Fix bug with memory allocation for capability SIDs.

googleprojectzero · Aug 15, 2019 · f52e329 · f52e329
1 parent e35f5dd
commit f52e329
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 11 deletions.
diff --git a/NtApiDotNet/NtSecurity.cs b/NtApiDotNet/NtSecurity.cs
@@ -702,15 +702,10 @@ public static bool IsCapabilityGroupSid(Sid sid)
                 sid.SubAuthorities[0] == 32;
         }
 
-        private static int GetSidSize(int rids)
-        {
-            return 8 + rids * 4;
-        }
-
         private static void GetCapabilitySids(string capability_name, out Sid capability_sid, out Sid capability_group_sid)
         {
-            using (SafeHGlobalBuffer cap_sid = new SafeHGlobalBuffer(GetSidSize(9)),
-                    cap_group_sid = new SafeHGlobalBuffer(GetSidSize(10)))
+            using (SafeHGlobalBuffer cap_sid = new SafeHGlobalBuffer(Sid.MaximumSidSize),
+                    cap_group_sid = new SafeHGlobalBuffer(Sid.MaximumSidSize))
             {
                 NtRtl.RtlDeriveCapabilitySidsFromName(
                     new UnicodeString(capability_name),
@@ -727,8 +722,8 @@ private static void GetCapabilitySids(string capability_name, out Sid capability
         /// <returns>The capability SID.</returns>
         public static Sid GetCapabilitySid(string capability_name)
         {
-            using (SafeHGlobalBuffer cap_sid = new SafeHGlobalBuffer(GetSidSize(9)), 
-                cap_group_sid = new SafeHGlobalBuffer(GetSidSize(10)))
+            using (SafeHGlobalBuffer cap_sid = new SafeHGlobalBuffer(Sid.MaximumSidSize), 
+                cap_group_sid = new SafeHGlobalBuffer(Sid.MaximumSidSize))
             {
                 NtRtl.RtlDeriveCapabilitySidsFromName(
                     new UnicodeString(capability_name),
@@ -744,8 +739,8 @@ public static Sid GetCapabilitySid(string capability_name)
         /// <returns>The capability SID.</returns>
         public static Sid GetCapabilityGroupSid(string capability_name)
         {
-            using (SafeHGlobalBuffer cap_sid = new SafeHGlobalBuffer(GetSidSize(9)),
-                cap_group_sid = new SafeHGlobalBuffer(GetSidSize(10)))
+            using (SafeHGlobalBuffer cap_sid = new SafeHGlobalBuffer(Sid.MaximumSidSize),
+                cap_group_sid = new SafeHGlobalBuffer(Sid.MaximumSidSize))
             {
                 NtRtl.RtlDeriveCapabilitySidsFromName(
                     new UnicodeString(capability_name),

diff --git a/NtApiDotNet/Sid.cs b/NtApiDotNet/Sid.cs
@@ -179,6 +179,11 @@ public override string ToString()
     /// </summary>
     public sealed class Sid
     {
+        /// <summary>
+        /// Maximum size of a SID buffer.
+        /// </summary>
+        public const int MaximumSidSize = 256;
+
         /// <summary>
         /// The SIDs authority.
         /// </summary>