Author: hbelusca
Date: Sun Oct 6 14:20:18 2013
New Revision: 60561
URL: http://svn.reactos.org/svn/reactos?rev=60561&view=rev
Log:
[CSRSRV]: In CsrCaptureArguments, be sure that the number of captured pointers is at most equal to MAXUSHORT (and not the total length of the captured buffer).
Modified:
trunk/reactos/subsystems/win32/csrsrv/api.c
Modified: trunk/reactos/subsystems/win32/csrsrv/api.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrsrv/ap…
==============================================================================
--- trunk/reactos/subsystems/win32/csrsrv/api.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrsrv/api.c [iso-8859-1] Sun Oct 6 14:20:18 2013
@@ -1153,7 +1153,7 @@
/* Check if the Length is valid */
if ((FIELD_OFFSET(CSR_CAPTURE_BUFFER, PointerOffsetsArray) +
(LocalCaptureBuffer->PointerCount * sizeof(PVOID)) > Length) ||
- (Length > MAXWORD))
+ (LocalCaptureBuffer->PointerCount > MAXUSHORT))
{
/* Return failure */
DPRINT1("*** CSRSS: CaptureBuffer %p has bad length\n", LocalCaptureBuffer);
Author: hbelusca
Date: Sun Oct 6 13:33:17 2013
New Revision: 60560
URL: http://svn.reactos.org/svn/reactos?rev=60560&view=rev
Log:
[CSR]
During my investigations for making working Win2k3 csrsrv.dll (or other CSR servers) into ROS (to compare our behaviour with our own csrsrv.dll and Win2k3 one), I hit a problem: if I test a checked-build version of csrsrv (or other CSR servers), everything was fine when they were loaded, but if I use a release-build version (i.e. without any debug information), I systematically hit a memory access violation which was traced back to the moment when a CSR server's CsrInitialization entry point was called.
So I did the experiment, where I used our (debug-build) csrsrv with a free-build win2k3 CSR server dll (it was winsrv.dll, and I retested with basesrv.dll after). I hit the access violation. But if I took a debug-build version of winsrv.dll, everything was OK.
I then added in our csrsrv' server.c file the following line (around line 212 of the current file version):
DPRINT1("%s ; ServerDll->ValidTable = 0x%p ; ServerDll->NameTable = 0x%p ; ServerDll->SizeOfProcessData = %d ; ServerDll->ConnectCallback = 0x%p\n", DllString, ServerDll->ValidTable, ServerDll->NameTable, ServerDll->SizeOfProcessData, ServerDll->ConnectCallback);
and I saw that, when using a debug-build win2k3 CSR server, everything was fine (in particular the ServerDll->SizeOfProcessData member contained a reasonable value, e.g. a size of 88 bytes), whereas if I used a free-build version, I got an off-by-one problem, with the ServerDll->ValidTable pointer valid but the ServerDll->NameTable member being equal to 88 (i.e. invalid pointer) and the ServerDll->SizeOfProcessData member being equal to a very large value, which looked like a pointer value.
After more investigations, I saw that in debug-build CSR servers the list of API names were stored, whereas it was not the case in free-build versions. Therefore I concluded that the API names table was included *ONLY* in debug builds and not in release builds.
Hence, to be able to test in ROS either debug-builds or release-builds versions of Windows CSR servers in ROS (and vice-versa), I introduced a #define called CSR_DBG, which is defined only if the DBG macro is != 0, and which is not defined otherwise. When the CSR_DBG flag is defined, API names tables are added in CSR servers and otherwise, they are not.
Therefore, we are now able to test debug-build Windows CSR servers in ROS (the default possibility) or free-build versions of these CSR servers (but first, we have to build the other ones without the CSR_DBG flag, to avoid the off-by-one problem described above).
