Andrew Talbot : netapi32: Fix some limits and bounds checking.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 05c283246c5c30c50bf0f4f58602e0b3a55c9980
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=05c283246c5c30c50bf0f4f586...

Author: Andrew Talbot 
Date:   Mon Jan 19 17:34:54 2009 +0000

netapi32: Fix some limits and bounds checking.

---

dlls/netapi32/nbt.c |   16 ++++++++--------
 1 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/dlls/netapi32/nbt.c b/dlls/netapi32/nbt.c
index 8db87b4..5042baa 100644
--- a/dlls/netapi32/nbt.c
+++ b/dlls/netapi32/nbt.c
@@ -103,8 +103,8 @@ WINE_DEFAULT_DEBUG_CHANNEL(netbios);
 #define MIN_CACHE_TIMEOUT   60000
 #define CACHE_TIMEOUT       360000

-#define MAX_NBT_NAME_SZ (NCBNAMSZ * 2 + MAX_DOMAIN_NAME_LEN + 2)
-#define SIMPLE_NAME_QUERY_PKT_SIZE 26 + MAX_NBT_NAME_SZ
+#define MAX_NBT_NAME_SZ            255
+#define SIMPLE_NAME_QUERY_PKT_SIZE 16 + MAX_NBT_NAME_SZ

#define DEFAULT_NBT_SESSIONS 16

@@ -156,7 +156,7 @@ static DWORD gWINSQueries;
 static DWORD gWINSQueryTimeout;
 static DWORD gWINSServers[MAX_WINS_SERVERS];
 static int   gNumWINSServers;
-static char  gScopeID[MAX_DOMAIN_NAME_LEN];
+static char  gScopeID[MAX_SCOPE_ID_LEN];
 static DWORD gCacheTimeout;
 static struct NBNameCache *gNameCache;

@@ -1493,7 +1493,7 @@ void NetBTInit(void)
          (LPBYTE)&dword, &size) == ERROR_SUCCESS && dword >= MIN_QUERY_TIMEOUT
          && dword <= MAX_QUERY_TIMEOUT)
             gWINSQueryTimeout = dword;
-        size = MAX_DOMAIN_NAME_LEN - 1;
+        size = sizeof(gScopeID) - 1;
         if (RegQueryValueExW(hKey, ScopeIDW, NULL, NULL, (LPBYTE)gScopeID + 1, &size)
          == ERROR_SUCCESS)
         {
@@ -1501,11 +1501,11 @@ void NetBTInit(void)
                NetBTNameEncode */
             char *ptr, *lenPtr;

-            for (ptr = gScopeID + 1; *ptr &&
-             ptr - gScopeID < MAX_DOMAIN_NAME_LEN; )
+            for (ptr = gScopeID + 1; ptr - gScopeID < sizeof(gScopeID) && *ptr; )
             {
-                for (lenPtr = ptr - 1, *lenPtr = 0; *ptr && *ptr != '.' &&
-                 ptr - gScopeID < MAX_DOMAIN_NAME_LEN; ptr++)
+                for (lenPtr = ptr - 1, *lenPtr = 0;
+                     ptr - gScopeID < sizeof(gScopeID) && *ptr && *ptr != '.';
+                     ptr++)
                     *lenPtr += 1;
                 ptr++;
             }