Re: ntdll: Fix two buffer overflow conditions in RtlDosPathNameToNtPathName_U.

2011-09-07 Thread Vitaliy Margolen
On 09/06/2011 08:46 AM, Octavian Voicu wrote: On Tue, Sep 6, 2011 at 4:40 PM, Vitaliy Margolen wrote: The fix is not entirely correct. UNICODE_STRING does not have to have a terminating \0 character. The code should not use str* functions on not zero-terminated strings. I was also unsure abo

Re: ntdll: Fix two buffer overflow conditions in RtlDosPathNameToNtPathName_U.

2011-09-06 Thread Octavian Voicu
On Tue, Sep 6, 2011 at 4:40 PM, Vitaliy Margolen wrote: > The fix is not entirely correct. UNICODE_STRING does not have to have a > terminating \0 character. The code should not use str* functions on not > zero-terminated strings. I was also unsure about this when coding the patch, but I read her

Re: ntdll: Fix two buffer overflow conditions in RtlDosPathNameToNtPathName_U.

2011-09-06 Thread Vitaliy Margolen
On 09/06/2011 06:23 AM, Octavian Voicu wrote: First one is an off-by-one error: RtlGetFullPathName_U, on success, returns the number of bytes written, without counting the terminating NULL. The allocated size for ntpath->Buffer didn't account for that NULL byte, so for UNC paths the NULL byte wou