Modified:
trunk/reactos/include/reactos/subsys/csr/csrsrv.h
trunk/reactos/subsystems/win/basesrv/init.c
trunk/reactos/subsystems/win32/csrsrv/api.c
trunk/reactos/subsystems/win32/csrsrv/api.h
trunk/reactos/subsystems/win32/csrsrv/init.c
trunk/reactos/subsystems/win32/csrsrv/server.c
trunk/reactos/win32ss/user/winsrv/consrv/init.c
trunk/reactos/win32ss/user/winsrv/usersrv/init.c
Modified: trunk/reactos/include/reactos/subsys/csr/csrsrv.h
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/subsys/csr…
==============================================================================
--- trunk/reactos/include/reactos/subsys/csr/csrsrv.h [iso-8859-1] (original)
+++ trunk/reactos/include/reactos/subsys/csr/csrsrv.h [iso-8859-1] Sun Oct 6 13:33:17 2013
@@ -9,6 +9,14 @@
#ifndef _CSRSRV_H
#define _CSRSRV_H
+
+/*
+ * The CSR_DBG macro is defined for building CSR Servers
+ * with extended debugging information.
+ */
+#if DBG
+#define CSR_DBG
+#endif
#include "csrmsg.h"
@@ -215,7 +223,14 @@
ULONG HighestApiSupported;
PCSR_API_ROUTINE *DispatchTable;
PBOOLEAN ValidTable; // Table of booleans which describe whether or not a server function call is valid when it is called via CsrCallServerFromServer.
+/*
+ * On Windows Server 2003, CSR Servers contain
+ * the API Names Table only in Debug Builds.
+ */
+#ifdef CSR_DBG
PCHAR *NameTable;
+#endif
+
ULONG SizeOfProcessData;
PCSR_CONNECT_CALLBACK ConnectCallback;
PCSR_DISCONNECT_CALLBACK DisconnectCallback;
@@ -226,7 +241,11 @@
ULONG Unknown2[3];
} CSR_SERVER_DLL, *PCSR_SERVER_DLL;
#ifndef _WIN64
-C_ASSERT(FIELD_OFFSET(CSR_SERVER_DLL, SharedSection) == 0x3C);
+ #ifdef CSR_DBG
+ C_ASSERT(FIELD_OFFSET(CSR_SERVER_DLL, SharedSection) == 0x3C);
+ #else
+ C_ASSERT(FIELD_OFFSET(CSR_SERVER_DLL, SharedSection) == 0x38);
+ #endif
#endif
typedef
Modified: trunk/reactos/subsystems/win/basesrv/init.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win/basesrv/ini…
==============================================================================
--- trunk/reactos/subsystems/win/basesrv/init.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win/basesrv/init.c [iso-8859-1] Sun Oct 6 13:33:17 2013
@@ -97,6 +97,11 @@
TRUE, // BaseSrvNlsGetUserInfo
};
+/*
+ * On Windows Server 2003, CSR Servers contain
+ * the API Names Table only in Debug Builds.
+ */
+#ifdef CSR_DBG
PCHAR BaseServerApiNameTable[BasepMaxApiNumber - BASESRV_FIRST_API_NUMBER] =
{
"BaseCreateProcess",
@@ -131,6 +136,7 @@
"BaseRegisterThread",
"BaseNlsGetUserInfo",
};
+#endif
/* FUNCTIONS ******************************************************************/
@@ -567,7 +573,9 @@
LoadedServerDll->HighestApiSupported = BasepMaxApiNumber;
LoadedServerDll->DispatchTable = BaseServerApiDispatchTable;
LoadedServerDll->ValidTable = BaseServerApiServerValidTable;
+#ifdef CSR_DBG
LoadedServerDll->NameTable = BaseServerApiNameTable;
+#endif
LoadedServerDll->SizeOfProcessData = 0;
LoadedServerDll->ConnectCallback = NULL;
LoadedServerDll->DisconnectCallback = NULL;
Modified: trunk/reactos/subsystems/win32/csrsrv/api.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrsrv/ap…
==============================================================================
--- trunk/reactos/subsystems/win32/csrsrv/api.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrsrv/api.c [iso-8859-1] Sun Oct 6 13:33:17 2013
@@ -77,23 +77,27 @@
{
/* We are beyond the Maximum API ID, or it doesn't exist */
DPRINT1("API: %d\n", ApiId);
+#ifdef CSR_DBG
DPRINT1("CSRSS: %lx (%s) is invalid ApiTableIndex for %Z or is an "
"invalid API to call from the server.\n",
ApiId,
((ServerDll->NameTable) && (ServerDll->NameTable[ApiId])) ?
