ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ntdll: Fix heap corruption in RtlDeleteAce.

This commit is contained in:
Mike Hearn 2006-05-01 09:08:58 +01:00 committed by Alexandre Julliard
parent aea0b5d0f8
commit 0154704f9f
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
dlls/ntdll/sec.c
View File

@ -1132,15 +1132,20 @@ NTSTATUS WINAPI RtlDeleteAce(PACL pAcl, DWORD dwAceIndex)
PACE_HEADER pcAce;
DWORD len = 0;
/* skip over the ACE we are deleting */
pcAce = (PACE_HEADER)(((BYTE*)pAce)+pAce->AceSize);
dwAceIndex++;
/* calculate the length of the rest */
for (; dwAceIndex < pAcl->AceCount; dwAceIndex++)
{
len += pcAce->AceSize;
pcAce = (PACE_HEADER)(((BYTE*)pcAce) + pcAce->AceSize);
}
memcpy(pAce, ((BYTE*)pAce)+pAce->AceSize, len);
pAcl->AceCount--;
/* slide them all backwards */
memmove(pAce, ((BYTE*)pAce)+pAce->AceSize, len);
pAcl->AceCount--;
}
TRACE("pAcl=%p dwAceIndex=%ld status=0x%08lx\n", pAcl, dwAceIndex, status);