[ros-diffs] [janderwald] 39424: - Fix a potential buffer overflow in RChangeServiceConfigA - Make sure that returned buffers are zero terminated in RQueryServiceConfigA

Author: janderwald
Date: Thu Feb  5 16:23:43 2009
New Revision: 39424

URL: http://svn.reactos.org/svn/reactos?rev=39424&view=rev
Log:
- Fix a potential buffer overflow in RChangeServiceConfigA
- Make sure that returned buffers are zero terminated in RQueryServiceConfigA

Modified:
    trunk/reactos/base/system/services/rpcserver.c

Modified: trunk/reactos/base/system/services/rpcserver.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/base/system/services/rpcse…
==============================================================================
--- trunk/reactos/base/system/services/rpcserver.c [iso-8859-1] (original)
+++ trunk/reactos/base/system/services/rpcserver.c [iso-8859-1] Thu Feb  5 16:23:43 2009
@@ -2984,7 +2984,7 @@
                             lpDisplayName,
                             -1,
                             lpDisplayNameW,
-                            wcslen(lpDisplayNameW) + 1);
+                            strlen(lpDisplayName) + 1);
 
         RegSetValueExW(hServiceKey,
                        L"DisplayName",
@@ -3620,7 +3620,7 @@
                                 lpImagePath,
                                 -1,
                                 lpStr,
-                                wcslen(lpImagePath),
+                                wcslen(lpImagePath)+1,
                                 0,
                                 0);
         }
@@ -3639,7 +3639,7 @@
                                 lpService->lpGroup->lpGroupName,
                                 -1,
                                 lpStr,
-                                wcslen(lpService->lpGroup->lpGroupName),
+                                wcslen(lpService->lpGroup->lpGroupName)+1,
                                 0,
                                 0);
         }
@@ -3664,7 +3664,7 @@
                                 lpServiceStartName,
                                 -1,
                                 lpStr,
-                                wcslen(lpServiceStartName),
+                                wcslen(lpServiceStartName)+1,
                                 0,
                                 0);
         }
@@ -3683,7 +3683,7 @@
                                 lpService->lpDisplayName,
                                 -1,
                                 lpStr,
-                                wcslen(lpService->lpDisplayName),
+                                wcslen(lpService->lpDisplayName)+1,
                                 0,
                                 0);
         }