fix(wddm): reject undersized QueryAdapterInfo buffers - #18
Open
Neonstudio28 wants to merge 2 commits into
Open
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The critical versioned-structure validation gap and moderate test-buffer coverage issue remain unresolved.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This pull request adds WDDM QueryAdapterInfo output-buffer validation and portable sanitizer regression tests.
Changes:
- Adds size checks for
DRIVERCAPSand segment-query outputs. - Tests boundary sizes and canary preservation.
File summaries
| File | Summary |
|---|---|
tests/query-adapter-output-size.test.c |
Adds regression coverage; the test allocation does not fully cover DXGK_DRIVERCAPS. |
driver/wddm/query_adapter_info.c |
Adds buffer checks, but v3/v4 queries use larger versioned structures than the legacy size checked. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| case DXGKQAITYPE_QUERYSEGMENT: | ||
| case DXGKQAITYPE_QUERYSEGMENT3: | ||
| case DXGKQAITYPE_QUERYSEGMENT4: | ||
| if (pQueryAdapterInfo->OutputDataSize < sizeof(DXGK_QUERYSEGMENTOUT)) { |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the output-buffer validation gap described in #15.
GpusionQueryAdapterInfopreviously passed caller-controlled buffers directly to theDRIVERCAPSandQUERYSEGMENThelpers. Those helpers write complete WDDM structures, so truncated buffers could be overwritten. This change returnsSTATUS_BUFFER_TOO_SMALLbefore dispatching whenOutputDataSizeis smaller than the structure being written. The check coversQUERYSEGMENT,QUERYSEGMENT3, andQUERYSEGMENT4.Validation
Added
tests/query-adapter-output-size.test.c, a portable regression harness. Under AddressSanitizer and UndefinedBehaviorSanitizer it checks sizes 0, 1, size-1, exact size, and size+8 for all four affected query types. The harness passed and verified that undersized buffers remain unchanged and canaries remain intact.Command:
Terms and attribution
This PR is submitted against the report in #15, with the reporter credited for the finding. I noticed the current
CONTRIBUTING.mdsays the project no longer runs a paid bounty program and only honours reports submitted while the earlier cash terms were listed. Please confirm whether this post-terms fix can receive any funded sponsorship or other payable award. If so, I can provide UPI or bank-transfer details privately; no payment information is included here.AI assistance was used for the implementation and test drafting; the reproduction and test were run locally as described above.