From e49ef251b7a14d5a0261d0b5c3890c8abe03569d Mon Sep 17 00:00:00 2001 From: Timo Kreuzer Date: Mon, 29 Jan 2018 12:37:26 +0100 Subject: [PATCH] [NTOS:MM] Fix ViewSize parameter passed to MiInsertVadEx() from MiCreatePebOrTeb() The size is in bytes, not in pages! On x86 we got away with it, since PEB and TEB require only a single page and the 1 passed to MiInsertVadEx() was aligned up to PAGE_SIZE. On x64 this doesn't work, since the size is 2 pages. --- ntoskrnl/mm/ARM3/procsup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ntoskrnl/mm/ARM3/procsup.c b/ntoskrnl/mm/ARM3/procsup.c index 95e760a2ecf..009168eba95 100644 --- a/ntoskrnl/mm/ARM3/procsup.c +++ b/ntoskrnl/mm/ARM3/procsup.c @@ -88,7 +88,7 @@ MiCreatePebOrTeb(IN PEPROCESS Process, *BaseAddress = 0; Status = MiInsertVadEx((PMMVAD)Vad, BaseAddress, - BYTES_TO_PAGES(Size), + Size, HighestAddress, PAGE_SIZE, MEM_TOP_DOWN); -- 2.17.1