ServerDll->NameTable[ApiId] : "*** UNKNOWN ***",
&ServerDll->Name);
+#endif
// DbgBreakPoint();
ReplyMsg->Status = STATUS_ILLEGAL_FUNCTION;
return STATUS_ILLEGAL_FUNCTION;
}
}
+#ifdef CSR_DBG
if (CsrDebug & 2)
{
DPRINT1("CSRSS: %s Api Request received from server process\n",
ServerDll->NameTable[ApiId]);
}
+#endif
/* Validation complete, start SEH */
_SEH2_TRY
@@ -577,6 +581,7 @@
continue;
}
+#ifdef CSR_DBG
if (CsrDebug & 2)
{
DPRINT1("[%02x] CSRSS: [%02x,%02x] - %s Api called from %08x\n",
@@ -586,6 +591,7 @@
ServerDll->NameTable[ApiId],
NULL);
}
+#endif
/* Assume success */
ReceiveMsg.Status = STATUS_SUCCESS;
@@ -781,6 +787,7 @@
continue;
}
+#ifdef CSR_DBG
if (CsrDebug & 2)
{
DPRINT1("[%02x] CSRSS: [%02x,%02x] - %s Api called from %08x, Process %08x - %08x\n",
@@ -792,6 +799,7 @@
CsrThread->Process,
CsrProcess);
}
+#endif
/* Assume success */
ReplyMsg = &ReceiveMsg;
Modified: trunk/reactos/subsystems/win32/csrsrv/api.h
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrsrv/ap…
==============================================================================
--- trunk/reactos/subsystems/win32/csrsrv/api.h [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrsrv/api.h [iso-8859-1] Sun Oct 6 13:33:17 2013
@@ -40,6 +40,9 @@
#define CSR_SERVER_DLL_MAX 4
+
+// Debug Flag
+extern ULONG CsrDebug;
extern HANDLE hBootstrapOk;
extern HANDLE CsrApiPort;
@@ -49,7 +52,6 @@
extern LIST_ENTRY CsrThreadHashTable[NUMBER_THREAD_HASH_BUCKETS];
extern PCSR_PROCESS CsrRootProcess;
extern UNICODE_STRING CsrDirectoryName;
-extern ULONG CsrDebug;
extern ULONG CsrTotalPerProcessDataLength;
extern SYSTEM_BASIC_INFORMATION CsrNtSysInfo;
extern HANDLE CsrHeap;
Modified: trunk/reactos/subsystems/win32/csrsrv/init.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrsrv/in…
==============================================================================
--- trunk/reactos/subsystems/win32/csrsrv/init.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrsrv/init.c [iso-8859-1] Sun Oct 6 13:33:17 2013
@@ -15,6 +15,9 @@
#include <debug.h>
/* DATA ***********************************************************************/
+
+// Debug Flag
+ULONG CsrDebug = 0; // 0xFFFFFFFF;
HANDLE CsrHeap = NULL;
HANDLE CsrObjectDirectory = NULL;
@@ -25,7 +28,6 @@
HANDLE CsrSmApiPort = NULL;
HANDLE hSbApiPort = NULL;
HANDLE CsrApiPort = NULL;
-ULONG CsrDebug = 0; // 0xFFFFFFFF;
ULONG CsrMaxApiRequestThreads;
ULONG CsrTotalPerProcessDataLength;
ULONG SessionId;
Modified: trunk/reactos/subsystems/win32/csrsrv/server.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrsrv/se…
==============================================================================
--- trunk/reactos/subsystems/win32/csrsrv/server.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrsrv/server.c [iso-8859-1] Sun Oct 6 13:33:17 2013
@@ -15,6 +15,13 @@
/* DATA ***********************************************************************/
+PCSR_SERVER_DLL CsrLoadedServerDll[CSR_SERVER_DLL_MAX];
+PVOID CsrSrvSharedSectionHeap = NULL;
+PVOID CsrSrvSharedSectionBase = NULL;
+PVOID *CsrSrvSharedStaticServerData = NULL;
+ULONG CsrSrvSharedSectionSize = 0;
+HANDLE CsrSrvSharedSection = NULL;
+
PCSR_API_ROUTINE CsrServerApiDispatchTable[CsrpMaxApiNumber] =
{
CsrSrvClientConnect,
@@ -33,6 +40,11 @@
TRUE
};
+/*
+ * On Windows Server 2003, CSR Servers contain
+ * the API Names Table only in Debug Builds.
