[NTFS]
authorPierre Schweitzer <pierre@reactos.org>
Sun, 2 Nov 2014 17:53:18 +0000 (17:53 +0000)
committerPierre Schweitzer <pierre@reactos.org>
Sun, 2 Nov 2014 17:53:18 +0000 (17:53 +0000)
Fix a really nasty bug in NTFS: it was possible to perform a buffer overflow when reading the bitmap data.

svn path=/trunk/; revision=65186

reactos/drivers/filesystems/ntfs/volinfo.c

index 7b07312..c034e0b 100644 (file)
@@ -70,7 +70,7 @@ NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt)
 
     BitmapDataSize = AttributeDataLength(&DataContext->Record);
     ASSERT((BitmapDataSize * 8) >= (DeviceExt->NtfsInfo.SectorCount / DeviceExt->NtfsInfo.SectorsPerCluster));
-    BitmapData = ExAllocatePoolWithTag(NonPagedPool, BitmapDataSize, TAG_NTFS);
+    BitmapData = ExAllocatePoolWithTag(NonPagedPool, ROUND_UP(BitmapDataSize, DeviceExt->NtfsInfo.BytesPerSector), TAG_NTFS);
     if (BitmapData == NULL)
     {
         ReleaseAttributeContext(DataContext);