Skip to content

Commit d6db7fb

Browse files
committed
[RPCRT4] Fix buffer size calculation bug when unions of pointers are used in RPC interfaces
The size of the transfer buffer was always too small when a parameter of a function was a pointer to a union of pointers. The buffer size calculation function for the union only returned the size of the data the the pointer in the union pointed to, omitting the size of the data for the union itself. This caused a buffer overrun in the following marshal step which makes the RPC call fail. This fix will enable us to remove some workarounds in our RPC interfaces.
1 parent d1f54aa commit d6db7fb

File tree

2 files changed

+20
-1
lines changed

2 files changed

+20
-1
lines changed

dll/win32/rpcrt4/ndr_marshall.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5904,7 +5904,11 @@ static void union_arm_buffer_size(PMIDL_STUB_MESSAGE pStubMsg,
59045904
ERR("BufferLength == 0??\n");
59055905
PointerBufferSize(pStubMsg, *(unsigned char **)pMemory, desc);
59065906
pStubMsg->PointerLength = pStubMsg->BufferLength;
5907+
#ifdef __REACTOS__
5908+
pStubMsg->BufferLength += saved_buffer_length;
5909+
#else
59075910
pStubMsg->BufferLength = saved_buffer_length;
5911+
#endif
59085912
}
59095913
break;
59105914
case FC_IP:

dll/win32/rpcrt4/rpcrt4_ros.diff

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,22 @@ diff -pudN e:\wine\dlls\rpcrt4/cstub.c e:\reactos\dll\win32\rpcrt4/cstub.c
4949
#else
5050

5151
#warning You must implement delegated proxies/stubs for your CPU
52-
52+
diff --git "a/dll/win32/rpcrt4/ndr_marshall.c" "b/dll/win32/rpcrt4/ndr_marshall.c"
53+
index 764b304a047..5fdc1dbd106 100644
54+
--- "a/dll/win32/rpcrt4/ndr_marshall.c"
55+
+++ "b/dll/win32/rpcrt4/ndr_marshall.c"
56+
@@ -5904,7 +5904,11 @@ static void union_arm_buffer_size(PMIDL_STUB_MESSAGE pStubMsg,
57+
ERR("BufferLength == 0??\n");
58+
PointerBufferSize(pStubMsg, *(unsigned char **)pMemory, desc);
59+
pStubMsg->PointerLength = pStubMsg->BufferLength;
60+
+#ifdef __REACTOS__
61+
+ pStubMsg->BufferLength += saved_buffer_length;
62+
+#else
63+
pStubMsg->BufferLength = saved_buffer_length;
64+
+#endif
65+
}
66+
break;
67+
case FC_IP:
5368
diff -pudN e:\wine\dlls\rpcrt4/rpc_epmap.c e:\reactos\dll\win32\rpcrt4/rpc_epmap.c
5469
--- e:\wine\dlls\rpcrt4/rpc_epmap.c 2016-11-16 17:29:34 +0100
5570
+++ e:\reactos\dll\win32\rpcrt4/rpc_epmap.c 2016-11-17 12:09:06 +0100

0 commit comments

Comments
 (0)