+ */
+#ifdef CSR_DBG
PCHAR CsrServerApiNameTable[CsrpMaxApiNumber] =
{
"ClientConnect",
@@ -41,13 +53,7 @@
"IdentifyAlertableThread",
"SetPriorityClass"
};
-
-PCSR_SERVER_DLL CsrLoadedServerDll[CSR_SERVER_DLL_MAX];
-PVOID CsrSrvSharedSectionHeap = NULL;
-PVOID CsrSrvSharedSectionBase = NULL;
-PVOID *CsrSrvSharedStaticServerData = NULL;
-ULONG CsrSrvSharedSectionSize = 0;
-HANDLE CsrSrvSharedSection = NULL;
+#endif
/* PRIVATE FUNCTIONS **********************************************************/
@@ -73,7 +79,9 @@
LoadedServerDll->HighestApiSupported = CsrpMaxApiNumber;
LoadedServerDll->DispatchTable = CsrServerApiDispatchTable;
LoadedServerDll->ValidTable = CsrServerApiServerValidTable;
+#ifdef CSR_DBG
LoadedServerDll->NameTable = CsrServerApiNameTable;
+#endif
LoadedServerDll->SizeOfProcessData = 0;
LoadedServerDll->ConnectCallback = NULL;
LoadedServerDll->DisconnectCallback = NULL;
Modified: trunk/reactos/win32ss/user/winsrv/consrv/init.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/winsrv/consrv…
==============================================================================
--- trunk/reactos/win32ss/user/winsrv/consrv/init.c [iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/winsrv/consrv/init.c [iso-8859-1] Sun Oct 6 13:33:17 2013
@@ -218,6 +218,11 @@
// FALSE, // SrvConsoleClientConnect,
};
+/*
+ * On Windows Server 2003, CSR Servers contain
+ * the API Names Table only in Debug Builds.
+ */
+#ifdef CSR_DBG
PCHAR ConsoleServerApiNameTable[ConsolepMaxApiNumber - CONSRV_FIRST_API_NUMBER] =
{
"OpenConsole",
@@ -313,7 +318,7 @@
// "SetScreenBufferInfo",
// "ConsoleClientConnect",
};
-
+#endif
/* FUNCTIONS ******************************************************************/
@@ -532,7 +537,9 @@
LoadedServerDll->HighestApiSupported = ConsolepMaxApiNumber;
LoadedServerDll->DispatchTable = ConsoleServerApiDispatchTable;
LoadedServerDll->ValidTable = ConsoleServerApiServerValidTable;
+#ifdef CSR_DBG
LoadedServerDll->NameTable = ConsoleServerApiNameTable;
+#endif
LoadedServerDll->SizeOfProcessData = sizeof(CONSOLE_PROCESS_DATA);
LoadedServerDll->ConnectCallback = ConSrvConnect;
LoadedServerDll->DisconnectCallback = ConSrvDisconnect;
Modified: trunk/reactos/win32ss/user/winsrv/usersrv/init.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/winsrv/usersr…
==============================================================================
--- trunk/reactos/win32ss/user/winsrv/usersrv/init.c [iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/winsrv/usersrv/init.c [iso-8859-1] Sun Oct 6 13:33:17 2013
@@ -57,6 +57,11 @@
// FALSE, // SrvGetSetShutdownBlockReason
};
+/*
+ * On Windows Server 2003, CSR Servers contain
+ * the API Names Table only in Debug Builds.
+ */
+#ifdef CSR_DBG
PCHAR UserServerApiNameTable[UserpMaxApiNumber - USERSRV_FIRST_API_NUMBER] =
{
"SrvExitWindowsEx",
@@ -73,7 +78,7 @@
// "SrvConsoleHandleOperation",
// "SrvGetSetShutdownBlockReason",
};
-
+#endif
/* FUNCTIONS ******************************************************************/
@@ -291,7 +296,9 @@
LoadedServerDll->HighestApiSupported = UserpMaxApiNumber;
LoadedServerDll->DispatchTable = UserServerApiDispatchTable;
LoadedServerDll->ValidTable = UserServerApiServerValidTable;
+#ifdef CSR_DBG
LoadedServerDll->NameTable = UserServerApiNameTable;
+#endif
LoadedServerDll->SizeOfProcessData = 0;
LoadedServerDll->ConnectCallback = NULL;
LoadedServerDll->DisconnectCallback = NULL;