Protect against writes beyond the end of partition.

svn path=/trunk/; revision=13386

diff --git a/reactos/drivers/storage/disk/disk.c b/reactos/drivers/storage/disk/disk.c
index e2910de..2d68cf8 100644 (file)
--- a/reactos/drivers/storage/disk/disk.c
+++ b/reactos/drivers/storage/disk/disk.c
@@ -390,6 +390,8 @@ DiskClassCheckReadWrite(IN PDEVICE_OBJECT DeviceObject,
 {
   PDEVICE_EXTENSION DeviceExtension;
   PDISK_DATA DiskData;
 {
   PDEVICE_EXTENSION DeviceExtension;
   PDISK_DATA DiskData;

+  PIO_STACK_LOCATION IrpStack;
+  ULARGE_INTEGER EndingOffset;

 
   DPRINT("DiskClassCheckReadWrite() called\n");
 
 
   DPRINT("DiskClassCheckReadWrite() called\n");
 


@@ -404,6 +406,16 @@ DiskClassCheckReadWrite(IN PDEVICE_OBJECT DeviceObject,
       return(STATUS_INVALID_PARAMETER);
     }
 
       return(STATUS_INVALID_PARAMETER);
     }
 

+  IrpStack = IoGetCurrentIrpStackLocation(Irp);  
+  EndingOffset.QuadPart = IrpStack->Parameters.Read.ByteOffset.QuadPart +
+                          IrpStack->Parameters.Read.Length;
+
+  if (EndingOffset.QuadPart > DeviceExtension->PartitionLength.QuadPart)
+    {
+      Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+      return(STATUS_INVALID_PARAMETER);
+    }
+

   return(STATUS_SUCCESS);
 }
 
   return(STATUS_SUCCESS);
 }