Commit 235e3e52 authored by Sven Baars's avatar Sven Baars Committed by Alexandre Julliard

ntdll: Test against the correct limit in get_extended_params().

parent ac511013
...@@ -4353,6 +4353,10 @@ static NTSTATUS get_extended_params( const MEM_EXTENDED_PARAMETER *parameters, U ...@@ -4353,6 +4353,10 @@ static NTSTATUS get_extended_params( const MEM_EXTENDED_PARAMETER *parameters, U
case MemExtendedParameterAddressRequirements: case MemExtendedParameterAddressRequirements:
{ {
MEM_ADDRESS_REQUIREMENTS *r = parameters[i].Pointer; MEM_ADDRESS_REQUIREMENTS *r = parameters[i].Pointer;
ULONG_PTR limit;
if (is_wow64()) limit = (ULONG_PTR)get_wow_user_space_limit();
else limit = (ULONG_PTR)user_space_limit;
if (r->Alignment) if (r->Alignment)
{ {
...@@ -4366,7 +4370,7 @@ static NTSTATUS get_extended_params( const MEM_EXTENDED_PARAMETER *parameters, U ...@@ -4366,7 +4370,7 @@ static NTSTATUS get_extended_params( const MEM_EXTENDED_PARAMETER *parameters, U
if (r->LowestStartingAddress) if (r->LowestStartingAddress)
{ {
*limit_low = (ULONG_PTR)r->LowestStartingAddress; *limit_low = (ULONG_PTR)r->LowestStartingAddress;
if (*limit_low >= (ULONG_PTR)user_space_limit || (*limit_low & granularity_mask)) if (*limit_low >= limit || (*limit_low & granularity_mask))
{ {
WARN( "Invalid limit %p.\n", r->LowestStartingAddress ); WARN( "Invalid limit %p.\n", r->LowestStartingAddress );
return STATUS_INVALID_PARAMETER; return STATUS_INVALID_PARAMETER;
...@@ -4375,7 +4379,7 @@ static NTSTATUS get_extended_params( const MEM_EXTENDED_PARAMETER *parameters, U ...@@ -4375,7 +4379,7 @@ static NTSTATUS get_extended_params( const MEM_EXTENDED_PARAMETER *parameters, U
if (r->HighestEndingAddress) if (r->HighestEndingAddress)
{ {
*limit_high = (ULONG_PTR)r->HighestEndingAddress; *limit_high = (ULONG_PTR)r->HighestEndingAddress;
if (*limit_high > (ULONG_PTR)user_space_limit || if (*limit_high > limit ||
*limit_high <= *limit_low || *limit_high <= *limit_low ||
((*limit_high + 1) & (page_mask - 1))) ((*limit_high + 1) & (page_mask - 1)))
{ {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment