Author: cgutman Date: Mon Aug 27 03:42:28 2012 New Revision: 57173
URL: http://svn.reactos.org/svn/reactos?rev=57173&view=rev Log: [AFD] - Only access stack parameters when we're sure that the major function is correct
Modified: trunk/reactos/drivers/network/afd/afd/main.c
Modified: trunk/reactos/drivers/network/afd/afd/main.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/network/afd/afd/mai... ============================================================================== --- trunk/reactos/drivers/network/afd/afd/main.c [iso-8859-1] (original) +++ trunk/reactos/drivers/network/afd/afd/main.c [iso-8859-1] Mon Aug 27 03:42:28 2012 @@ -1046,23 +1046,38 @@ PAFD_SEND_INFO SendReq; PAFD_POLL_INFO PollReq;
- if (IrpSp->Parameters.DeviceIoControl.IoControlCode == IOCTL_AFD_RECV || - IrpSp->MajorFunction == IRP_MJ_READ) + if (IrpSp->MajorFunction == IRP_MJ_READ) { RecvReq = GetLockedData(Irp, IrpSp); UnlockBuffers(RecvReq->BufferArray, RecvReq->BufferCount, CheckUnlockExtraBuffers(FCB, IrpSp)); } - else if (IrpSp->Parameters.DeviceIoControl.IoControlCode == IOCTL_AFD_SEND || - IrpSp->MajorFunction == IRP_MJ_WRITE) + else if (IrpSp->MajorFunction == IRP_MJ_WRITE) { SendReq = GetLockedData(Irp, IrpSp); UnlockBuffers(SendReq->BufferArray, SendReq->BufferCount, CheckUnlockExtraBuffers(FCB, IrpSp)); } - else if (IrpSp->Parameters.DeviceIoControl.IoControlCode == IOCTL_AFD_SELECT) - { - PollReq = Irp->AssociatedIrp.SystemBuffer; - ZeroEvents(PollReq->Handles, PollReq->HandleCount); - SignalSocket(Poll, NULL, PollReq, STATUS_CANCELLED); + else + { + ASSERT(IrpSp->MajorFunction == IRP_MJ_DEVICE_CONTROL); + + if (IrpSp->Parameters.DeviceIoControl.IoControlCode == IOCTL_AFD_RECV) + { + RecvReq = GetLockedData(Irp, IrpSp); + UnlockBuffers(RecvReq->BufferArray, RecvReq->BufferCount, CheckUnlockExtraBuffers(FCB, IrpSp)); + } + else if (IrpSp->Parameters.DeviceIoControl.IoControlCode == IOCTL_AFD_SEND) + { + SendReq = GetLockedData(Irp, IrpSp); + UnlockBuffers(SendReq->BufferArray, SendReq->BufferCount, CheckUnlockExtraBuffers(FCB, IrpSp)); + } + else if (IrpSp->Parameters.DeviceIoControl.IoControlCode == IOCTL_AFD_SELECT) + { + ASSERT(Poll); + + PollReq = Irp->AssociatedIrp.SystemBuffer; + ZeroEvents(PollReq->Handles, PollReq->HandleCount); + SignalSocket(Poll, NULL, PollReq, STATUS_CANCELLED); + } } }