From e660e61027593e30ce3fd5ab7ce8e55de8532f41 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= Date: Wed, 24 Apr 2024 11:04:03 +0800 Subject: [PATCH] Swap (Windows): fix x86-32 (v2) --- src/detection/swap/swap_windows.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) diff --git a/src/detection/swap/swap_windows.c b/src/detection/swap/swap_windows.c index 52d713c2b..5b3a15457 100644 --- a/src/detection/swap/swap_windows.c +++ b/src/detection/swap/swap_windows.c @@ -7,21 +7,11 @@ const char* ffDetectSwap(FFSwapResult* swap) { - ULONG size = sizeof(SYSTEM_PAGEFILE_INFORMATION) * 2; - SYSTEM_PAGEFILE_INFORMATION* FF_AUTO_FREE pstart = (SYSTEM_PAGEFILE_INFORMATION*)malloc(size); - while(true) - { - NTSTATUS status = NtQuerySystemInformation(SystemPagefileInformation, pstart, size, &size); - if(status == STATUS_INFO_LENGTH_MISMATCH) - { - if(!(pstart = (SYSTEM_PAGEFILE_INFORMATION*)realloc(pstart, size))) - return "realloc(pstart, size) failed"; - continue; - } - else if(!NT_SUCCESS(status)) - return "NtQuerySystemInformation(SystemPagefileInformation, size) failed"; - break; - } + uint8_t buffer[1024]; + ULONG size = sizeof(buffer); + SYSTEM_PAGEFILE_INFORMATION* pstart = (SYSTEM_PAGEFILE_INFORMATION*) buffer; + if(!NT_SUCCESS(NtQuerySystemInformation(SystemPagefileInformation, pstart, size, &size))) + return "NtQuerySystemInformation(SystemPagefileInformation, size) failed"; uint32_t pageSize = instance.state.platform.pageSize; swap->bytesUsed = (uint64_t)pstart->TotalUsed * pageSize;