Hans Leidekker : wldap32: Fix parsing page controls.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: fb4426780390d2a6bd1fced47f867ba46afa3ead
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=fb4426780390d2a6bd1fced47...

Author: Hans Leidekker 
Date:   Tue Apr 20 11:42:19 2021 +0200

wldap32: Fix parsing page controls.

Signed-off-by: Hans Leidekker 
Signed-off-by: Alexandre Julliard

---

dlls/wldap32/page.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/dlls/wldap32/page.c b/dlls/wldap32/page.c
index 471108c636e..8b0ded40e35 100644
--- a/dlls/wldap32/page.c
+++ b/dlls/wldap32/page.c
@@ -20,6 +20,7 @@

#include <stdarg.h>
 #include <stdlib.h>
+#include <limits.h>
 #include "windef.h"
 #include "winbase.h"
 #include "winnls.h"
@@ -31,8 +32,6 @@

WINE_DEFAULT_DEBUG_CHANNEL(wldap32);

-#define LDAP_MAXINT (2^31)
-
 static struct berval null_cookieW = { 0, NULL };

/***********************************************************************
@@ -48,7 +47,7 @@ ULONG CDECL ldap_create_page_controlA( LDAP *ld, ULONG pagesize, struct berval *

TRACE( "(%p, 0x%08x, %p, 0x%02x, %p)\n", ld, pagesize, cookie, critical, control );

-    if (!ld || !control || pagesize > LDAP_MAXINT) return LDAP_PARAM_ERROR;
+    if (!ld || !control || pagesize > INT_MAX) return LDAP_PARAM_ERROR;

ret = ldap_create_page_controlW( ld, pagesize, cookie, critical, &controlW );
     if (ret == LDAP_SUCCESS)
@@ -131,7 +130,7 @@ ULONG CDECL ldap_create_page_controlW( LDAP *ld, ULONG pagesize, struct berval *
 {
     TRACE( "(%p, 0x%08x, %p, 0x%02x, %p)\n", ld, pagesize, cookie, critical, control );

-    if (!ld || !control || pagesize > LDAP_MAXINT) return LDAP_PARAM_ERROR;
+    if (!ld || !control || pagesize > INT_MAX) return LDAP_PARAM_ERROR;
     return create_page_control( pagesize, cookie, critical, control );
 }

@@ -230,18 +229,18 @@ ULONG CDECL ldap_parse_page_controlA( LDAP *ld, LDAPControlA **ctrls, ULONG *cou
 /***********************************************************************
  *      ldap_parse_page_controlW      (WLDAP32.@)
  */
-ULONG CDECL ldap_parse_page_controlW( LDAP *ld, LDAPControlW **ctrls, ULONG *count, struct berval **cookie )
+ULONG CDECL ldap_parse_page_controlW( LDAP *ld, LDAPControlW **ctrls, ULONG *ret_count, struct berval **ret_cookie )
 {
-    ULONG ret;
+    ULONG ret, count;
     LDAPControlW *control = NULL;
     BerElement *ber;
-    struct berval *vec[2];
+    struct berval *cookie = NULL;
     int tag;
     ULONG i;

-    TRACE( "(%p, %p, %p, %p)\n", ld, ctrls, count, cookie );
+    TRACE( "(%p, %p, %p, %p)\n", ld, ctrls, ret_count, ret_cookie );

-    if (!ld || !ctrls || !count || !cookie) return LDAP_PARAM_ERROR;
+    if (!ld || !ctrls || !ret_count || !ret_cookie) return LDAP_PARAM_ERROR;

for (i = 0; ctrls[i]; i++)
     {
@@ -252,13 +251,14 @@ ULONG CDECL ldap_parse_page_controlW( LDAP *ld, LDAPControlW **ctrls, ULONG *cou

if (!(ber = ber_init( &control->ldctl_value ))) return LDAP_NO_MEMORY;

-    vec[0] = *cookie;
-    vec[1] = 0;
-    tag = ber_scanf( ber, (char *)"{iV}", count, vec );
-    if (tag == LBER_ERROR)
-        ret = LDAP_DECODING_ERROR;
+    tag = ber_scanf( ber, (char *)"{iO}", &count, &cookie );
+    if (tag == LBER_ERROR) ret = LDAP_DECODING_ERROR;
     else
+    {
+        *ret_count = count;
+        *ret_cookie = cookie;
         ret = LDAP_SUCCESS;
+    }

ber_free( ber, 1 );
     return ret;