Added ProbeForWrite() buffer writable check routine for Irp->UserBuffer in the See driver. The See driver is a legacy driver for packet capturing with NDIS 5.x (Windows 2000 or XP). It is based on the source code of WinPcap.
@@ -668,6 +668,8 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
PUINT pStats;
ULONG Information = 0;
+ BOOLEAN check_ok;
+
IF_LOUD(DbgPrint("NPF: IoControl\n");)
IrpSp = IoGetCurrentIrpStackLocation(Irp);
@@ -686,6 +688,22 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
EXIT_FAILURE(0);
}
+ check_ok = TRUE;
+ __try
+ {
+ ProbeForWrite(Irp->UserBuffer, IrpSp->Parameters.DeviceIoControl.OutputBufferLength, 1);
+ }
+ __except (EXCEPTION_EXECUTE_HANDLER)
+ {
+ check_ok = FALSE;
+ }
+
+ if (check_ok == FALSE)
+ {
+ EXIT_FAILURE(0);
+ }
+ else
+ {
pStats = (PUINT)(Irp->UserBuffer);
pStats[3] = 0;
@@ -702,6 +720,7 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
pStats[2] += 0; // Not yet supported
}
EXIT_SUCCESS(4*sizeof(UINT));
+ }
break;
@@ -711,9 +730,26 @@ NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
EXIT_FAILURE(0);
}
+ check_ok = TRUE;
+ __try
+ {
+ ProbeForWrite(Irp->UserBuffer, IrpSp->Parameters.DeviceIoControl.OutputBufferLength, 1);
+ }
+ __except (EXCEPTION_EXECUTE_HANDLER)
+ {
+ check_ok = FALSE;
+ }
+
+ if (check_ok == FALSE)
+ {
+ EXIT_FAILURE(0);
+ }
+ else
+ {
RtlCopyMemory(Irp->UserBuffer,(Open->ReadEventName.Buffer)+18,26);
EXIT_SUCCESS(26);
+ }
break;
