Fix Burn pipe bug where 64-bit code was not interoperable with 32-bit.
Sean Hall committed
Mar 30, 2022 at 17:06 UTC
fec789e9645a0f1dc1d91143bf7592cba8c4f0a2
2 files changed
+20
-11
src/burn/engine/pipe.cpp
+19
-10
@@ -14,7 +14,7 @@ static HRESULT AllocatePipeMessage(
14
__in_bcount_opt(cbData) LPVOID pvData,
15
__in SIZE_T cbData,
16
__out_bcount(cb) LPVOID* ppvMessage,
17
- __out SIZE_T* cbMessage
17
+ __out SIZE_T* pcbMessage
18
);
19
static void FreePipeMessage(
20
__in BURN_PIPE_MESSAGE *pMsg
@@ -553,32 +553,41 @@ static HRESULT AllocatePipeMessage(
553
__in_bcount_opt(cbData) LPVOID pvData,
554
__in SIZE_T cbData,
555
__out_bcount(cb) LPVOID* ppvMessage,
556
- __out SIZE_T* cbMessage
556
+ __out SIZE_T* pcbMessage
557
)
558
{
559
HRESULT hr = S_OK;
560
LPVOID pv = NULL;
561
- SIZE_T cb = 0;
561
+ size_t cb = 0;
562
+ DWORD dwcbData = 0;
563
564
// If no data was provided, ensure the count of bytes is zero.
565
if (!pvData)
566
{
567
cbData = 0;
568
}
569
+ else if (MAXDWORD < cbData)
570
+ {
571
+ ExitWithRootFailure(hr, E_INVALIDDATA, "Pipe message is too large.");
572
+ }
573
+
574
+ hr = ::SizeTAdd(sizeof(dwMessage) + sizeof(dwcbData), cbData, &cb);
575
+ ExitOnRootFailure(hr, "Failed to calculate total pipe message size");
576
+
577
+ dwcbData = (DWORD)cbData;
578
579
// Allocate the message.
570
- cb = sizeof(dwMessage) + sizeof(cbData) + cbData;
580
pv = MemAlloc(cb, FALSE);
581
ExitOnNull(pv, hr, E_OUTOFMEMORY, "Failed to allocate memory for message.");
582
583
memcpy_s(pv, cb, &dwMessage, sizeof(dwMessage));
575
- memcpy_s(static_cast<BYTE*>(pv) + sizeof(dwMessage), cb - sizeof(dwMessage), &cbData, sizeof(cbData));
576
- if (cbData)
584
+ memcpy_s(static_cast<BYTE*>(pv) + sizeof(dwMessage), cb - sizeof(dwMessage), &dwcbData, sizeof(dwcbData));
585
+ if (dwcbData)
586
{
578
- memcpy_s(static_cast<BYTE*>(pv) + sizeof(dwMessage) + sizeof(cbData), cb - sizeof(dwMessage) - sizeof(cbData), pvData, cbData);
587
+ memcpy_s(static_cast<BYTE*>(pv) + sizeof(dwMessage) + sizeof(dwcbData), cb - sizeof(dwMessage) - sizeof(dwcbData), pvData, dwcbData);
588
}
589
581
- *cbMessage = cb;
590
+ *pcbMessage = cb;
591
*ppvMessage = pv;
592
pv = NULL;
593
@@ -627,7 +636,7 @@ static HRESULT GetPipeMessage(
636
)
637
{
638
HRESULT hr = S_OK;
630
- BYTE pbMessageAndByteCount[sizeof(DWORD) + sizeof(SIZE_T)] = { };
639
+ BYTE pbMessageAndByteCount[sizeof(DWORD) + sizeof(DWORD)] = { };
640
641
hr = FileReadHandle(hPipe, pbMessageAndByteCount, sizeof(pbMessageAndByteCount));
642
if (HRESULT_FROM_WIN32(ERROR_BROKEN_PIPE) == hr)
@@ -638,7 +647,7 @@ static HRESULT GetPipeMessage(
647
ExitOnFailure(hr, "Failed to read message from pipe.");
648
649
pMsg->dwMessage = *(DWORD*)(pbMessageAndByteCount);
641
- pMsg->cbData = *(SIZE_T*)(pbMessageAndByteCount + sizeof(DWORD));
650
+ pMsg->cbData = *(DWORD*)(pbMessageAndByteCount + sizeof(DWORD));
651
if (pMsg->cbData)
652
{
653
pMsg->pvData = MemAlloc(pMsg->cbData, FALSE);
src/burn/engine/pipe.h
+1
-1
@@ -27,7 +27,7 @@ typedef enum _BURN_PIPE_MESSAGE_TYPE : DWORD
27
typedef struct _BURN_PIPE_MESSAGE
28
{
29
DWORD dwMessage;
30
- SIZE_T cbData;
30
+ DWORD cbData;
31
32
BOOL fAllocatedData;
33
LPVOID pvData;