ApfelTeeSaft/reactos
1
0
Fork 0
mirror of https://github.com/ApfelTeeSaft/reactos.git synced 2026-09-02 19:26:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Avoid buffer overflow (bug #4693).

Browse Source 
svn path=/trunk/; revision=44449
This commit is contained in:
Dmitry Gorbachev
2009-12-07 01:30:32 +00:00
parent ae13f265c6
commit a80552f8a9
1 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
reactos/dll/win32/msafd/misc/dllmain.c
+15 -9
View File
@@ -560,25 +560,31 @@ WSPBind(SOCKET Handle,
PAFD_BIND_DATA BindData;
PSOCKET_INFORMATION Socket = NULL;
NTSTATUS Status;
UCHAR BindBuffer[0x1A];
SOCKADDR_INFO SocketInfo;
HANDLE SockEvent;
/* See below */
BindData = HeapAlloc(GlobalHeap, 0, 0xA + SocketAddressLength);
if (!BindData)
{
return MsafdReturnWithErrno(STATUS_INSUFFICIENT_RESOURCES, lpErrno, 0, NULL);
}
Status = NtCreateEvent(&SockEvent,
GENERIC_READ | GENERIC_WRITE,
NULL,
1,
FALSE);
if( !NT_SUCCESS(Status) )
return -1;
if (!NT_SUCCESS(Status))
{
HeapFree(GlobalHeap, 0, BindData);
return SOCKET_ERROR;
}
/* Get the Socket Structure associate to this Socket*/
Socket = GetSocketStructure(Handle);
/* Dynamic Structure...ugh */
BindData = (PAFD_BIND_DATA)BindBuffer;
/* Set up Address in TDI Format */
BindData->Address.TAAddressCount = 1;
BindData->Address.Address[0].AddressLength = SocketAddressLength - sizeof(SocketAddress->sa_family);
@@ -633,9 +639,9 @@ WSPBind(SOCKET Handle,
Socket->SharedData.State = SocketBound;
Socket->TdiAddressHandle = (HANDLE)IOSB.Information;
NtClose( SockEvent );
return MsafdReturnWithErrno ( Status, lpErrno, 0, NULL );
NtClose(SockEvent);
HeapFree(GlobalHeap, 0, BindData);
return MsafdReturnWithErrno(Status, lpErrno, 0, NULL);
}
int