Zero the uninitialized part of the system buffer before executing
IOCTL_PIO_EXECUTE_FN is METHOD_BUFFERED, so the I/O manager allocates SystemBuffer at max(InputBufferLength, OutputBufferLength) but copies only InputBufferLength bytes in from user mode. Since every successful execute reports the full OutputBufferLength as written, anything the module does not fill past the input length went back to the caller as uninitialized nonpaged pool. This needed no hostile module: any legitimately signed one called with a large output buffer leaked, and PawnIOUtil interactive prints it verbatim. Zero the tail before the VM runs. The ABI still carries no written-length channel, so Information stays as it was.
N
namazso committed
f728aa79207bd1e62cd540441c86c8974f3faa8a
Parent: 579bb2a