Author: ekohl Date: Sat Sep 14 21:35:01 2013 New Revision: 60119
URL: http://svn.reactos.org/svn/reactos?rev=60119&view=rev Log: [NETAPI32] NetLocalGroupGetMembers: Fix heap corruption by calculationg the proper buffer size.
Modified: trunk/reactos/dll/win32/netapi32/local_group.c
Modified: trunk/reactos/dll/win32/netapi32/local_group.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/netapi32/local_gr... ============================================================================== --- trunk/reactos/dll/win32/netapi32/local_group.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/netapi32/local_group.c [iso-8859-1] Sat Sep 14 21:35:01 2013 @@ -1515,27 +1515,27 @@ switch (level) { case 0: - Size = sizeof(LOCALGROUP_MEMBERS_INFO_0) + - RtlLengthSid(EnumContext->Sids[i]); + Size += sizeof(LOCALGROUP_MEMBERS_INFO_0) + + RtlLengthSid(EnumContext->Sids[i]); break;
case 1: - Size = sizeof(LOCALGROUP_MEMBERS_INFO_1) + - RtlLengthSid(EnumContext->Sids[i]) + - EnumContext->Names[i].Name.Length + sizeof(WCHAR); + Size += sizeof(LOCALGROUP_MEMBERS_INFO_1) + + RtlLengthSid(EnumContext->Sids[i]) + + EnumContext->Names[i].Name.Length + sizeof(WCHAR); break;
case 2: - Size = sizeof(LOCALGROUP_MEMBERS_INFO_2) + - RtlLengthSid(EnumContext->Sids[i]) + - EnumContext->Names[i].Name.Length + sizeof(WCHAR) + - EnumContext->Domains->Domains[EnumContext->Names[i].DomainIndex].Name.Length + sizeof(WCHAR); + Size += sizeof(LOCALGROUP_MEMBERS_INFO_2) + + RtlLengthSid(EnumContext->Sids[i]) + + EnumContext->Names[i].Name.Length + sizeof(WCHAR) + + EnumContext->Domains->Domains[EnumContext->Names[i].DomainIndex].Name.Length + sizeof(WCHAR); break;
case 3: - Size = sizeof(LOCALGROUP_MEMBERS_INFO_3) + - EnumContext->Names[i].Name.Length + sizeof(WCHAR) + - EnumContext->Domains->Domains[EnumContext->Names[i].DomainIndex].Name.Length + sizeof(WCHAR); + Size += sizeof(LOCALGROUP_MEMBERS_INFO_3) + + EnumContext->Names[i].Name.Length + sizeof(WCHAR) + + EnumContext->Domains->Domains[EnumContext->Names[i].DomainIndex].Name.Length + sizeof(WCHAR); break;
default: