From adcf73538130589e5c4831ec5a8fdd37a6408824 Mon Sep 17 00:00:00 2001
From: Sebastian Lackner <sebastian@fds-team.de>
Date: Sat, 4 Oct 2014 02:38:27 +0200
Subject: advapi: Trigger write watches before passing userdata pointer to read
 syscall.

---
 dlls/advapi32/crypt.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dlls/advapi32/crypt.c b/dlls/advapi32/crypt.c
index b2be5e3..50502b8 100644
--- a/dlls/advapi32/crypt.c
+++ b/dlls/advapi32/crypt.c
@@ -2378,7 +2378,8 @@ BOOLEAN WINAPI SystemFunction036(PVOID pbBuffer, ULONG dwLen)
     dev_random = open("/dev/urandom", O_RDONLY);
     if (dev_random != -1)
     {
-        if (read(dev_random, pbBuffer, dwLen) == (ssize_t)dwLen)
+        if (!IsBadWritePtr( pbBuffer, dwLen ) &&
+            read(dev_random, pbBuffer, dwLen) == (ssize_t)dwLen)
         {
             close(dev_random);
             return TRUE;
-- 
2.2.1

