[NTOSKRNL] Properly copy backtracking buffer content on realloc
authorBartosz Brachaczek <b.brachaczek@gmail.com>
Sun, 31 Mar 2019 09:42:56 +0000 (11:42 +0200)
committerPierre Schweitzer <pierre@reactos.org>
Sun, 31 Mar 2019 09:44:01 +0000 (11:44 +0200)
CORE-15902

ntoskrnl/fsrtl/dbcsname.c
ntoskrnl/fsrtl/name.c

index d44fde9..2c7300f 100644 (file)
@@ -305,21 +305,21 @@ FsRtlIsDbcsInExpression(IN PANSI_STRING Expression,
                         goto Exit;
                     }
 
-                    /* Backtracking is at the start of the buffer */
-                    BackTracking = AllocatedBuffer;
-
-                    /* Copy BackTrackingBuffer content */
-                    RtlCopyMemory(BackTracking,
-                                  BackTrackingBuffer,
+                    /* Copy BackTracking content. Note that it can point to either BackTrackingBuffer or OldBackTrackingBuffer */
+                    RtlCopyMemory(AllocatedBuffer,
+                                  BackTracking,
                                   RTL_NUMBER_OF(BackTrackingBuffer) * sizeof(USHORT));
 
-                    /* OldBackTracking is after BackTracking */
-                    OldBackTracking = &BackTracking[BackTrackingBufferSize];
+                    /* Place current Backtracking is at the start of the new buffer */
+                    BackTracking = AllocatedBuffer;
 
-                    /* Copy OldBackTrackingBuffer content */
-                    RtlCopyMemory(OldBackTracking,
-                                  OldBackTrackingBuffer,
+                    /* Copy OldBackTracking content */
+                    RtlCopyMemory(&BackTracking[BackTrackingBufferSize],
+                                  OldBackTracking,
                                   RTL_NUMBER_OF(OldBackTrackingBuffer) * sizeof(USHORT));
+
+                    /* Place current OldBackTracking after current BackTracking in the buffer */
+                    OldBackTracking = &BackTracking[BackTrackingBufferSize];
                 }
 
                 /* If lead byte present */
index ae93490..6a2c280 100644 (file)
@@ -157,21 +157,21 @@ FsRtlIsNameInExpressionPrivate(IN PUNICODE_STRING Expression,
                         goto Exit;
                     }
 
-                    /* Backtracking is at the start of the buffer */
-                    BackTracking = AllocatedBuffer;
-
-                    /* Copy BackTrackingBuffer content */
-                    RtlCopyMemory(BackTracking,
-                                  BackTrackingBuffer,
+                    /* Copy BackTracking content. Note that it can point to either BackTrackingBuffer or OldBackTrackingBuffer */
+                    RtlCopyMemory(AllocatedBuffer,
+                                  BackTracking,
                                   RTL_NUMBER_OF(BackTrackingBuffer) * sizeof(USHORT));
 
-                    /* OldBackTracking is after BackTracking */
-                    OldBackTracking = &BackTracking[BackTrackingBufferSize];
+                    /* Place current Backtracking is at the start of the new buffer */
+                    BackTracking = AllocatedBuffer;
 
-                    /* Copy OldBackTrackingBuffer content */
-                    RtlCopyMemory(OldBackTracking,
-                                  OldBackTrackingBuffer,
+                    /* Copy OldBackTracking content */
+                    RtlCopyMemory(&BackTracking[BackTrackingBufferSize],
+                                  OldBackTracking,
                                   RTL_NUMBER_OF(OldBackTrackingBuffer) * sizeof(USHORT));
+
+                    /* Place current OldBackTracking after current BackTracking in the buffer */
+                    OldBackTracking = &BackTracking[BackTrackingBufferSize];
                 }
 
                 /* Basic check to test if chars are equal */