diff options
| author |   Jason A. Donenfeld <Jason@zx2c4.com> | 2020-11-09 22:21:12 +0100 |
|---|---|---|
| committer | Jason A. Donenfeld <Jason@zx2c4.com> | 2020-11-09 22:23:26 +0100 |
| commit | 87ef399d1cb2c325d8b742f6b77edf1c33f82a5b (patch) | |
| tree | 61be6ed0482655a0152ccdd8d16ad1d677aecf3b | |
| parent | version: bump (diff) | |
| download | wintun-87ef399d1cb2c325d8b742f6b77edf1c33f82a5b.tar.xz wintun-87ef399d1cb2c325d8b742f6b77edf1c33f82a5b.zip | |
driver: do not allow compiler to reload PacketSize
In theory, the compiler could reload PacketSize after the bounds check
but before it's passed to NdisAllocateNetBufferAndNetBufferList. In
practice, it's not actually doing that, but better safe than sorry.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
| -rw-r--r-- | driver/wintun.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/driver/wintun.c b/driver/wintun.c index f170964..72178d4 100644 --- a/driver/wintun.c +++ b/driver/wintun.c @@ -483,7 +483,7 @@ TunProcessReceiveData(_Inout_ TUN_CTX *Ctx) break; TUN_PACKET *Packet = (TUN_PACKET *)(Ring->Data + RingHead); - ULONG PacketSize = Packet->Size; + ULONG PacketSize = *(volatile ULONG *)&Packet->Size; if (PacketSize > TUN_MAX_IP_PACKET_SIZE) break; |