IIS: fix ReadFileChunk latent overflow (allocate m_dwPageSize, not 1)

[A13501350]

Summary

Fixes a latent buffer overflow in ReadFileChunk (IIS module).

The I/O scratch buffer was allocated with VirtualAlloc(NULL, 1, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE), yet ReadFile writes m_dwPageSize bytes into it (iis/mymodule.cpp:304, :339). It only worked by accident: VirtualAlloc rounds the allocation size up to a full page, and the returned address is page-aligned — so requesting 1 byte commits exactly one page, which happens to equal m_dwPageSize. If m_dwPageSize ever differed from the system page size, ReadFile would write past the committed region (access violation).

Fixes

Closes #3623

Changed location

• iis/mymodule.cpp:305 — allocate the real size: VirtualAlloc(NULL, m_dwPageSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)

The page-aligned address still satisfies the file I/O alignment requirements already used in the function, and the committed size now matches the ReadFile length. VirtualFree(pIoBuffer, 0, MEM_RELEASE) cleanup is unchanged.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: cbd28e70-132c-4da4-8988-faf99f0f3900

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR fixes a latent buffer overflow risk in the IIS module’s CMyHttpModule::ReadFileChunk by allocating an I/O scratch buffer sized to the actual read length (m_dwPageSize) rather than relying on VirtualAlloc’s page-rounding behavior.

Changes:

• Update VirtualAlloc call to allocate m_dwPageSize bytes instead of 1, matching the ReadFile(..., m_dwPageSize, ...) usage.
• Keep existing cleanup behavior (VirtualFree(..., MEM_RELEASE)) unchanged.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[airween]

This PR looks good to me - I'll approve and merge it soon.