diff options
| author |   Simon Rozman <simon@rozman.si> | 2019-06-10 13:38:33 +0200 |
|---|---|---|
| committer | Simon Rozman <simon@rozman.si> | 2019-06-10 16:59:03 +0200 |
| commit | 2e744ebde5590183b69219d14321030b532c3825 (patch) | |
| tree | 51ba33b5d2f1e576d79f5b4d616a3d4135fbcee1 | |
| parent | Version bump (diff) | |
| download | wintun-2e744ebde5590183b69219d14321030b532c3825.tar.xz wintun-2e744ebde5590183b69219d14321030b532c3825.zip | |
Revise buffer size calculation to work across 32/64-bit boundary
Signed-off-by: Simon Rozman <simon@rozman.si>
| -rw-r--r-- | wintun.c | 6 |
1 files changed, 3 insertions, 3 deletions
@@ -678,7 +678,7 @@ static NTSTATUS TunWriteFromIrp(_Inout_ TUN_CTX *ctx, _Inout_ IRP *Irp) { NULL, NULL, 0 }, { NULL, NULL, 0 } }; - while (b + sizeof(TUN_PACKET) <= b_end) { + while (b_end - b >= sizeof(TUN_PACKET)) { if (nbl_queue[ethtypeidx_ipv4].count + nbl_queue[ethtypeidx_ipv6].count >= MAXLONG) { status = STATUS_INVALID_USER_BUFFER; goto cleanup_nbl_queues; @@ -689,8 +689,8 @@ static NTSTATUS TunWriteFromIrp(_Inout_ TUN_CTX *ctx, _Inout_ IRP *Irp) status = STATUS_INVALID_USER_BUFFER; goto cleanup_nbl_queues; } - UINT p_size = TunPacketAlign(sizeof(TUN_PACKET) + p->Size); - if (b + p_size > b_end) { + ptrdiff_t p_size = TunPacketAlign(sizeof(TUN_PACKET) + p->Size); + if (b_end - b < p_size) { status = STATUS_INVALID_USER_BUFFER; goto cleanup_nbl_queues; } |