[weiden] 15149: prevent buffer overflow, LoadString accepts the size of the buffer in TCHARs, not in bytes! Please guys, read the documentation of the function _before_ you use it...
prevent buffer overflow, LoadString accepts the size of the buffer in TCHARs, not in bytes! Please guys, read the documentation of the function _before_ you use it... Modified: trunk/reactos/subsys/system/cmd/copy.c Modified: trunk/reactos/subsys/system/cmd/del.c Modified: trunk/reactos/subsys/system/cmd/for.c Modified: trunk/reactos/subsys/system/cmd/timer.c Modified: trunk/reactos/subsys/system/cmd/ver.c Modified: trunk/reactos/subsys/system/taskmgr/applpage.c Modified: trunk/reactos/subsys/system/taskmgr/trayicon.c _____
Modified: trunk/reactos/subsys/system/cmd/copy.c --- trunk/reactos/subsys/system/cmd/copy.c 2005-05-08 19:14:18 UTC (rev 15148) +++ trunk/reactos/subsys/system/cmd/copy.c 2005-05-08 19:22:28 UTC (rev 15149) @@ -299,7 +299,7 @@
LPTSTR p; TCHAR szOptions[4];
- LoadString( CMD_ModuleHandle, STRING_COPY_OPTION, szOptions, 4); + LoadString( CMD_ModuleHandle, STRING_COPY_OPTION, szOptions, sizeof(szOptions) / sizeof(szOptions[0]) );
ConOutResPuts(STRING_COPY_HELP1);
@@ -760,7 +760,7 @@ DeleteFileList (sources); freep ((VOID*)p); - LoadString( CMD_ModuleHandle, STRING_COPY_FILE, (LPTSTR) szMsg,sizeof(szMsg)); + LoadString( CMD_ModuleHandle, STRING_COPY_FILE, szMsg, RC_STRING_MAX_SIZE); ConOutPrintf (szMsg, copied);
return 1; _____
Modified: trunk/reactos/subsys/system/cmd/del.c --- trunk/reactos/subsys/system/cmd/del.c 2005-05-08 19:14:18 UTC (rev 15148) +++ trunk/reactos/subsys/system/cmd/del.c 2005-05-08 19:22:28 UTC (rev 15149) @@ -71,9 +71,9 @@
HANDLE fh; WIN32_FIND_DATA f; LONGLONG FileSize; - TCHAR szMsg[RC_STRING_MAX_SIZE]; + TCHAR szMsg[RC_STRING_MAX_SIZE];
- LoadString( CMD_ModuleHandle, STRING_DELETE_WIPE, (LPTSTR) szMsg,sizeof(szMsg)); + LoadString( CMD_ModuleHandle, STRING_DELETE_WIPE, szMsg, RC_STRING_MAX_SIZE);
fh = FindFirstFile(lpFileName, &f); FileSize = ((LONGLONG)f.nFileSizeHigh * ((LONGLONG)MAXDWORD+1)) + (LONGLONG)f.nFileSizeLow; _____
Modified: trunk/reactos/subsys/system/cmd/for.c --- trunk/reactos/subsys/system/cmd/for.c 2005-05-08 19:14:18 UTC (rev 15148) +++ trunk/reactos/subsys/system/cmd/for.c 2005-05-08 19:22:28 UTC (rev 15149) @@ -68,7 +68,7 @@
/* Check that first element is % then an alpha char followed by space */ if ((*param != _T('%')) || !_istalpha (*(param + 1)) || !_istspace (*(param + 2))) { - LoadString( CMD_ModuleHandle, STRING_FOR_ERROR, (LPTSTR) szMsg,sizeof(szMsg)); + LoadString( CMD_ModuleHandle, STRING_FOR_ERROR, szMsg, RC_STRING_MAX_SIZE); error_syntax (szMsg); return 1; } _____
