windows-backconnectionhostnames-fix-20060809

The previous code failed to specify the correct size of the REG_MULTI_SZ
being written to the registry when appending an additional name to the
list of Back Connection Host names.  This would cause the written string
to contain

   FOO\0B

instead of

   FOO\0\BAR\0\0

this caused problems for Windows 2000 lsass.exe which failed to properly
allocate the buffer for RegQueryValueEx and failed to check that it did
not read beyond the buffer.   If the list was not terminated with two
nuls an exception would be thrown that could result in a lock being
orphaned on the NTLMNameTable.  This would in turn prevent authentications
to UNC resources from completing.  As a result, the startup of
afsd_service.exe would fail if a GlobalAutoMapper drive was configured.

The work around is to set the correct value in the registry before
switching machine names or installing/removing the Microsoft Loopback
Adapter.

diff --git a/src/WINNT/afsd/afsd_init.c b/src/WINNT/afsd/afsd_init.c
index 6c92ae81fface967fdb46e657156793c02453555..75fa0e74c17e625d4935414e3f857490e23d9eb1 100644 (file)
--- a/src/WINNT/afsd/afsd_init.c
+++ b/src/WINNT/afsd/afsd_init.c
@@ -270,7 +270,7 @@ configureBackConnectionHostNames(void)
     HKEY hkMSV10;
     HKEY hkClient;
     DWORD dwType;
-    DWORD dwSize;
+    DWORD dwSize, dwAllocSize;
     DWORD dwValue;
     PBYTE pHostNames = NULL, pName = NULL;
     BOOL  bNameFound = FALSE;   
@@ -283,11 +283,15 @@ configureBackConnectionHostNames(void)
     {
         if (RegQueryValueEx( hkMSV10, "BackConnectionHostNames", 0, 
                             &dwType, NULL, &dwSize) == ERROR_SUCCESS) {
-           dwSize += strlen(cm_NetbiosName) + 1;
-           pHostNames = malloc(dwSize);
+           dwAllocSize += 1 /* in case the source string is not nul terminated */
+               + strlen(cm_NetbiosName) + 2;
+           pHostNames = malloc(dwAllocSize);
+           dwSize = dwAllocSize;
             if (RegQueryValueEx( hkMSV10, "BackConnectionHostNames", 0, &dwType, 
                                 pHostNames, &dwSize) == ERROR_SUCCESS) {
-               for (pName = pHostNames; *pName ; pName += strlen(pName) + 1)
+               for (pName = pHostNames; 
+                    (pName - pHostNames < dwSize) && *pName ; 
+                    pName += strlen(pName) + 1)
                {
                    if ( !stricmp(pName, cm_NetbiosName) ) {
                        bNameFound = TRUE;
@@ -301,7 +305,6 @@ configureBackConnectionHostNames(void)
             size_t size = strlen(cm_NetbiosName) + 2;
             if ( !pHostNames ) {
                 pHostNames = malloc(size);
-               dwSize = size;
                pName = pHostNames;
             }
             StringCbCopyA(pName, size, cm_NetbiosName);
@@ -309,6 +312,7 @@ configureBackConnectionHostNames(void)
             *pName = '\0';  /* add a second nul terminator */
 
             dwType = REG_MULTI_SZ;
+           dwSize = pName - pHostNames + 1;
             RegSetValueEx( hkMSV10, "BackConnectionHostNames", 0, dwType, pHostNames, dwSize);
 
             if ( RegOpenKeyEx( HKEY_LOCAL_MACHINE,