From e2b8151f6eca6c91b45e0d715b1533cde274eaa5 Mon Sep 17 00:00:00 2001 From: Willian Henrique Date: Sat, 12 Feb 2022 23:25:04 -0300 Subject: Fix hook_inline() breaking after a single call Committer note: I, mike, am a big dumb idiot. Thanks, Bill. --- src/hook.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/hook.c') diff --git a/src/hook.c b/src/hook.c index f625966..09dc403 100644 --- a/src/hook.c +++ b/src/hook.c @@ -1,5 +1,6 @@ /* * Copyright © 2021 Michael Smith + * Copyright © 2022 Willian Henrique * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -58,10 +59,11 @@ void *hook_inline(void *func_, void *target) { len += ud_insn_len(&udis); } // for simplicity, just bump alloc the trampoline. no need to free anyway - if (nexttrampoline - trampolines > len + 6) goto nospc; + if (nexttrampoline - trampolines > sizeof(trampolines) - len - 6) goto nospc; uchar *trampoline = (uchar *)InterlockedExchangeAdd( (volatile long *)&nexttrampoline, len + 6); - if (trampoline - trampolines > len + 6) { // avoid TOCTOU + // avoid TOCTOU + if (trampoline - trampolines > sizeof(trampolines) - len - 6) { nospc: con_warn("hook_inline: out of trampoline space\n"); return 0; } -- cgit v1.2.3