Author: tfaber
Date: Sat Jun 1 20:50:13 2013
New Revision: 59134
URL: http://svn.reactos.org/svn/reactos?rev=59134&view=rev
Log:
[NTOS:IO]
- Do not dereference an unsafe ObjectAttributes pointer in IoCreateFile. Spotted by Aleksandar Andrejevic
(I'm removing the OriginalAttributes assignment completely because it's never used, and it generally makes no sense to copy this. ObOpenObjectByName already takes care of everything in attributes)
CORE-7167
Modified:
trunk/reactos/ntoskrnl/io/iomgr/file.c
Modified: trunk/reactos/ntoskrnl/io/iomgr/file.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/io/iomgr/file.c?r…
==============================================================================
--- trunk/reactos/ntoskrnl/io/iomgr/file.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/io/iomgr/file.c [iso-8859-1] Sat Jun 1 20:50:13 2013
@@ -1761,7 +1761,7 @@
SystemEaBuffer = ExAllocatePoolWithTag(NonPagedPool,
EaLength,
TAG_EA);
- if(!SystemEaBuffer)
+ if (!SystemEaBuffer)
{
_SEH2_YIELD(return STATUS_INSUFFICIENT_RESOURCES);
}
@@ -1840,7 +1840,6 @@
RtlZeroMemory(&OpenPacket, sizeof(OPEN_PACKET));
OpenPacket.Type = IO_TYPE_OPEN_PACKET;
OpenPacket.Size = sizeof(OPEN_PACKET);
- OpenPacket.OriginalAttributes = *ObjectAttributes;
OpenPacket.AllocationSize = SafeAllocationSize;
OpenPacket.CreateOptions = CreateOptions;
OpenPacket.FileAttributes = (USHORT)FileAttributes;
Author: akhaldi
Date: Sat Jun 1 18:47:11 2013
New Revision: 59133
URL: http://svn.reactos.org/svn/reactos?rev=59133&view=rev
Log:
[NTOSKRNL]
* Properly fail when the read pointer is out of the file. Brought to you by Sergey Chernov.
CORE-7249 #resolve #comment Committed in r59133. Thanks !
Modified:
trunk/reactos/ntoskrnl/cache/section/io.c
Modified: trunk/reactos/ntoskrnl/cache/section/io.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/cache/section/io.…
==============================================================================
--- trunk/reactos/ntoskrnl/cache/section/io.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/cache/section/io.c [iso-8859-1] Sat Jun 1 18:47:11 2013
@@ -187,7 +187,9 @@
}
DPRINT("Paging IO Done: %08x\n", ReadStatus->Status);
- Status = ReadStatus->Status == STATUS_END_OF_FILE ? STATUS_SUCCESS : ReadStatus->Status;
+ /* When "ReadStatus->Information > 0" is false and "ReadStatus->Status == STATUS_END_OF_FILE" is true
+ * it means that read pointer is out of file, so we must fail */
+ Status = ReadStatus->Status == STATUS_END_OF_FILE && ReadStatus->Information > 0 ? STATUS_SUCCESS : ReadStatus->Status;
return Status;
}