Fix length checks in parallel driver

The length requested was not checked against the length read from the port.
microsoft · Oct 6, 2022 · 094cc5a · 094cc5a
1 parent 229e047
commit 094cc5a
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/channels/parallel/client/parallel_main.c b/channels/parallel/client/parallel_main.c
@@ -157,7 +157,7 @@ static UINT parallel_process_irp_read(PARALLEL_DEVICE* parallel, IRP* irp)
 		return ERROR_INVALID_DATA;
 	Stream_Read_UINT32(irp->input, Length);
 	Stream_Read_UINT64(irp->input, Offset);
-	buffer = (BYTE*)malloc(Length);
+	buffer = (BYTE*)calloc(Length, sizeof(BYTE));
 
 	if (!buffer)
 	{
@@ -176,6 +176,7 @@ static UINT parallel_process_irp_read(PARALLEL_DEVICE* parallel, IRP* irp)
 	}
 	else
 	{
+		Length = status;
 	}
 
 	Stream_Write_UINT32(irp->output, Length);