Modified: trunk/reactos/subsys/system/cmd/timer.c --- trunk/reactos/subsys/system/cmd/timer.c 2005-05-08 19:14:18 UTC (rev 15148) +++ trunk/reactos/subsys/system/cmd/timer.c 2005-05-08 19:22:28 UTC (rev 15149) @@ -107,7 +107,7 @@
return 0; }
- LoadString( CMD_ModuleHandle, STRING_TIMER_TIME, (LPTSTR) szMsg,sizeof(szMsg)); + LoadString( CMD_ModuleHandle, STRING_TIMER_TIME, szMsg, RC_STRING_MAX_SIZE);
p = split (param, &argc, FALSE);
_____
Modified: trunk/reactos/subsys/system/cmd/ver.c --- trunk/reactos/subsys/system/cmd/ver.c 2005-05-08 19:14:18 UTC (rev 15148) +++ trunk/reactos/subsys/system/cmd/ver.c 2005-05-08 19:22:28 UTC (rev 15149) @@ -46,8 +46,8 @@
(RosVersion - VersionInfo.szCSDVersion); if (7 <= RosVersionLen && 0 == _tcsnicmp(RosVersion, _T("ReactOS"), 7)) { - LoadString( CMD_ModuleHandle, STRING_VERSION_RUNVER, (LPTSTR) szMsg,sizeof(szMsg)); - ConOutPrintf (szMsg, RosVersion); + LoadString( CMD_ModuleHandle, STRING_VERSION_RUNVER, (LPTSTR) szMsg, RC_STRING_MAX_SIZE); + ConOutPrintf (szMsg, RosVersion); } } ConOutPuts (_T("\n")); _____
Modified: trunk/reactos/subsys/system/taskmgr/applpage.c --- trunk/reactos/subsys/system/taskmgr/applpage.c 2005-05-08 19:14:18 UTC (rev 15148) +++ trunk/reactos/subsys/system/taskmgr/applpage.c 2005-05-08 19:22:28 UTC (rev 15149) @@ -489,7 +489,7 @@
LPNM_LISTVIEW pnmv; LV_DISPINFO* pnmdi; LPAPPLICATION_PAGE_LIST_ITEM pAPLI; - TCHAR szMsg[256]; + TCHAR szMsg[256];
idctrl = (int) wParam; @@ -516,15 +516,15 @@ else if (pnmdi->item.iSubItem == 1) { if (pAPLI->bHung) - { - LoadString( GetModuleHandle(NULL), IDS_Not_Responding , (LPTSTR) szMsg,sizeof(szMsg)); + { + LoadString( GetModuleHandle(NULL), IDS_Not_Responding , szMsg, sizeof(szMsg) / sizeof(szMsg[0])); _tcsncpy(pnmdi->item.pszText, szMsg, pnmdi->item.cchTextMax); - } + } else - { - LoadString( GetModuleHandle(NULL), IDS_Running, (LPTSTR) szMsg,sizeof(szMsg)); + { + LoadString( GetModuleHandle(NULL), IDS_Running, (LPTSTR) szMsg, sizeof(szMsg) / sizeof(szMsg[0])); _tcsncpy(pnmdi->item.pszText, szMsg, pnmdi->item.cchTextMax); - } + } }
break; _____
Modified: trunk/reactos/subsys/system/taskmgr/trayicon.c --- trunk/reactos/subsys/system/taskmgr/trayicon.c 2005-05-08 19:14:18 UTC (rev 15148) +++ trunk/reactos/subsys/system/taskmgr/trayicon.c 2005-05-08 19:22:28 UTC (rev 15149) @@ -149,7 +149,7 @@
nid.hIcon = hIcon;
- LoadString( GetModuleHandle(NULL), IDS_MSG_TRAYICONCPUUSAGE, (LPTSTR) szMsg,sizeof(szMsg)); + LoadString( GetModuleHandle(NULL), IDS_MSG_TRAYICONCPUUSAGE, szMsg, sizeof(szMsg) / sizeof(szMsg[0])); wsprintf(nid.szTip, szMsg, PerfDataGetProcessorUsage());
bRetVal = Shell_NotifyIcon(NIM_ADD, &nid);
-
weiden＠svn.reactos.com