Skip to content

Commit 68ebcf1

Browse files
committed
[NTOS:KD] Protect against invalid user arguments for BREAKPOINT_LOAD_SYMBOLS. CORE-14057
1 parent 34ccecb commit 68ebcf1

File tree

1 file changed

+30
-3
lines changed

1 file changed

+30
-3
lines changed

ntoskrnl/kd/kdmain.c

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -153,11 +153,38 @@ KdpEnterDebuggerException(IN PKTRAP_FRAME TrapFrame,
153153
#ifdef KDBG
154154
else if (ExceptionCommand == BREAKPOINT_LOAD_SYMBOLS)
155155
{
156+
PKD_SYMBOLS_INFO SymbolsInfo;
157+
KD_SYMBOLS_INFO CapturedSymbolsInfo;
156158
PLDR_DATA_TABLE_ENTRY LdrEntry;
157159

158-
/* Load symbols. Currently implemented only for KDBG! */
159-
if(KdbpSymFindModule(((PKD_SYMBOLS_INFO)ExceptionRecord->ExceptionInformation[2])->BaseOfDll, NULL, -1, &LdrEntry))
160-
KdbSymProcessSymbols(LdrEntry);
160+
SymbolsInfo = (PKD_SYMBOLS_INFO)ExceptionRecord->ExceptionInformation[2];
161+
if (PreviousMode != KernelMode)
162+
{
163+
_SEH2_TRY
164+
{
165+
ProbeForRead(SymbolsInfo,
166+
sizeof(*SymbolsInfo),
167+
1);
168+
RtlCopyMemory(&CapturedSymbolsInfo,
169+
SymbolsInfo,
170+
sizeof(*SymbolsInfo));
171+
SymbolsInfo = &CapturedSymbolsInfo;
172+
}
173+
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
174+
{
175+
SymbolsInfo = NULL;
176+
}
177+
_SEH2_END;
178+
}
179+
180+
if (SymbolsInfo != NULL)
181+
{
182+
/* Load symbols. Currently implemented only for KDBG! */
183+
if (KdbpSymFindModule(SymbolsInfo->BaseOfDll, NULL, -1, &LdrEntry))
184+
{
185+
KdbSymProcessSymbols(LdrEntry);
186+
}
187+
}
161188
}
162189
else if (ExceptionCommand == BREAKPOINT_PROMPT)
163190
{

0 commit comments

Comments
 (0)