From f683586623694a66b2466254efdf278b8e046945 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Wed, 8 Apr 2026 23:15:37 +0800
Subject: [PATCH] Swap (Windows): fixes out-of-bound memory access when swaps
 are disabled

---
 src/detection/swap/swap_windows.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/detection/swap/swap_windows.c b/src/detection/swap/swap_windows.c
index a0c6999c5..558feff5c 100644
--- a/src/detection/swap/swap_windows.c
+++ b/src/detection/swap/swap_windows.c
@@ -14,6 +14,10 @@ const char* ffDetectSwap(FFlist* result) {
         return "NtQuerySystemInformation(SystemPagefileInformation, size) failed";
     }
 
+    if (size == 0) {
+        return NULL;
+    }
+
     uint32_t pageSize = instance.state.platform.sysinfo.pageSize;
     for (SYSTEM_PAGEFILE_INFORMATION* current = pstart;; current = (SYSTEM_PAGEFILE_INFORMATION*) ((uint8_t*) current + current->NextEntryOffset)) {
         FFSwapResult* swap = ffListAdd(result);