https://git.reactos.org/?p=reactos.git;a=commitdiff;h=d4a0549eb61b99b24e245b...
commit d4a0549eb61b99b24e245ba1b2d5343ecc98c7da Author: Mark Jansen mark.jansen@reactos.org AuthorDate: Sat Nov 23 16:23:28 2019 +0100 Commit: Mark Jansen mark.jansen@reactos.org CommitDate: Sat Nov 23 16:24:56 2019 +0100
[MOUNTMGR] Fix out of bounds write CORE-16530 --- drivers/filters/mountmgr/mountmgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/filters/mountmgr/mountmgr.c b/drivers/filters/mountmgr/mountmgr.c index aa152621b51..b79bb0f9f01 100644 --- a/drivers/filters/mountmgr/mountmgr.c +++ b/drivers/filters/mountmgr/mountmgr.c @@ -42,6 +42,7 @@ KEVENT UnloadEvent; LONG Unloading;
static const WCHAR Cunc[] = L"\??\C:"; +#define Cunc_LETTER_POSITION 4
/* * @implemented @@ -1106,7 +1107,7 @@ MountMgrMountedDeviceArrival(IN PDEVICE_EXTENSION DeviceExtension, /* Start checking all letters that could have been associated */ for (Letter = L'D'; Letter <= L'Z'; Letter++) { - CSymLink.Buffer[LETTER_POSITION] = Letter; + CSymLink.Buffer[Cunc_LETTER_POSITION] = Letter;
InitializeObjectAttributes(&ObjectAttributes, &CSymLink,