[NTOSKRNL] Properly copy backtracking buffer content on realloc

CORE-15902

diff --git a/ntoskrnl/fsrtl/dbcsname.c b/ntoskrnl/fsrtl/dbcsname.c
index d44fde9..2c7300f 100644 (file)
--- a/ntoskrnl/fsrtl/dbcsname.c
+++ b/ntoskrnl/fsrtl/dbcsname.c
@@ -305,21 +305,21 @@ FsRtlIsDbcsInExpression(IN PANSI_STRING Expression,
                         goto Exit;
                     }
 
                         goto Exit;
                     }
 

-                    /* Backtracking is at the start of the buffer */
-                    BackTracking = AllocatedBuffer;
-
-                    /* Copy BackTrackingBuffer content */
-                    RtlCopyMemory(BackTracking,
-                                  BackTrackingBuffer,
+                    /* Copy BackTracking content. Note that it can point to either BackTrackingBuffer or OldBackTrackingBuffer */
+                    RtlCopyMemory(AllocatedBuffer,
+                                  BackTracking,

                                   RTL_NUMBER_OF(BackTrackingBuffer) * sizeof(USHORT));
 
                                   RTL_NUMBER_OF(BackTrackingBuffer) * sizeof(USHORT));
 

-                    /* OldBackTracking is after BackTracking */
-                    OldBackTracking = &BackTracking[BackTrackingBufferSize];
+                    /* Place current Backtracking is at the start of the new buffer */
+                    BackTracking = AllocatedBuffer;

 
 

-                    /* Copy OldBackTrackingBuffer content */
-                    RtlCopyMemory(OldBackTracking,
-                                  OldBackTrackingBuffer,
+                    /* Copy OldBackTracking content */
+                    RtlCopyMemory(&BackTracking[BackTrackingBufferSize],
+                                  OldBackTracking,

                                   RTL_NUMBER_OF(OldBackTrackingBuffer) * sizeof(USHORT));
                                   RTL_NUMBER_OF(OldBackTrackingBuffer) * sizeof(USHORT));

+
+                    /* Place current OldBackTracking after current BackTracking in the buffer */
+                    OldBackTracking = &BackTracking[BackTrackingBufferSize];

                 }
 
                 /* If lead byte present */
                 }
 
                 /* If lead byte present */

diff --git a/ntoskrnl/fsrtl/name.c b/ntoskrnl/fsrtl/name.c
index ae93490..6a2c280 100644 (file)
--- a/ntoskrnl/fsrtl/name.c
+++ b/ntoskrnl/fsrtl/name.c
@@ -157,21 +157,21 @@ FsRtlIsNameInExpressionPrivate(IN PUNICODE_STRING Expression,
                         goto Exit;
                     }
 
                         goto Exit;
                     }
 

-                    /* Backtracking is at the start of the buffer */
-                    BackTracking = AllocatedBuffer;
-
-                    /* Copy BackTrackingBuffer content */
-                    RtlCopyMemory(BackTracking,
-                                  BackTrackingBuffer,
+                    /* Copy BackTracking content. Note that it can point to either BackTrackingBuffer or OldBackTrackingBuffer */
+                    RtlCopyMemory(AllocatedBuffer,
+                                  BackTracking,

                                   RTL_NUMBER_OF(BackTrackingBuffer) * sizeof(USHORT));
 
                                   RTL_NUMBER_OF(BackTrackingBuffer) * sizeof(USHORT));
 

-                    /* OldBackTracking is after BackTracking */
-                    OldBackTracking = &BackTracking[BackTrackingBufferSize];
+                    /* Place current Backtracking is at the start of the new buffer */
+                    BackTracking = AllocatedBuffer;

 
 

-                    /* Copy OldBackTrackingBuffer content */
-                    RtlCopyMemory(OldBackTracking,
-                                  OldBackTrackingBuffer,
+                    /* Copy OldBackTracking content */
+                    RtlCopyMemory(&BackTracking[BackTrackingBufferSize],
+                                  OldBackTracking,

                                   RTL_NUMBER_OF(OldBackTrackingBuffer) * sizeof(USHORT));
                                   RTL_NUMBER_OF(OldBackTrackingBuffer) * sizeof(USHORT));

+
+                    /* Place current OldBackTracking after current BackTracking in the buffer */
+                    OldBackTracking = &BackTracking[BackTrackingBufferSize];

                 }
 
                 /* Basic check to test if chars are equal */
                 }
 
                 /* Basic check to test if chars are equal */