[LSASRV]

Fix memory related issues in calls to LsaEnumerateLogonSessions.
- Initialize ClientBaseAddress to NULL because we do not need to allocate a fixed memory page.
- Protect Length from being overwitten by NtWriteVirtualMemory.

svn path=/trunk/; revision=64318

diff --git a/reactos/dll/win32/lsasrv/session.c b/reactos/dll/win32/lsasrv/session.c
index 6edbf0d..25bc1a0 100644 (file)
--- a/reactos/dll/win32/lsasrv/session.c
+++ b/reactos/dll/win32/lsasrv/session.c
@@ -131,8 +131,8 @@ LsapEnumLogonSessions(IN OUT PLSA_API_MSG RequestMsg)
     PLIST_ENTRY SessionEntry;
     PLSAP_LOGON_SESSION CurrentSession;
     PLUID SessionList;
-    ULONG i, Length;
-    PVOID ClientBaseAddress;
+    ULONG i, Length, MemSize;
+    PVOID ClientBaseAddress = NULL;
     NTSTATUS Status;
 
     TRACE("LsapEnumLogonSessions()\n");
@@ -175,10 +175,11 @@ LsapEnumLogonSessions(IN OUT PLSA_API_MSG RequestMsg)
         goto done;
     }
 
+    MemSize = Length;
     Status = NtAllocateVirtualMemory(ProcessHandle,
                                      &ClientBaseAddress,
                                      0,
-                                     &Length,
+                                     &MemSize,
                                      MEM_COMMIT,
                                      PAGE_READWRITE);
     if (!NT_SUCCESS(Status))