[NTOSKRNL]

If we cannot read the file at offset e_lfanew, it means that the value of e_lfanew is invalid.

svn path=/branches/ntvdm/; revision=63105

diff --git a/ntoskrnl/mm/section.c b/ntoskrnl/mm/section.c
index f138dd2..f88fbba 100644 (file)
--- a/ntoskrnl/mm/section.c
+++ b/ntoskrnl/mm/section.c
@@ -284,7 +284,14 @@ l_ReadHeaderFromFile:
         nStatus = ReadFileCb(File, &lnOffset, sizeof(IMAGE_NT_HEADERS64), &pData, &pBuffer, &cbReadSize);
 
         if(!NT_SUCCESS(nStatus))
-            DIE(("ReadFile failed, status %08X\n", nStatus));
+        {
+            NTSTATUS ReturnedStatus = nStatus;
+
+            /* If it attempted to read past the end of the file, it means e_lfanew is invalid */
+            if (ReturnedStatus == STATUS_END_OF_FILE) nStatus = STATUS_INVALID_IMAGE_FORMAT;
+
+            DIE(("ReadFile failed, status %08X\n", ReturnedStatus));
+        }
 
         ASSERT(pData);
         ASSERT(pBuffer);