Jeffrey Morlan : netapi32: Fix heap buffer overflows.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: d5f2172c093e0b4cef04fd3d99639c0b7300907c
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=d5f2172c093e0b4cef04fd3d99...

Author: Jeffrey Morlan 
Date:   Sun Oct 11 13:02:40 2009 -0700

netapi32: Fix heap buffer overflows.

---

dlls/netapi32/access.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/dlls/netapi32/access.c b/dlls/netapi32/access.c
index 8a3b8f4..0044035 100644
--- a/dlls/netapi32/access.c
+++ b/dlls/netapi32/access.c
@@ -112,7 +112,7 @@ static BOOL NETAPI_IsCurrentUser(LPCWSTR username)
     BOOL ret = FALSE;

dwSize = LM20_UNLEN+1;
-    curr_user = HeapAlloc(GetProcessHeap(), 0, dwSize);
+    curr_user = HeapAlloc(GetProcessHeap(), 0, dwSize * sizeof(WCHAR));
     if(!curr_user)
     {
         ERR("Failed to allocate memory for user name.\n");
@@ -431,7 +431,7 @@ NetUserGetLocalGroups(LPCWSTR servername, LPCWSTR username, DWORD level,
         return status;

size = UNLEN + 1;
-    NetApiBufferAllocate(size, (LPVOID*)&currentuser);
+    NetApiBufferAllocate(size * sizeof(WCHAR), (LPVOID*)&currentuser);
     GetUserNameW(currentuser, &size);

if (lstrcmpiW(username, currentuser) && NETAPI_FindUser(username))
@@ -640,7 +640,7 @@ NetQueryDisplayInformation(

/* get data */
         dwSize = UNLEN + 1;
-        NetApiBufferAllocate(dwSize, (LPVOID *) &name);
+        NetApiBufferAllocate(dwSize * sizeof(WCHAR), (LPVOID *) &name);
         if (!GetUserNameW(name, &dwSize))
         {
             NetApiBufferFree(name);