Fix/sound helper buffer pointer bug

src/AutoOS.Core/Helpers/Device/DeviceHelper.cs

@@ -537,19 +537,18 @@ public static async Task<RestartResult> RestartDevicesAsync(List<DeviceInfo> dev
 				while (true)
 				{
 					CONFIGRET result = PInvoke.CM_Get_Next_Res_Des(out nuint nextResDes, currentHandle, 0, out CM_RESTYPE outResType, 0);
-					resType = (uint)outResType;
+					if (result != CONFIGRET.CR_SUCCESS)
+						break;
 
 					if (!isFirst && resDes != 0)
 						PInvoke.CM_Free_Res_Des_Handle(resDes);
 
-					if (result != CONFIGRET.CR_SUCCESS)
-						break;
-
+					resType = (uint)outResType;
 					resDes = nextResDes;
 					isFirst = false;
 					currentHandle = resDes;
 
-					if (resType == 1 || resType == 7)
+					if (resType == (uint)CM_RESTYPE.ResType_Mem || resType == (uint)CM_RESTYPE.ResType_MemLarge)
 					{
 						uint dataSize;
 						if (PInvoke.CM_Get_Res_Des_Data_Size(&dataSize, resDes, 0) == CONFIGRET.CR_SUCCESS && dataSize >= 24)

src/AutoOS.Core/Helpers/ReadWrite/ReadWriteHelper.cs

@@ -1,5 +1,5 @@
+using System.Runtime.InteropServices;
 using Windows.Win32;
-using Windows.Win32.System.Memory;
 
 namespace AutoOS.Core.Helpers.ReadWrite;
 
@@ -141,18 +141,12 @@ public unsafe bool ReadMemory(ulong address, uint length, byte[] output)
 		if (pLinAddr == IntPtr.Zero)
 			return false;
 
-		if (!IsReadableMemory(pLinAddr, (int)(extra + length)))
-		{
-			_ = InpOut.UnmapPhysicalMemory(hMapping, pLinAddr);
-			return false;
-		}
-
 		try
 		{
-			fixed (byte* pOutput = output)
-			{
-				Buffer.MemoryCopy((void*)(pLinAddr + (nint)extra), pOutput, length, length);
-			}
+			if (PInvoke.IsBadReadPtr((void*)(pLinAddr + (nint)extra), (nuint)length))
+				return false;
+
+			Marshal.Copy(pLinAddr + (nint)extra, output, 0, (int)length);
 			return true;
 		}
 		catch
@@ -165,49 +159,21 @@ public unsafe bool ReadMemory(ulong address, uint length, byte[] output)
 		}
 	}
 
-	private static unsafe bool IsReadableMemory(IntPtr address, int length)
-	{
-		ulong addr = (ulong)address.ToInt64();
-		long remaining = length;
-
-		while (remaining > 0)
-		{
-			MEMORY_BASIC_INFORMATION mbi;
-			if (PInvoke.VirtualQuery((void*)addr, &mbi, (nuint)sizeof(MEMORY_BASIC_INFORMATION)) == 0)
-				return false;
-
-			if (mbi.State != VIRTUAL_ALLOCATION_TYPE.MEM_COMMIT)
-				return false;
-
-			if ((mbi.Protect & (PAGE_PROTECTION_FLAGS.PAGE_GUARD | PAGE_PROTECTION_FLAGS.PAGE_NOACCESS)) != 0)
-				return false;
-
-			if ((mbi.Protect & (PAGE_PROTECTION_FLAGS.PAGE_READONLY | PAGE_PROTECTION_FLAGS.PAGE_READWRITE | PAGE_PROTECTION_FLAGS.PAGE_WRITECOPY | PAGE_PROTECTION_FLAGS.PAGE_EXECUTE_READ | PAGE_PROTECTION_FLAGS.PAGE_EXECUTE_READWRITE | PAGE_PROTECTION_FLAGS.PAGE_EXECUTE_WRITECOPY)) == 0)
-				return false;
-
-			ulong regionSize = (ulong)mbi.RegionSize;
-			if (regionSize == 0)
-				return false;
-
-			ulong regionEnd = (ulong)mbi.BaseAddress + regionSize;
-			remaining -= (long)Math.Min((ulong)remaining, regionEnd - addr);
-			addr = regionEnd;
-		}
-
-		return true;
-	}
-
 	public unsafe bool WriteMemory(ulong address, byte[] buffer)
 	{
-		IntPtr pLinAddr = InpOut.MapPhysToLin((IntPtr)address, (uint)buffer.Length, out nint hMapping);
+		ulong baseAddress = address & ~0xFFFUL;
+		uint extra = (uint)(address - baseAddress);
+		uint mapLength = extra + (uint)buffer.Length + 0x1000;
+
+		IntPtr pLinAddr = InpOut.MapPhysToLin((IntPtr)baseAddress, mapLength, out nint hMapping);
 		if (pLinAddr == IntPtr.Zero) return false;
 
 		try
 		{
-			fixed (byte* pBuffer = buffer)
-			{
-				Buffer.MemoryCopy(pBuffer, (void*)pLinAddr, buffer.Length, buffer.Length);
-			}
+			if (PInvoke.IsBadWritePtr((void*)(pLinAddr + (nint)extra), (nuint)buffer.Length))
+				return false;
+
+			Marshal.Copy(buffer, 0, pLinAddr + (nint)extra, buffer.Length);
 			return true;
 		}
 		catch

src/AutoOS.Core/Helpers/Sound/SoundHelper.cs

@@ -549,40 +549,45 @@ public static unsafe void SetAudioFormat(DeviceInfo device, AudioFormatOption fo
 					*(WAVEFORMATEXTENSIBLE*)pEndpointFormat = endpointFormat;
 					*(WAVEFORMATEXTENSIBLE*)pMixFormat = mixFormat;
 
