SeValidSecurityDescriptor
UINT8 __stdcall SeValidSecurityDescriptor(UINT64 Length, VOID *SecurityDescriptor){
unsigned int v3;
__int64 v4;
int v5;
__int64 v6;
int v7;
__int64 v8;
unsigned int v9;
ACL *v10;
__int64 v11;
unsigned int v13;
ACL *v14;
v3 = Length;
if( (unsigned int)Length < 0x14 )
return 0;
if( *(_BYTE *)SecurityDescriptor != 1 )
return 0;
if( *((__int16 *)SecurityDescriptor + 1) >= 0 )
return 0;
v4 = *((unsigned int *)SecurityDescriptor + 1);
if( !(_DWORD)v4 )
return 0;
if( ((v4 + 3) & 0xFFFFFFFFFFFFFFFCui64) != v4 )
return 0;
if( (unsigned int)v4 > v3 )
return 0;
if( v3 - (unsigned int)v4 < 0xC )
return 0;
if( *((_BYTE *)SecurityDescriptor + v4) != 1 )
return 0;
v5 = *((unsigned __int8 *)SecurityDescriptor + v4 + 1);
if( (unsigned __int8)v5 > 0xFu )
return 0;
if( v3 - (unsigned int)v4 < 4 * v5 + 8 )
return 0;
v6 = *((unsigned int *)SecurityDescriptor + 2);
if( (_DWORD)v6 )
{
if( ((v6 + 3) & 0xFFFFFFFFFFFFFFFCui64) != v6 )
return 0;
if( (unsigned int)v6 > v3 )
return 0;
if( v3 - (unsigned int)v6 < 0xC )
return 0;
if( *((_BYTE *)SecurityDescriptor + v6) != 1 )
return 0;
v7 = *((unsigned __int8 *)SecurityDescriptor + v6 + 1);
if( (unsigned __int8)v7 > 0xFu || v3 - (unsigned int)v6 < 4 * v7 + 8 )
return 0;
}
if( ((v8 = *((unsigned int *)SecurityDescriptor + 4), !(_DWORD)v8)
|| ((v8 + 3) & 0xFFFFFFFFFFFFFFFCui64) == v8
&& (unsigned int)v8 <= v3
&& (v9 = v3 - v8, v3 - (unsigned int)v8 >= 8)
&& (v10 = (ACL *)((char *)SecurityDescriptor + v8), v9 >= v10->AclSize)
&& RtlValidAcl(v10))
&& ((v11 = *((unsigned int *)SecurityDescriptor + 3), !(_DWORD)v11)
|| ((v11 + 3) & 0xFFFFFFFFFFFFFFFCui64) == v11
&& (unsigned int)v11 <= v3
&& (v13 = v3 - v11, v13 >= 8)
&& (v14 = (ACL *)((char *)SecurityDescriptor + v11), v13 >= v14->AclSize)
&& RtlValidAcl(v14)) )
{
return 1;
}
else
{
return 0;
}
}Referenced by:
EtwpGetGuidSecurityDescriptor
PiSwValidateCreateData
RtlNormalizeSecurityDescriptor
SepReadAndPopulateCapes
WmipSDRegistryQueryRoutine