Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-08-05 21:42:57 +00:00
Code Issues Projects Releases Packages Wiki Activity

fixed possible buffer overflows in LookupAccountSidW(): LSA_UNICODE_STRINGs are not necessarily NULL-terminated!

Browse source 
svn path=/trunk/; revision=20855
This commit is contained in:
Thomas Bluemel 2006-01-14 16:31:28 +00:00
parent 2edcb03c9d
commit a988d3cfe2
1 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
reactos/lib/advapi32/sec/misc.c
View file

@ -872,15 +872,14 @@ LookupAccountSidW (
PSID_NAME_USE peUse ) PSID_NAME_USE peUse )
{ {
LSA_UNICODE_STRING SystemName; LSA_UNICODE_STRING SystemName;
LSA_OBJECT_ATTRIBUTES ObjectAttributes; LSA_OBJECT_ATTRIBUTES ObjectAttributes = {0};
LSA_HANDLE PolicyHandle = INVALID_HANDLE_VALUE; LSA_HANDLE PolicyHandle = NULL;
NTSTATUS Status; NTSTATUS Status;
PLSA_REFERENCED_DOMAIN_LIST ReferencedDomain = NULL; PLSA_REFERENCED_DOMAIN_LIST ReferencedDomain = NULL;
PLSA_TRANSLATED_NAME TranslatedName = NULL; PLSA_TRANSLATED_NAME TranslatedName = NULL;
BOOL ret; BOOL ret;
RtlInitUnicodeString ( &SystemName, pSystemName ); RtlInitUnicodeString ( &SystemName, pSystemName );
ZeroMemory(&ObjectAttributes, sizeof(ObjectAttributes));
Status = LsaOpenPolicy ( &SystemName, &ObjectAttributes, POLICY_LOOKUP_NAMES, &PolicyHandle ); Status = LsaOpenPolicy ( &SystemName, &ObjectAttributes, POLICY_LOOKUP_NAMES, &PolicyHandle );
if ( !NT_SUCCESS(Status) ) if ( !NT_SUCCESS(Status) )
{ {
@ -910,7 +909,8 @@ LookupAccountSidW (
else else
{ {
*pdwAccountName = dwSrcLen; *pdwAccountName = dwSrcLen;
wcscpy ( pAccountName, TranslatedName->Name.Buffer ); RtlCopyMemory ( pAccountName, TranslatedName->Name.Buffer, TranslatedName->Name.Length );
pAccountName[TranslatedName->Name.Length / sizeof(WCHAR)] = L'\0';
} }
if ( peUse ) if ( peUse )
*peUse = TranslatedName->Use; *peUse = TranslatedName->Use;
@ -929,7 +929,8 @@ LookupAccountSidW (
else else
{ {
*pdwDomainName = dwSrcLen; *pdwDomainName = dwSrcLen;
wcscpy ( pDomainName, ReferencedDomain->Domains[0].Name.Buffer ); RtlCopyMemory ( pDomainName, ReferencedDomain->Domains[0].Name.Buffer, ReferencedDomain->Domains[0].Name.Length );
pDomainName[ReferencedDomain->Domains[0].Name.Length / sizeof(WCHAR)] = L'\0';
} }
} }
} }