-					Guid clsidPolicy = new("870af99c-171d-4f9e-af0d-e63df40c2bc9");
-					Guid iidPolicy = new("f8679f50-850a-41cf-9c72-430f290290c8");
-
-					void* pPolicyOut;
-					if (PInvoke.CoCreateInstance(&clsidPolicy, null, CLSCTX.CLSCTX_ALL, &iidPolicy, &pPolicyOut).Value >= 0)
+					try
 					{
-						var policy = (IPolicyConfigNativeOut*)pPolicyOut;
-						fixed (char* pwzDeviceId = device.RegistryPath)
+						Guid clsidPolicy = new("870af99c-171d-4f9e-af0d-e63df40c2bc9");
+						Guid iidPolicy = new("f8679f50-850a-41cf-9c72-430f290290c8");
+
+						void* pPolicyOut;
+						if (PInvoke.CoCreateInstance(&clsidPolicy, null, CLSCTX.CLSCTX_ALL, &iidPolicy, &pPolicyOut).Value >= 0)
 						{
-							policy->Vtbl->SetDeviceFormat(pPolicyOut, pwzDeviceId, pEndpointFormat, pMixFormat);
+							var policy = (IPolicyConfigNativeOut*)pPolicyOut;
+							fixed (char* pwzDeviceId = device.RegistryPath)
+							{
+								policy->Vtbl->SetDeviceFormat(pPolicyOut, pwzDeviceId, pEndpointFormat, pMixFormat);
+							}
+							policy->Vtbl->Release(policy);
 						}
-						policy->Vtbl->Release(pPolicyOut);
-					}
 
-					PROPVARIANT propDev = default;
-					propDev.Anonymous.Anonymous.vt = VARENUM.VT_BLOB;
-					propDev.Anonymous.Anonymous.Anonymous.blob.cbSize = (uint)sizeof(WAVEFORMATEXTENSIBLE);
-					propDev.Anonymous.Anonymous.Anonymous.blob.pBlobData = (byte*)&endpointFormat;
+						PROPVARIANT propDev = default;
+						propDev.Anonymous.Anonymous.vt = VARENUM.VT_BLOB;
+						propDev.Anonymous.Anonymous.Anonymous.blob.cbSize = (uint)sizeof(WAVEFORMATEXTENSIBLE);
+						propDev.Anonymous.Anonymous.Anonymous.blob.pBlobData = (byte*)pEndpointFormat;
 
-					PROPVARIANT propMix = default;
-					propMix.Anonymous.Anonymous.vt = VARENUM.VT_BLOB;
-					propMix.Anonymous.Anonymous.Anonymous.blob.cbSize = (uint)sizeof(WAVEFORMATEXTENSIBLE);
-					propMix.Anonymous.Anonymous.Anonymous.blob.pBlobData = (byte*)&mixFormat;
+						PROPVARIANT propMix = default;
+						propMix.Anonymous.Anonymous.vt = VARENUM.VT_BLOB;
+						propMix.Anonymous.Anonymous.Anonymous.blob.cbSize = (uint)sizeof(WAVEFORMATEXTENSIBLE);
+						propMix.Anonymous.Anonymous.Anonymous.blob.pBlobData = (byte*)pMixFormat;
 
-					PROPERTYKEY keyDeviceFormat = new() { fmtid = new Guid("F19F064D-082C-4E27-BC73-6882A1BB8E4C"), pid = 0 };
-					PROPERTYKEY keyOemFormat = new() { fmtid = new Guid("E4870E26-3CC5-4CD2-BA46-CA0A9A70ED04"), pid = 0 };
+						PROPERTYKEY keyDeviceFormat = new() { fmtid = new Guid("F19F064D-082C-4E27-BC73-6882A1BB8E4C"), pid = 0 };
+						PROPERTYKEY keyOemFormat = new() { fmtid = new Guid("E4870E26-3CC5-4CD2-BA46-CA0A9A70ED04"), pid = 0 };
 
-					store->SetValue(in keyDeviceFormat, in propDev);
-					store->SetValue(in keyOemFormat, in propMix);
-					store->Commit();
-
-					Marshal.FreeCoTaskMem((IntPtr)pEndpointFormat);
-					Marshal.FreeCoTaskMem((IntPtr)pMixFormat);
-					store->Release();
+						store->SetValue(in keyDeviceFormat, in propDev);
+						store->SetValue(in keyOemFormat, in propMix);
+						store->Commit();
+					}
+					finally
+					{
+						Marshal.FreeCoTaskMem((IntPtr)pEndpointFormat);
+						Marshal.FreeCoTaskMem((IntPtr)pMixFormat);
+						store->Release();
+					}
 				}
 				endpoint->Release();
 			}

src/AutoOS.Core/NativeMethods.txt

@@ -48,6 +48,8 @@ GetSystemFirmwareTable
 GetTokenInformation
 GlobalMemoryStatusEx
 HANDLE
+IsBadReadPtr
+IsBadWritePtr
 HRESULT
 IAudioClient
 IAudioClient3
@@ -124,7 +126,9 @@ SERVICE_START_TYPE
 SERVICE_STATUS
 SERVICE_STOP
 SETUP_DI_PROPERTY_CHANGE_SCOPE
+SETUP_DI_REGISTRY_PROPERTY
 SETUP_DI_STATE_CHANGE
+SP_DEVINFO_DATA
 SetFirmwareEnvironmentVariableEx
 SHCreateItemFromParsingName
 SP_CLASSINSTALL_HEADER