[ros-diffs] [tfaber] 64661: [CONSRV] - Fix buffer overflows

Author: tfaber
Date: Sat Oct 11 12:13:27 2014
New Revision: 64661

URL: http://svn.reactos.org/svn/reactos?rev=64661&view=rev
Log:
[CONSRV]
- Fix buffer overflows

Modified:
    trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/conwnd.c
    trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guisettings.c
    trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c

Modified: trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/conwnd.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/winsrv/consrv/...
==============================================================================
--- trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/conwnd.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/conwnd.c	[iso-8859-1] Sat Oct 11 12:13:27 2014
@@ -627,9 +627,8 @@
      */
     if (FaceName != GuiData->GuiInfo.FaceName)
     {
-        SIZE_T Length = min(wcslen(FaceName) + 1, LF_FACESIZE); // wcsnlen
         wcsncpy(GuiData->GuiInfo.FaceName, FaceName, LF_FACESIZE);
-        GuiData->GuiInfo.FaceName[Length] = L'\0'; // NULL-terminate
+        GuiData->GuiInfo.FaceName[LF_FACESIZE - 1] = UNICODE_NULL;
     }
     GuiData->GuiInfo.FontFamily = FontFamily;
     GuiData->GuiInfo.FontSize   = FontSize;

Modified: trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guisettings.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/winsrv/consrv/...
==============================================================================
--- trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guisettings.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guisettings.c	[iso-8859-1] Sat Oct 11 12:13:27 2014
@@ -83,9 +83,8 @@

if (!wcscmp(szValueName, L"FaceName"))
         {
-            SIZE_T Length = min(wcslen(szValue) + 1, LF_FACESIZE); // wcsnlen
             wcsncpy(TermInfo->FaceName, szValue, LF_FACESIZE);
-            TermInfo->FaceName[Length] = L'\0';
+            TermInfo->FaceName[LF_FACESIZE - 1] = UNICODE_NULL;
             RetVal = TRUE;
         }
         else if (!wcscmp(szValueName, L"FontFamily"))
@@ -323,9 +322,8 @@
         /* GUI Information */
         pSharedInfo->TerminalInfo.Size = sizeof(GUI_CONSOLE_INFO);
         GuiInfo = pSharedInfo->TerminalInfo.TermInfo = (PGUI_CONSOLE_INFO)(pSharedInfo + 1);
-        Length = min(wcslen(GuiData->GuiInfo.FaceName) + 1, LF_FACESIZE); // wcsnlen
         wcsncpy(GuiInfo->FaceName, GuiData->GuiInfo.FaceName, LF_FACESIZE);
-        GuiInfo->FaceName[Length] = L'\0';
+        GuiInfo->FaceName[LF_FACESIZE - 1] = UNICODE_NULL;
         GuiInfo->FontFamily = GuiData->GuiInfo.FontFamily;
         GuiInfo->FontSize   = GuiData->GuiInfo.FontSize;
         GuiInfo->FontWeight = GuiData->GuiInfo.FontWeight;
@@ -573,7 +571,9 @@
     PCONSOLE_STATE_INFO pConInfo = NULL;
     CONSOLE_INFO     ConInfo;
     GUI_CONSOLE_INFO GuiInfo;
+#if 0
     SIZE_T Length;
+#endif

if (!ConDrvValidateConsoleUnsafe(Console, CONSOLE_RUNNING, TRUE)) return;

@@ -649,9 +649,8 @@

// Terminal information
-        Length = min(wcslen(pConInfo->FaceName) + 1, LF_FACESIZE); // wcsnlen
         wcsncpy(GuiInfo.FaceName, pConInfo->FaceName, LF_FACESIZE);
-        GuiInfo.FaceName[Length] = L'\0';
+        GuiInfo.FaceName[LF_FACESIZE - 1] = UNICODE_NULL;

GuiInfo.FontFamily = pConInfo->FontFamily;
         GuiInfo.FontSize = pConInfo->FontSize;

Modified: trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/winsrv/consrv/...
==============================================================================
--- trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c	[iso-8859-1] Sat Oct 11 12:13:27 2014
@@ -340,8 +340,6 @@

PGUI_CONSOLE_DATA GuiData;
     GUI_CONSOLE_INFO  TermInfo;
-
-    SIZE_T Length = 0;

if (This == NULL || Console == NULL || This->OldData == NULL)
         return STATUS_INVALID_PARAMETER;
@@ -417,9 +415,8 @@
      */

// Font data
-    Length = min(wcslen(TermInfo.FaceName) + 1, LF_FACESIZE); // wcsnlen
     wcsncpy(GuiData->GuiInfo.FaceName, TermInfo.FaceName, LF_FACESIZE);
-    GuiData->GuiInfo.FaceName[Length] = L'\0';
+    GuiData->GuiInfo.FaceName[LF_FACESIZE - 1] = UNICODE_NULL;
     GuiData->GuiInfo.FontFamily     = TermInfo.FontFamily;
     GuiData->GuiInfo.FontSize       = TermInfo.FontSize;
     GuiData->GuiInfo.FontWeight     = TermInfo.FontWeight;