[PATCH 2/4] ntdll: If PE image size is larger than the backed file size then treat file as removable.

[Dmitry Timoshkov]

Signed-off-by: Dmitry Timoshkov 
---
 dlls/ntdll/virtual.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/dlls/ntdll/virtual.c b/dlls/ntdll/virtual.c
index 7700385eb7..e62c133f7f 100644
--- a/dlls/ntdll/virtual.c
+++ b/dlls/ntdll/virtual.c
@@ -1588,6 +1588,10 @@ static NTSTATUS map_image( HANDLE hmapping, ACCESS_MASK access, int fd, int top_
         /* unaligned sections, this happens for native subsystem binaries */
         /* in that case Windows simply maps in the whole file */

+        /* if the image size is larger than the backed file size we can't mmap it */
+        if (total_size > ROUND_SIZE( 0, st.st_size ))
+            removable = TRUE;
+
         if (map_file_into_view( view, fd, 0, total_size, 0, VPROT_COMMITTED | VPROT_READ | VPROT_WRITECOPY,
                                 removable ) != STATUS_SUCCESS) goto error;