[ros-diffs] [cwittich] 36131: fix some heap corruptions in services

Author: cwittich
Date: Thu Sep 11 03:31:52 2008
New Revision: 36131

URL: http://svn.reactos.org/svn/reactos?rev=36131&view=rev
Log:
fix some heap corruptions in services

Modified:
    trunk/reactos/base/system/services/groupdb.c
    trunk/reactos/base/system/services/rpcserver.c

Modified: trunk/reactos/base/system/services/groupdb.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/base/system/services/group…
==============================================================================
--- trunk/reactos/base/system/services/groupdb.c [iso-8859-1] (original)
+++ trunk/reactos/base/system/services/groupdb.c [iso-8859-1] Thu Sep 11 03:31:52 2008
@@ -61,7 +61,7 @@
 
     lpGroup = (PSERVICE_GROUP)HeapAlloc(GetProcessHeap(),
                                         HEAP_ZERO_MEMORY,
-                                        sizeof(SERVICE_GROUP) + (wcslen(lpGroupName) *
sizeof(WCHAR)));
+                                        sizeof(SERVICE_GROUP) + ((wcslen(lpGroupName) +
1)* sizeof(WCHAR)));
     if (lpGroup == NULL)
         return ERROR_NOT_ENOUGH_MEMORY;
 
@@ -144,7 +144,7 @@
 
         Group = (PSERVICE_GROUP)HeapAlloc(GetProcessHeap(),
                                           HEAP_ZERO_MEMORY,
-                                          sizeof(SERVICE_GROUP) + (wcslen((const
wchar_t*) ValueData) * sizeof(WCHAR)));
+                                          sizeof(SERVICE_GROUP) + ((wcslen((const
wchar_t*) ValueData) + 1) * sizeof(WCHAR)));
         if (Group == NULL)
         {
             return STATUS_INSUFFICIENT_RESOURCES;

Modified: trunk/reactos/base/system/services/rpcserver.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/base/system/services/rpcse…
==============================================================================
--- trunk/reactos/base/system/services/rpcserver.c [iso-8859-1] (original)
+++ trunk/reactos/base/system/services/rpcserver.c [iso-8859-1] Thu Sep 11 03:31:52 2008
@@ -164,7 +164,7 @@
 
     Ptr = (MANAGER_HANDLE*) HeapAlloc(GetProcessHeap(),
                     HEAP_ZERO_MEMORY,
-                    sizeof(MANAGER_HANDLE) + wcslen(lpDatabaseName) * sizeof(WCHAR));
+                    sizeof(MANAGER_HANDLE) + (wcslen(lpDatabaseName) + 1) *
sizeof(WCHAR));
     if (Ptr == NULL)
         return ERROR_NOT_ENOUGH_MEMORY;