From b3331c5ec2eea2c4396bf528c95df366dcbb7c3d Mon Sep 17 00:00:00 2001
From: Joseph Henry <josephjah@gmail.com>
Date: Wed, 23 Sep 2020 15:31:20 -0700
Subject: [PATCH] Fix buffer overflow in windows tap driver

---
 windows/TapDriver6/adapter.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/windows/TapDriver6/adapter.c b/windows/TapDriver6/adapter.c
index 7ce4b310c..c170e2215 100644
--- a/windows/TapDriver6/adapter.c
+++ b/windows/TapDriver6/adapter.c
@@ -272,7 +272,8 @@ tapReadConfiguration(
 
         if (status == NDIS_STATUS_SUCCESS)
         {
-            if (configParameter->ParameterType == NdisParameterString)
+            if (configParameter->ParameterType == NdisParameterString
+                && configParameter->ParameterData.StringData.Length <= sizeof(Adapter->NetCfgInstanceIdBuffer) - sizeof(WCHAR))
             {
                 DEBUGP (("[TAP] NdisReadConfiguration (NetCfgInstanceId=%wZ)\n",
                     &configParameter->ParameterData.StringData ));