NetApiBufferFree returns ERROR_INVALID_PARAMETER (Error Code 87)

Question

I have been developing an application that uses winapi to get administrator group members. I used NetLocalGroupGetMembers method for that purpose. My problem is when i try to free buffer's heap space i get ERROR_INVALID_PARAMETER (Error Code 87) from NetApiBufferFree method. I have administrator privileges for the application.

Here is the code:

#include <stdio.h>
#include <windows.h>
#include <process.h>
#include <lm.h>
#include <time.h>
#include <assert.h>

#define SLEEP_TIME 2000
#define OS_GROUP_NAME L"administrators"

void createServiceThread();
DWORD WINAPI mainServiceThread( LPVOID lpParam );
char** getUsersByLocalGroup();
void freeNetApiBuffer(LPVOID buffer);

int localGroupUserCount;

int WriteToLog(char* str)
{
    printf("%s\n", str);
    return 0;
}

int main() 
{ 
    createServiceThread();  
}

void createServiceThread(){
    WriteToLog("Application Started...");
    while(TRUE){
        mainServiceThread(NULL);

        Sleep(SLEEP_TIME);
    }
    WriteToLog("Application Closed...");
}

//-------------------------------------------
// A function that represents Main Service Thread
//-------------------------------------------
DWORD WINAPI mainServiceThread( LPVOID lpParam ) 
{
    time_t startTime;
    time (&startTime);
    char startTimeText[30];
    sprintf(startTimeText, "Service Loop Started %s", ctime(&startTime));
    WriteToLog(startTimeText);
    localGroupUserCount = 0;

    char** localGroupUsers = getUsersByLocalGroup();

    WriteToLog("User not found...");

    time_t endTime;
    time (&endTime);
    char endTimeText[30];
    sprintf(endTimeText, "Service Loop Ended %s", ctime(&endTime));
    WriteToLog(endTimeText);
}

char** getUsersByLocalGroup(){
    WriteToLog("getUsersByLocalGroup started");
    LOCALGROUP_MEMBERS_INFO_3 *pBuf;
    DWORD dwLevel = 3;
    DWORD dwPrefMaxLen = MAX_PREFERRED_LENGTH;
    DWORD dwEntriesRead = 0;
    DWORD dwTotalEntries = 0;
    DWORD dwResumeHandle = 0;
    NET_API_STATUS nStatus;

    WriteToLog("Call NetLocalGroupGetMembers"); 
    nStatus = NetLocalGroupGetMembers(
        NULL,
        OS_GROUP_NAME,
        dwLevel,
        (LPBYTE *) &pBuf,
        dwPrefMaxLen,
        &dwEntriesRead,
        &dwTotalEntries,
        NULL
    );  
//  nStatus = ERROR_SUCCESS;
    WriteToLog("NetLocalGroupGetMembers called");
    //
    // If the call succeeds,
    //
    if (nStatus == ERROR_SUCCESS  || nStatus == ERROR_MORE_DATA)
    {
        DWORD i;
        DWORD dwTotalCount = 0;
        WriteToLog("Correct Status");
        if (pBuf != NULL)
        {
            //
            // Loop through the entries.
            //
            for (i = 0; (i < dwEntriesRead); i++)
            {
                assert(pBuf != NULL);

                if (pBuf == NULL)
                {
                    char bufError[] = "";
                    sprintf(bufError, "An access violation has occurred %d", stderr);
                    WriteToLog(bufError);
                    break;
                }
                LPWSTR userNameOnBuffer = pBuf->lgrmi3_domainandname;
                pBuf++;
                dwTotalCount++;     
            }
            localGroupUserCount = dwTotalCount;
            char totalCount[] = "";
            sprintf(totalCount, "Entries enumerated: %d", dwTotalCount);
            WriteToLog(totalCount); 
        }
        //
        // Otherwise, print the system error.
        //
        else{
        char systemError[] = "";
        sprintf(systemError, "An system error has occurred %d - %d", stderr, nStatus);
        WriteToLog(systemError);
        }
    }
    //
    // Free the allocated buffer.
    //  
    if (pBuf != NULL)
    {
        NET_API_STATUS nBufferFreeStatus = NetApiBufferFree((LPVOID)pBuf);
        if(nBufferFreeStatus == NERR_Success){
            WriteToLog("Succesfully freed buffer");
        }
        else{
            WriteToLog("Error occured freeing buffer");
        }
        pBuf = NULL;
    }
    WriteToLog("getUsersByLocalGroup finished");
    return NULL;
}

Answer 1

In your loop you have the line pBuf++; . This modifies pBuf which means that the value you are freeing is not the value that was allocated. Hence the invalid parameter.

Also, these lines

char totalCount[] = "";
sprintf(totalCount, "Entries enumerated: %d", dwTotalCount);

create a stack buffer overflow, which is probably corrupting your pBuf variable. There is another instance of it a few lines later.

In general, here's how you debug it: Set a breakpoint as soon as NetLocalGroupGetMembers returns. Look at the value in pBuf and write it down in a safe place. Set another breakpoint when you are about to call NetApiBufferFree . Look at the value of pBuf you are passing. Is it equal to the value you wrote down earlier? If not, then you have a bug. Use the debugger to find out why you are passing the wrong value.