diff options
author | Willian Henrique <wsimanbrazil@yahoo.com.br> | 2022-02-12 23:25:04 -0300 |
---|---|---|
committer | Michael Smith <mikesmiffy128@gmail.com> | 2022-03-19 04:57:00 +0000 |
commit | e2b8151f6eca6c91b45e0d715b1533cde274eaa5 (patch) | |
tree | 2f337bcf9e2f8f2392c5869f05f4a8bc551dc11f /src | |
parent | dc317d53ccf74257c12c1d73c4265ec2a9b25d24 (diff) |
Fix hook_inline() breaking after a single call
Committer note: I, mike, am a big dumb idiot. Thanks, Bill.
Diffstat (limited to 'src')
-rw-r--r-- | src/hook.c | 6 |
1 files changed, 4 insertions, 2 deletions
@@ -1,5 +1,6 @@ /* * Copyright © 2021 Michael Smith <mikesmiffy128@gmail.com> + * Copyright © 2022 Willian Henrique <wsimanbrazil@yahoo.com.br> * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -58,10 +59,11 @@ void *hook_inline(void *func_, void *target) { len += ud_insn_len(&udis); } // for simplicity, just bump alloc the trampoline. no need to free anyway - if (nexttrampoline - trampolines > len + 6) goto nospc; + if (nexttrampoline - trampolines > sizeof(trampolines) - len - 6) goto nospc; uchar *trampoline = (uchar *)InterlockedExchangeAdd( (volatile long *)&nexttrampoline, len + 6); - if (trampoline - trampolines > len + 6) { // avoid TOCTOU + // avoid TOCTOU + if (trampoline - trampolines > sizeof(trampolines) - len - 6) { nospc: con_warn("hook_inline: out of trampoline space\n"); return 0; } |