status == MM_STATUS_SUCCESS); } // free node connection indexes @@ -597,6 +601,8 @@ DestinationLine->Line.Target.wMid = MixerInfo->MixCaps.wMid; DestinationLine->Line.Target.wPid = MixerInfo->MixCaps.wPid; DestinationLine->Line.Target.vDriverVersion = MixerInfo->MixCaps.vDriverVersion; + + ASSERT(MixerInfo->MixCaps.szPname[MAXPNAMELEN-1] == 0); wcscpy(DestinationLine->Line.Target.szPname, MixerInfo->MixCaps.szPname);
// initialize extra line @@ -736,11 +742,11 @@ return Status; }
- /* there should be no split in the bride pin */ + /* there should be no split in the bridge pin */ ASSERT(PinConnectionIndexCount == 1);
/* find all target pins of this connection */ - Status = MMixerGetTargetPinsByNodeConnectionIndex(MixerContext, NodeConnections, NodeTypes, FALSE, PinConnectionIndex[0], PinsRef); + Status = MMixerGetTargetPinsByNodeConnectionIndex(MixerContext, NodeConnections, NodeTypes, FALSE, PinConnectionIndex[0], PinsRefCount, PinsRef); if (Status != MM_STATUS_SUCCESS) { MixerContext->Free(PinsRef); @@ -779,7 +785,7 @@ }
// now get all connected source pins - Status = MMixerGetTargetPinsByNodeConnectionIndex(MixerContext, NodeConnections, NodeTypes, TRUE, MixerControls[0], PinsSrcRef); + Status = MMixerGetTargetPinsByNodeConnectionIndex(MixerContext, NodeConnections, NodeTypes, TRUE, MixerControls[0], PinsRefCount, PinsSrcRef); if (Status != MM_STATUS_SUCCESS) { // failed */ @@ -857,6 +863,9 @@ InitializeListHead(&MixerInfo->LineList); InitializeListHead(&MixerInfo->EventList);
+ // sanity check + ASSERT(PinCount); + // now allocate an array which will receive the indices of the pin // which has a ADC / DAC nodetype in its path Pins = (PULONG)MixerContext->Alloc(PinCount * sizeof(ULONG));
Modified: trunk/reactos/lib/drivers/sound/mmixer/filter.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/lib/drivers/sound/mmixer/fi... ============================================================================== --- trunk/reactos/lib/drivers/sound/mmixer/filter.c [iso-8859-1] (original) +++ trunk/reactos/lib/drivers/sound/mmixer/filter.c [iso-8859-1] Sat Jun 12 10:21:03 2010 @@ -57,6 +57,9 @@ if (Status != MM_STATUS_MORE_ENTRIES) return Status;
+ //sanity check + ASSERT(BytesReturned); + // allocate an result buffer MultipleItem = (PKSMULTIPLE_ITEM)MixerContext->Alloc(BytesReturned);
Modified: trunk/reactos/lib/drivers/sound/mmixer/mixer.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/lib/drivers/sound/mmixer/mi... ============================================================================== --- trunk/reactos/lib/drivers/sound/mmixer/mixer.c [iso-8859-1] (original) +++ trunk/reactos/lib/drivers/sound/mmixer/mixer.c [iso-8859-1] Sat Jun 12 10:21:03 2010 @@ -65,6 +65,8 @@ MixerCaps->vDriverVersion = MixerInfo->MixCaps.vDriverVersion; MixerCaps->fdwSupport = MixerInfo->MixCaps.fdwSupport; MixerCaps->cDestinations = MixerInfo->MixCaps.cDestinations; + + ASSERT(MixerInfo->MixCaps.szPname[MAXPNAMELEN-1] == 0); wcscpy(MixerCaps->szPname, MixerInfo->MixCaps.szPname);
return MM_STATUS_SUCCESS;
Modified: trunk/reactos/lib/drivers/sound/mmixer/priv.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/lib/drivers/sound/mmixer/pr... ============================================================================== --- trunk/reactos/lib/drivers/sound/mmixer/priv.h [iso-8859-1] (original) +++ trunk/reactos/lib/drivers/sound/mmixer/priv.h [iso-8859-1] Sat Jun 12 10:21:03 2010 @@ -178,6 +178,7 @@ IN PKSMULTIPLE_ITEM NodeTypes, IN ULONG bUpDirection, IN ULONG NodeConnectionIndex, + IN ULONG PinCount, OUT PULONG Pins);
MIXER_STATUS
Modified: trunk/reactos/lib/drivers/sound/mmixer/sup.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/lib/drivers/sound/mmixer/su... ============================================================================== --- trunk/reactos/lib/drivers/sound/mmixer/sup.c [iso-8859-1] (original) +++ trunk/reactos/lib/drivers/sound/mmixer/sup.c [iso-8859-1] Sat Jun 12 10:21:03 2010 @@ -358,7 +358,7 @@ { for(Index = 0; Index < NodeConnectionCount; Index++) { - Status = MMixerGetTargetPinsByNodeConnectionIndex(MixerContext, NodeConnections, NodeTypes, bUpDirection, NodeConnection[Index], Pins); + Status = MMixerGetTargetPinsByNodeConnectionIndex(MixerContext, NodeConnections, NodeTypes, bUpDirection, NodeConnection[Index], PinCount, Pins); ASSERT(Status == STATUS_SUCCESS); } MixerContext->Free((PVOID)NodeConnection); @@ -638,6 +638,7 @@ Status = MixerContext->QueryKeyValue(hKey, L"FriendlyName", (PVOID*)&Name, &Length, &Type); if (Status == MM_STATUS_SUCCESS) { + ASSERT(Length < MAXPNAMELEN); wcscpy(MixerInfo->MixCaps.szPname, Name); MixerContext->Free(Name); return Status; @@ -650,6 +651,7 @@ Status = MixerContext->QueryKeyValue(hKey, L"FriendlyName", (PVOID*)&Name, &Length, &Type); if (Status == MM_STATUS_SUCCESS) { + ASSERT(Length < MAXPNAMELEN); wcscpy(MixerInfo->MixCaps.szPname, Name); MixerContext->Free(Name); }
Modified: trunk/reactos/lib/drivers/sound/mmixer/wave.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/lib/drivers/sound/mmixer/wa... ============================================================================== --- trunk/reactos/lib/drivers/sound/mmixer/wave.c [iso-8859-1] (original) +++ trunk/reactos/lib/drivers/sound/mmixer/wave.c [iso-8859-1] Sat Jun 12 10:21:03 2010 @@ -360,6 +360,8 @@ WaveInfo->DeviceId = MixerData->DeviceId; WaveInfo->PinId = PinId;
+ // sanity check + ASSERT(wcslen(DeviceName) < MAXPNAMELEN);
/* copy device name */ if (bWaveIn) @@ -419,9 +421,6 @@
/* free dataranges buffer */ MixerContext->Free(MultipleItem); - - -
if (bWaveIn) {
-
janderwald＠svn.reactos.org