- Check buffer sizes and color counts for IOCTL_VIDEO_SET_COLOR_REGISTERS request.

svn path=/trunk/; revision=9464

diff --git a/reactos/drivers/video/miniport/vbe/vbemp.c b/reactos/drivers/video/miniport/vbe/vbemp.c
index 44ab119..627e522 100644 (file)
--- a/reactos/drivers/video/miniport/vbe/vbemp.c
+++ b/reactos/drivers/video/miniport/vbe/vbemp.c
@@ -473,9 +473,14 @@ VBEStartIO(
          break;
 
       case IOCTL_VIDEO_SET_COLOR_REGISTERS:
-         /*
-          * FIXME: Check buffer size!
-          */
+         if (RequestPacket->InputBufferLength < sizeof(VIDEO_CLUT) ||
+             RequestPacket->InputBufferLength <
+             (((PVIDEO_CLUT)RequestPacket->InputBuffer)->NumEntries * sizeof(ULONG)) +
+             sizeof(VIDEO_CLUT))
+         {
+            RequestPacket->StatusBlock->Status = ERROR_INSUFFICIENT_BUFFER;
+            return TRUE;
+         }
          Result = VBESetColorRegisters(
             (PVBE_DEVICE_EXTENSION)HwDeviceExtension,
             (PVIDEO_CLUT)RequestPacket->InputBuffer,
@@ -797,6 +802,9 @@ VBESetColorRegisters(
    ULONG Entry;
    PULONG OutputEntry;
 
+   if (ColorLookUpTable->NumEntries + ColorLookUpTable->FirstEntry > 256)
+      return FALSE;
+
    if (DeviceExtension->VGACompatible)
    {
       for (Entry = ColorLookUpTable->FirstEntry;