ApfelTeeSaft/reactos
1
0
Fork 0
mirror of https://github.com/ApfelTeeSaft/reactos.git synced 2026-09-03 04:13:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

[MSGINA]

Browse Source 
- pszEnvironment is a multi-sz string so make sure to double-null terminate it. Fixes a buffer overrun in winlogon; powered by DPH.

svn path=/trunk/; revision=65153
This commit is contained in:
Thomas Faber
2014-10-31 17:05:30 +00:00
parent 175d2a76b3
commit b5b1531e3e
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
reactos/dll/win32/msgina/msgina.c
+8 -3
View File
@@ -30,6 +30,7 @@
#include <winsvc.h>
#include <userenv.h>
#include <ndk/sefuncs.h>
#include <strsafe.h>
HINSTANCE hDllInstance;
@@ -778,15 +779,19 @@ CreateProfile(
pProfile->dwType = WLX_PROFILE_TYPE_V2_0;
pProfile->pszProfile = ProfilePath;
lpEnvironment = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY,
(wcslen(pgContext->Domain)+ 14 + 1) * sizeof(WCHAR));
cbSize = sizeof(L"LOGONSERVER=\\\\") +
wcslen(pgContext->Domain) * sizeof(WCHAR) +
sizeof(UNICODE_NULL);
lpEnvironment = HeapAlloc(GetProcessHeap(), 0, cbSize);
if (!lpEnvironment)
{
WARN("HeapAlloc() failed\n");
goto cleanup;
}
wsprintfW(lpEnvironment, L"LOGONSERVER=\\\\%s", pgContext->Domain);
StringCbPrintfW(lpEnvironment, cbSize, L"LOGONSERVER=\\\\%ls", pgContext->Domain);
ASSERT(wcslen(lpEnvironment) == cbSize / sizeof(WCHAR) - 2);
lpEnvironment[cbSize / sizeof(WCHAR) - 1] = UNICODE_NULL;
pProfile->pszEnvironment = lpEnvironment;