[ros-diffs] [hbirr] 19227: Fixed a few length calculation in NtEnumerateValueKey, which has resulted in a overflow, if the given buffer was too small.

Fixed a few length calculation in NtEnumerateValueKey, which has
resulted in a overflow, if the given buffer was too small.
Modified: trunk/reactos/ntoskrnl/cm/ntfunc.c
  _____  

Modified: trunk/reactos/ntoskrnl/cm/ntfunc.c
--- trunk/reactos/ntoskrnl/cm/ntfunc.c	2005-11-14 17:33:38 UTC (rev
19226)
+++ trunk/reactos/ntoskrnl/cm/ntfunc.c	2005-11-14 17:46:00 UTC (rev
19227)
@@ -1135,18 +1135,16 @@

                   ROUND_UP(ValueFullInformation->DataOffset,
sizeof(PVOID));
               ValueFullInformation->DataLength = ValueCell->DataSize &
REG_DATA_SIZE_MASK;
 
-	      if (Length - FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION,
Name[0]) <
-	          NameSize)
+              if (Length < ValueFullInformation->DataOffset)
 	        {
 	          NameSize = Length -
FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION, Name[0]);
 	          DataSize = 0;
 	          Status = STATUS_BUFFER_OVERFLOW;
 	          CHECKPOINT;
 	        }
-              else if (ROUND_UP(Length -
FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION,
-                       Name[0]) - NameSize, sizeof(PVOID)) < DataSize)
+              else if (Length - ValueFullInformation->DataOffset <
DataSize) 
 	        {
-	          DataSize = ROUND_UP(Length -
FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION, Name[0]) - NameSize,
sizeof(PVOID));
+	          DataSize = Length - ValueFullInformation->DataOffset;
 	          Status = STATUS_BUFFER_OVERFLOW;
 	          CHECKPOINT;
 	        }