From 895156b3c5545607b3f020bdc2168dc7c160d7f7 Mon Sep 17 00:00:00 2001
From: midipix <writeonce@midipix.org>
Date: Sun, 29 Jan 2017 01:07:34 +0000
Subject: __ntapi_tt_open_physical_parent_directory(): properly handle
 \Device\Mup.

---
 src/fs/ntapi_tt_open_physical_parent_directory.c | 33 ++++++++++++++++++++----
 1 file changed, 28 insertions(+), 5 deletions(-)

(limited to 'src/fs')

diff --git a/src/fs/ntapi_tt_open_physical_parent_directory.c b/src/fs/ntapi_tt_open_physical_parent_directory.c
index 1efbee9..77b8605 100644
--- a/src/fs/ntapi_tt_open_physical_parent_directory.c
+++ b/src/fs/ntapi_tt_open_physical_parent_directory.c
@@ -26,6 +26,7 @@ int32_t __stdcall __ntapi_tt_open_physical_parent_directory(
 	wchar16_t *			root;
 	nt_unicode_string *		path;
 	uint32_t			len;
+	int				mup;
 
 	(void)reserved;
 
@@ -48,24 +49,46 @@ int32_t __stdcall __ntapi_tt_open_physical_parent_directory(
 	wch  = path->buffer + (path->strlen / sizeof(uint16_t));
 
 
-	if ((root[0] != '\\')
+	if ((wch < &root[8])
+			|| (root[0] != '\\')
 			|| (root[1] != 'D') || (root[2] != 'e')
 			|| (root[3] != 'v') || (root[4] != 'i')
 			|| (root[5] != 'c') || (root[6] != 'e')
 			|| (root[7] != '\\'))
 		return NT_STATUS_INTERNAL_ERROR;
 
-	for (root=&root[8]; (root<wch) && (*root!='\\'); )
+	mup = (wch > &root[11])
+		&& (root[8]=='M')
+		&& (root[9]=='u')
+		&& (root[10]=='p')
+		&& (root[11]=='\\');
+
+	root = mup ? &root[12] : &root[8];
+
+	for (; (root<wch) && (*root!='\\'); )
 		root++;
 
-	if ((uint16_t)((++root - path->buffer) * sizeof(uint16_t)) == path->strlen)
+	if (root == wch)
+		return NT_STATUS_INTERNAL_ERROR;
+
+	if (mup)
+		for (root++; (root<wch) && (*root!='\\'); )
+			root++;
+
+	if (root == wch)
+		return NT_STATUS_INTERNAL_ERROR;
+
+	if (&root[1] == wch)
 		return NT_STATUS_MORE_PROCESSING_REQUIRED;
 
+	if (wch[-1] == '\\')
+		wch--;
+
 	/* physical parent directory path */
-	for (; (wch>root) && (wch[-1]!='\\'); )
+	for (root++; (wch>=root) && (wch[-1]!='\\'); )
 		wch--;
 
-	path->strlen = sizeof(uint16_t) * (uint16_t)(wch-path->buffer);
+	path->strlen = (uint16_t)(wch - path->buffer) * sizeof(uint16_t);
 	path->maxlen = 0;
 
 	/* oa */
-- 
cgit v1.2.3