[PATCH 1/6] msv1_0: Map SecBuffer data before accessing it in ntlm_SpInitLsaModeContext and ntlm_SpInitLsaModeContext.

[Piotr Caban]

From: Piotr Caban <[e-mail]>

---
 dlls/msv1_0/main.c | 19 ++++++++++++++++++-
 dlls/secur32/lsa.c |  7 ++++++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/dlls/msv1_0/main.c b/dlls/msv1_0/main.c
index 73dfcdac92a..97c35b52d05 100644
--- a/dlls/msv1_0/main.c
+++ b/dlls/msv1_0/main.c
@@ -1299,6 +1299,8 @@ static NTSTATUS NTAPI ntlm_SpInitLsaModeContext( LSA_SEC_HANDLE cred_handle, LSA
             goto done;
         }
 
+        status = lsa_secpkg_table->MapBuffer( input->pBuffers + idx, input->pBuffers + idx );
+        if (status) goto done;
         challenge = input->pBuffers[idx].pvBuffer;
         ctx->req_attrs |= ctx_req;
         *ctx_attr = 0;
@@ -1384,7 +1386,7 @@ static NTSTATUS NTAPI ntlm_SpInitLsaModeContext( LSA_SEC_HANDLE cred_handle, LSA
     if (ctx_req & ISC_REQ_ALLOCATE_MEMORY)
     {
         /* freed with secur32.FreeContextBuffer */
-        if (!(output->pBuffers[idx].pvBuffer = RtlAllocateHeap( GetProcessHeap(), 0, bin_len )))
+        if (!(output->pBuffers[idx].pvBuffer = lsa_secpkg_table->AllocateLsaHeap( bin_len )))
         {
             status = SEC_E_INSUFFICIENT_MEMORY;
             goto done;
@@ -1397,6 +1399,15 @@ static NTSTATUS NTAPI ntlm_SpInitLsaModeContext( LSA_SEC_HANDLE cred_handle, LSA
         status = SEC_E_BUFFER_TOO_SMALL;
         goto done;
     }
+    else
+    {
+        NTSTATUS ret = lsa_secpkg_table->MapBuffer( output->pBuffers + idx, output->pBuffers + idx );
+        if (ret)
+        {
+            status = ret;
+            goto done;
+        }
+    }
 
     if (!output->pBuffers[idx].pvBuffer)
     {
@@ -1482,6 +1493,8 @@ static NTSTATUS NTAPI ntlm_SpAcceptLsaModeContext( LSA_SEC_HANDLE cred_handle, L
             status = SEC_E_INVALID_TOKEN;
             goto done;
         }
+        status = lsa_secpkg_table->MapBuffer( input->pBuffers, input->pBuffers );
+        if (status) goto done;
         negotiate = input->pBuffers[0].pvBuffer;
 
         if (!(ctx = calloc( 1, sizeof(*ctx) ))) goto done;
@@ -1566,6 +1579,8 @@ static NTSTATUS NTAPI ntlm_SpAcceptLsaModeContext( LSA_SEC_HANDLE cred_handle, L
         }
         output->pBuffers[0].cbBuffer = bin_len;
         output->pBuffers[0].BufferType = SECBUFFER_TOKEN;
+        status = lsa_secpkg_table->MapBuffer( output->pBuffers, output->pBuffers );
+        if (status) goto done;
         memcpy( output->pBuffers[0].pvBuffer, bin, bin_len );
 
         *new_ctx_handle = (LSA_SEC_HANDLE)ctx;
@@ -1595,6 +1610,8 @@ static NTSTATUS NTAPI ntlm_SpAcceptLsaModeContext( LSA_SEC_HANDLE cred_handle, L
             goto done;
         }
         else bin_len = input->pBuffers[0].cbBuffer;
+        status = lsa_secpkg_table->MapBuffer( input->pBuffers, input->pBuffers );
+        if (status) goto done;
         memcpy( bin, input->pBuffers[0].pvBuffer, bin_len );
         authenticate = input->pBuffers[0].pvBuffer;
 
diff --git a/dlls/secur32/lsa.c b/dlls/secur32/lsa.c
index f81cd3522b3..de04ab9316d 100644
--- a/dlls/secur32/lsa.c
+++ b/dlls/secur32/lsa.c
@@ -910,6 +910,11 @@ static const SecurityFunctionTableA lsa_sspi_tableA =
     NULL, /* SetContextAttributesA */
 };
 
+static NTSTATUS NTAPI lsa_MapBuffer( SecBuffer *in, SecBuffer *out )
+{
+    return SEC_E_OK;
+}
+
 static BOOLEAN NTAPI lsa_GetCallInfo( SECPKG_CALL_INFO *info )
 {
     memset( info, 0, sizeof(*info) );
@@ -940,7 +945,7 @@ static const LSA_SECPKG_FUNCTION_TABLE lsa_secpkg_table =
     NULL, /* GetClientInfo */
     NULL, /* RegisterNotification */
     NULL, /* CancelNotification */
-    NULL, /* MapBuffer */
+    lsa_MapBuffer,
     NULL, /* CreateToken */
     NULL, /* AuditLogon */
     NULL, /* CallPackage */
-- 
GitLab


https://gitlab.winehq.org/wine/wine/-/merge_requests/11718