Alistair Leslie-Hughes leslie_alistair@hotmail.com writes:
@@ -141,30 +175,56 @@ static HRESULT WINAPI IDirectPlay8PeerImpl_EnumServiceProviders(IDirectPlay8Peer else { FIXME("Application requested a provider we don't handle (yet)\n");
*pcReturned = 0; return DPNERR_DOESNOTEXIST;}
if(*pcbEnumData < req_size) {
RegCloseKey(key); }*pcbEnumData = req_size; return DPNERR_BUFFERTOOSMALL;
- pSPInfoBuffer->pwszName = (LPWSTR)(pSPInfoBuffer + 1);
- if(!pguidServiceProvider) {
lstrcpyW(pSPInfoBuffer->pwszName, dp_providerW);pSPInfoBuffer->guid = CLSID_DP8SP_TCPIP;
int offset = 1;int count = 0;LPWSTR infoend = ((LPWSTR)pSPInfoBuffer + (sizeof(DPN_SERVICE_PROVIDER_INFO) * (*pcReturned)));index = 0;nextKeyNameResult = RegEnumKeyW( key, index, provider, MAX_PATH);while(nextKeyNameResult == ERROR_SUCCESS){DWORD dwBufLen = 350;WCHAR name[350];res = RegGetValueW( key, provider, friendly, RRF_RT_REG_SZ, NULL, name, &dwBufLen);if(res == ERROR_SUCCESS){pSPInfoBuffer[count].guid = CLSID_DP8SP_TCPIP;pSPInfoBuffer[count].pwszName = (LPWSTR)(infoend + offset);lstrcpyW(pSPInfoBuffer[count].pwszName, name);offset += dwBufLen/sizeof(WCHAR);count++;}index++;nextKeyNameResult = RegEnumKeyW( key, index, provider, MAX_PATH );}
The buffer sizes and pointers are pretty much all handled incorrectly.