Skip to content

W
wine-winehq
Commit 6e66c12c authored by Sebastian Lackner's avatar Sebastian Lackner Committed by Alexandre Julliard
Browse files
Options

ntdll: Validate SecurityCookie pointer before accessing cookie value.

parent 4bcdbe09
Hide whitespace changes
Inline Side-by-side
Showing with 4 additions and 2 deletions
dlls/ntdll/virtual.c
View file @ 6e66c12c
......@@ -1320,9 +1320,11 @@ static NTSTATUS map_image( HANDLE hmapping, int fd, char *base, SIZE_T total_siz
loadcfg = RtlImageDirectoryEntryToData( (HMODULE)ptr, TRUE,
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG, &loadcfg_size );
if (loadcfg &&
loadcfg_size >= offsetof(IMAGE_LOAD_CONFIG_DIRECTORY, SecurityCookie) + sizeof(loadcfg->SecurityCookie))
if (loadcfg && loadcfg_size >= offsetof(IMAGE_LOAD_CONFIG_DIRECTORY, SecurityCookie) + sizeof(loadcfg->SecurityCookie) &&
(ULONG_PTR)ptr <= loadcfg->SecurityCookie && loadcfg->SecurityCookie <= (ULONG_PTR)ptr + total_size - sizeof(ULONG_PTR))
{
set_security_cookie((ULONG_PTR *)loadcfg->SecurityCookie);
}
/* set the image protections */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment