Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-28 01:55:19 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOS:SE] Fix new dynamic length calculation in TokenPrimaryGroup case

Browse source 
Not only primary group assignation was broken but new dynamic length calculation is also broken. The length of the captured SID is not taken into account so the new dynamic length gets only the size of the default ACL present in an access token.
Therefore, the condition is always FALSE and the code never jumps to the STATUS_ALLOTTED_SPACE_EXCEEDED branch because the length will always be small than the charged dynamic length.

Addendum to 86bde3c.
This commit is contained in:
George Bișoc 2022-08-16 20:27:27 +02:00
parent 3bd822366c
commit 3b00f98b94
No known key found for this signature in database
GPG key ID: 688C4FBE25D7DEF6
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ntoskrnl/se/tokencls.c
View file

@ -1259,8 +1259,8 @@ NtSetInformationToken(
* to do so. Exceeding this boundary and we're
* busted out.
*/
NewDynamicLength = RtlLengthSid(CapturedSid) +
Token->DefaultDacl ? Token->DefaultDacl->AclSize : 0;
AclSize = Token->DefaultDacl ? Token->DefaultDacl->AclSize : 0;
NewDynamicLength = RtlLengthSid(CapturedSid) + AclSize;
if (NewDynamicLength > Token->DynamicCharged)
{
SepReleaseTokenLock(Token);
@ -1317,7 +1317,6 @@ NtSetInformationToken(
* has a default DACL then add up its size with
* the address of the dynamic part.
*/
AclSize = Token->DefaultDacl ? Token->DefaultDacl->AclSize : 0;
PrimaryGroup = (ULONG_PTR)(Token->DynamicPart) + AclSize;
RtlCopySid(RtlLengthSid(Token->UserAndGroups[PrimaryGroupIndex].Sid),
(PVOID)PrimaryGroup,