Rémi Bernon : hidclass.sys: Return error on invalid write buffer size.
Alexandre Julliard
julliard at winehq.org
Tue Jul 6 18:09:36 CDT 2021
Module: wine
Branch: master
Commit: 881b2d658352eec7cc9fcdd85ce8222ad1962d66
URL: https://source.winehq.org/git/wine.git/?a=commit;h=881b2d658352eec7cc9fcdd85ce8222ad1962d66
Author: Rémi Bernon <rbernon at codeweavers.com>
Date: Tue Jul 6 11:00:50 2021 +0200
hidclass.sys: Return error on invalid write buffer size.
Signed-off-by: Rémi Bernon <rbernon at codeweavers.com>
Signed-off-by: Zebediah Figura <zfigura at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
---
dlls/hidclass.sys/device.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/dlls/hidclass.sys/device.c b/dlls/hidclass.sys/device.c
index d3f5fa90fc7..5dd4aadb899 100644
--- a/dlls/hidclass.sys/device.c
+++ b/dlls/hidclass.sys/device.c
@@ -703,6 +703,20 @@ NTSTATUS WINAPI pdo_write(DEVICE_OBJECT *device, IRP *irp)
return STATUS_DELETE_PENDING;
}
+ if (!irpsp->Parameters.Write.Length)
+ {
+ irp->IoStatus.Status = STATUS_INVALID_USER_BUFFER;
+ IoCompleteRequest( irp, IO_NO_INCREMENT );
+ return irp->IoStatus.Status;
+ }
+
+ if (irpsp->Parameters.Write.Length < data->caps.OutputReportByteLength)
+ {
+ irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ IoCompleteRequest( irp, IO_NO_INCREMENT );
+ return irp->IoStatus.Status;
+ }
+
irp->IoStatus.Information = 0;
TRACE_(hid_report)("Device %p Buffer length %i Buffer %p\n", device, irpsp->Parameters.Write.Length, irp->AssociatedIrp.SystemBuffer);
More information about the wine-cvs
mailing list