Skip to content
Snippets Groups Projects
Commit f926811e authored by Michael Müller's avatar Michael Müller Committed by Alexandre Julliard
Browse files

server: Correctly validate SID length in sd_is_valid.

parent b8f0a28e
No related branches found
No related tags found
No related merge requests found
...@@ -305,8 +305,7 @@ int sd_is_valid( const struct security_descriptor *sd, data_size_t size ) ...@@ -305,8 +305,7 @@ int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
owner = sd_get_owner( sd ); owner = sd_get_owner( sd );
if (owner) if (owner)
{ {
size_t needed_size = security_sid_len( owner ); if ((sd->owner_len < sizeof(SID)) || (security_sid_len( owner ) > sd->owner_len))
if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
return FALSE; return FALSE;
} }
offset += sd->owner_len; offset += sd->owner_len;
...@@ -317,8 +316,7 @@ int sd_is_valid( const struct security_descriptor *sd, data_size_t size ) ...@@ -317,8 +316,7 @@ int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
group = sd_get_group( sd ); group = sd_get_group( sd );
if (group) if (group)
{ {
size_t needed_size = security_sid_len( group ); if ((sd->group_len < sizeof(SID)) || (security_sid_len( group ) > sd->group_len))
if ((sd->group_len < sizeof(SID)) || (needed_size > sd->group_len))
return FALSE; return FALSE;
} }
offset += sd->group_len; offset += sd->group_len;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment