Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-08-03 18:15:58 +00:00
Code Issues Projects Releases Packages Wiki Activity

[SMSS] Use RTL string-safe functions in critical places. Add validity checks for returned NtQueryValueKey() data. (#2704)

Browse source 
- Not all the wcscpy() / swprintf() calls have been converted to their
  string-safe equivalents. Instead I used the string-safe functions only
  for places where strings of unknown length were copied into fixed-size
  internal buffers. On the contrary, for known-fixed-length strings being
  copied or numbers being converted to string representations in large
  enough buffers, I kept the original function calls.

- Verify the registry data that has been returned by NtQueryValueKey():
  * When expecting (not multi) strings, check whether the data type is
    either REG_SZ or REG_EXPAND_SZ.
  * When expecting DWORD values, check whether the data type is
    REG_DWORD and whether the data length is (greater or) equal to
    sizeof(ULONG).
This commit is contained in:
Hermès Bélusca-Maïto 2020-04-30 18:42:16 +02:00
parent 8ee0ee6a88
commit 87e2ec585f
No known key found for this signature in database
GPG key ID: 3B2539C65E7B93D0
5 changed files with 80 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

4
base/system/smss/smsubsys.c
View file

@ -656,8 +656,8 @@ SmpLoadSubSystemsForMuSession(IN PULONG MuSessionId,
if ((NT_SUCCESS(Status2)) && (InitialCommandBuffer[0]))
{
/* Put the debugger string with the Winlogon string */
wcscat(InitialCommandBuffer, L" ");
wcscat(InitialCommandBuffer, InitialCommand->Buffer);
RtlStringCbCatW(InitialCommandBuffer, sizeof(InitialCommandBuffer), L" ");
RtlStringCbCatW(InitialCommandBuffer, sizeof(InitialCommandBuffer), InitialCommand->Buffer);
RtlInitUnicodeString(InitialCommand, InitialCommandBuffer);
}
}