Received: from MTLFS1.montreal.hcl.com ([132.216.79.3]) by krbdev.mit.edu (8.9.3p2) with ESMTP id TAA05685; Wed, 7 Jul 2004 19:01:14 -0400 (EDT) Content-Class: urn:content-classes:message Subject: RE: [krbdev.mit.edu #2622] Problem with LSH_DLGINFO_EX_V1_SZ MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Wed, 7 Jul 2004 19:00:03 -0400 X-Mimeole: Produced By Microsoft Exchange V6.5.6944.0 Message-Id: <88C8B14D74194F409F0E4AEC20DF228411EA83@MTLFS1.montreal.hcl.com> X-MS-Has-Attach: X-MS-Tnef-Correlator: Thread-Topic: [krbdev.mit.edu #2622] Problem with LSH_DLGINFO_EX_V1_SZ Thread-Index: AcRjBU94TD/+PURASICjV1/iy9K7UABb0hBg From: "Pierre Goyette" To: Cc: Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by krbdev.mit.edu id TAA05685 RT-Send-Cc: X-RT-Original-Encoding: us-ascii Content-Length: 1719 Jeff, I thought about this a bit and I believe the fundamental problem is actually with the WM_INITDLG code in lsh_pwd.c. The problem is that the code checks only for two known structure sizes: the original 2.5 size (V1) and the larger 2.6 size (V2). The code should in fact check that the size is at least the V1 structure size or at least the V2 structure size. Consider the problem where the structure gets resized in a future patch. Someone cannot write client code which will work with the new clients and old. If a size larger than required is passed to the API, it should happily take the structure and ignore members it does not know about. The first check should read: if (lpdi->size < LSH_DLGINFO_EX_V1_SZ || lpdi->dlgtype != DLGTYPE_PASSWD) { MessageBox(hDialog, "An incorrect initialization data structure was provided.", "AuthenticateProc()", MB_OK | MB_ICONSTOP); return FALSE; } // Then, the check should be if ( lpdi->size >= sizeof(LSH_DLGINFO_EX) ) { // Access the V2 members safely } If the structure size is large enough to contain the new members, then do what you need to. Comments? Pierre > -----Original Message----- > From: Unprivileged W User,,,, [mailto:www@MIT.EDU] On Behalf > Of Jeffrey Altman via RT > Sent: Monday, July 05, 2004 11:00 PM > To: Pierre Goyette > Subject: [krbdev.mit.edu #2622] Problem with LSH_DLGINFO_EX_V1_SZ > > Actually, why would an application ever be using this value? > > This #define is the value of the old data structure size, not > the new size. Programmers should never be setting the size > to that value. > Programmers should always be setting the size to sizeof(struct ...) > > I am just going to correct the definition. >