SIGN IN SIGN UP

Zero the uninitialized part of the system buffer before executing

IOCTL_PIO_EXECUTE_FN is METHOD_BUFFERED, so the I/O manager allocates
SystemBuffer at max(InputBufferLength, OutputBufferLength) but copies only
InputBufferLength bytes in from user mode. Since every successful execute
reports the full OutputBufferLength as written, anything the module does not
fill past the input length went back to the caller as uninitialized nonpaged
pool. This needed no hostile module: any legitimately signed one called with
a large output buffer leaked, and PawnIOUtil interactive prints it verbatim.

Zero the tail before the VM runs. The ABI still carries no written-length
channel, so Information stays as it was.
N
namazso committed
f728aa79207bd1e62cd540441c86c8974f3faa8a
Parent: 579bb2a