Author: ekohl
Date: Sat Sep 14 21:35:01 2013
New Revision: 60119
URL:
http://svn.reactos.org/svn/reactos?rev=60119&view=rev
Log:
[NETAPI32]
NetLocalGroupGetMembers: Fix heap corruption by calculationg the proper buffer size.
Modified:
trunk/reactos/dll/win32/netapi32/local_group.c
Modified: trunk/reactos/dll/win32/netapi32/local_group.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/netapi32/local_g…
==============================================================================
--- trunk/reactos/dll/win32/netapi32/local_group.c [iso-8859-1] (original)
+++ trunk/reactos/dll/win32/netapi32/local_group.c [iso-8859-1] Sat Sep 14 21:35:01 2013
@@ -1515,27 +1515,27 @@
switch (level)
{
case 0:
- Size = sizeof(LOCALGROUP_MEMBERS_INFO_0) +
- RtlLengthSid(EnumContext->Sids[i]);
+ Size += sizeof(LOCALGROUP_MEMBERS_INFO_0) +
+ RtlLengthSid(EnumContext->Sids[i]);
break;
case 1:
- Size = sizeof(LOCALGROUP_MEMBERS_INFO_1) +
- RtlLengthSid(EnumContext->Sids[i]) +
- EnumContext->Names[i].Name.Length + sizeof(WCHAR);
+ Size += sizeof(LOCALGROUP_MEMBERS_INFO_1) +
+ RtlLengthSid(EnumContext->Sids[i]) +
+ EnumContext->Names[i].Name.Length + sizeof(WCHAR);
break;
case 2:
- Size = sizeof(LOCALGROUP_MEMBERS_INFO_2) +
- RtlLengthSid(EnumContext->Sids[i]) +
- EnumContext->Names[i].Name.Length + sizeof(WCHAR) +
-
EnumContext->Domains->Domains[EnumContext->Names[i].DomainIndex].Name.Length +
sizeof(WCHAR);
+ Size += sizeof(LOCALGROUP_MEMBERS_INFO_2) +
+ RtlLengthSid(EnumContext->Sids[i]) +
+ EnumContext->Names[i].Name.Length + sizeof(WCHAR) +
+
EnumContext->Domains->Domains[EnumContext->Names[i].DomainIndex].Name.Length +
sizeof(WCHAR);
break;
case 3:
- Size = sizeof(LOCALGROUP_MEMBERS_INFO_3) +
- EnumContext->Names[i].Name.Length + sizeof(WCHAR) +
-
EnumContext->Domains->Domains[EnumContext->Names[i].DomainIndex].Name.Length +
sizeof(WCHAR);
+ Size += sizeof(LOCALGROUP_MEMBERS_INFO_3) +
+ EnumContext->Names[i].Name.Length + sizeof(WCHAR) +
+
EnumContext->Domains->Domains[EnumContext->Names[i].DomainIndex].Name.Length +
sizeof(WCHAR);
break;
default: