[MOUNTMGR] Properly validate input buffer size
authorPierre Schweitzer <pierre@reactos.org>
Thu, 5 Sep 2019 06:22:59 +0000 (08:22 +0200)
committerPierre Schweitzer <pierre@reactos.org>
Thu, 5 Sep 2019 06:36:19 +0000 (08:36 +0200)
This avoids IOCTL_MOUNTMGR_QUERY_POINTS always failing

drivers/filters/mountmgr/device.c

index 17d720e..7172a3b 100644 (file)
@@ -1745,7 +1745,7 @@ MountMgrQueryPoints(IN PDEVICE_EXTENSION DeviceExtension,
 
     /* We can't go beyond */
     if (((ULONG)MountPoint->SymbolicLinkNameLength + MountPoint->UniqueIdLength +
-        MountPoint->DeviceNameLength) < Stack->Parameters.DeviceIoControl.InputBufferLength)
+        MountPoint->DeviceNameLength) > Stack->Parameters.DeviceIoControl.InputBufferLength)
     {
         return STATUS_INVALID_PARAMETER;
     }