[PATCH v3 1/3] wow64: Truncate too-large regions from NtQueryVirtualMemory(MemoryBasicInformation).

[Tim Clem]

From: Tim Clem

BaseAddress + RegionSize should not exceed the highest WoW user
address.
---
 dlls/wow64/virtual.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/dlls/wow64/virtual.c b/dlls/wow64/virtual.c
index 4d3bb90386a..df189a64fea 100644
--- a/dlls/wow64/virtual.c
+++ b/dlls/wow64/virtual.c
@@ -399,6 +399,13 @@ NTSTATUS WINAPI wow64_NtQueryVirtualMemory( UINT *args )
                 info32->State = info.State;
                 info32->Protect = info.Protect;
                 info32->Type = info.Type;
+
+                if ((ULONG_PTR)info.BaseAddress + info.RegionSize > highest_user_address)
+                {
+                    info32->RegionSize = highest_user_address - (ULONG_PTR)info.BaseAddress;
+                    TRACE( "region %p-%p ends past the WoW address limit %p; reporting its size as 0x%lx\n",
+                           info.BaseAddress, (char *)info.BaseAddress + info.RegionSize, (void *)highest_user_address, (unsigned long)info32->RegionSize );
+                }
             }
         }
         res_len = sizeof(MEMORY_BASIC_INFORMATION32);