[ros-diffs] [weiden] 20855: fixed possible buffer overflows in LookupAccountSidW(): LSA_UNICODE_STRINGs are not necessarily NULL-terminated!

fixed possible buffer overflows in LookupAccountSidW():
LSA_UNICODE_STRINGs are not necessarily NULL-terminated!
Modified: trunk/reactos/lib/advapi32/sec/misc.c
  _____  

Modified: trunk/reactos/lib/advapi32/sec/misc.c
--- trunk/reactos/lib/advapi32/sec/misc.c	2006-01-14 16:18:45 UTC
(rev 20854)
+++ trunk/reactos/lib/advapi32/sec/misc.c	2006-01-14 16:31:28 UTC
(rev 20855)
@@ -872,15 +872,14 @@

 	PSID_NAME_USE peUse )
 {
 	LSA_UNICODE_STRING SystemName;
-	LSA_OBJECT_ATTRIBUTES ObjectAttributes;
-	LSA_HANDLE PolicyHandle = INVALID_HANDLE_VALUE;
+        LSA_OBJECT_ATTRIBUTES ObjectAttributes = {0};
+	LSA_HANDLE PolicyHandle = NULL;
 	NTSTATUS Status;
 	PLSA_REFERENCED_DOMAIN_LIST ReferencedDomain = NULL;
 	PLSA_TRANSLATED_NAME TranslatedName = NULL;
 	BOOL ret;
 
 	RtlInitUnicodeString ( &SystemName, pSystemName );
-	ZeroMemory(&ObjectAttributes, sizeof(ObjectAttributes));
 	Status = LsaOpenPolicy ( &SystemName, &ObjectAttributes,
POLICY_LOOKUP_NAMES, &PolicyHandle );
 	if ( !NT_SUCCESS(Status) )
 	{
@@ -910,7 +909,8 @@
 			else
 			{
 				*pdwAccountName = dwSrcLen;
-				wcscpy ( pAccountName,
TranslatedName->Name.Buffer );
+				RtlCopyMemory ( pAccountName,
TranslatedName->Name.Buffer, TranslatedName->Name.Length );
+
pAccountName[TranslatedName->Name.Length / sizeof(WCHAR)] = L'\0';
 			}
 			if ( peUse )
 				*peUse = TranslatedName->Use;
@@ -929,7 +929,8 @@
 				else
 				{
 					*pdwDomainName = dwSrcLen;
-					wcscpy ( pDomainName,
ReferencedDomain->Domains[0].Name.Buffer );
+					RtlCopyMemory ( pDomainName,
ReferencedDomain->Domains[0].Name.Buffer,
ReferencedDomain->Domains[0].Name.Length );
+
pDomainName[ReferencedDomain->Domains[0].Name.Length / sizeof(WCHAR)] =
L'\0';
 				}
 			}
 		}