Virtualization
/
capstone
mirror of https://gitlab.com/qemu-project/capstone.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

provide a validity check to prevent against Integer overflow conditions (#870) 

* provide a validity check to prevent against Integer overflow conditions

* fix some style issues.
This commit is contained in:
Quang Nguyễn 2017-03-13 22:34:48 +07:00 committed by Nguyen Anh Quynh
parent 4b86d85e50
commit e3b79ca59b
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
windows/winkernel_mm.c
View File

@ -3,6 +3,7 @@
#include "winkernel_mm.h"
#include <ntddk.h>
#include <Ntintsafe.h>
// A pool tag for memory allocation
static const ULONG CS_WINKERNEL_POOL_TAG = 'kwsC';
@ -33,8 +34,16 @@ void * CAPSTONE_API cs_winkernel_malloc(size_t size)
// FP; a use of NonPagedPool is required for Windows 7 support
#pragma prefast(suppress : 30030) // Allocating executable POOL_TYPE memory
CS_WINKERNEL_MEMBLOCK *block = (CS_WINKERNEL_MEMBLOCK *)ExAllocatePoolWithTag(
NonPagedPool, size + sizeof(CS_WINKERNEL_MEMBLOCK), CS_WINKERNEL_POOL_TAG);
size_t number_of_bytes = 0;
CS_WINKERNEL_MEMBLOCK *block = NULL;
// A specially crafted size value can trigger the overflow.
// If the sum in a value that overflows or underflows the capacity of the type,
// the function returns NULL.
if (!NT_SUCCESS(RtlSizeTAdd(size, sizeof(CS_WINKERNEL_MEMBLOCK), &number_of_bytes))) {
return NULL;
}
block = (CS_WINKERNEL_MEMBLOCK *)ExAllocatePoolWithTag(
NonPagedPool, number_of_bytes, CS_WINKERNEL_POOL_TAG);
if (!block) {
return NULL;
}