Ros-diffs November 2016

ros-diffs@reactos.org

15 participants
317 discussions

[hbelusca] 73170: [NTOS:IO]: IopCreateDriver(): Set the returned DriverObject value only in case of success.

by hbelusca＠svn.reactos.org

Author: hbelusca Date: Mon Nov 7 15:51:56 2016 New Revision: 73170 URL: http://svn.reactos.org/svn/reactos?rev=73170&view=rev Log: [NTOS:IO]: IopCreateDriver(): Set the returned DriverObject value only in case of success. Modified: trunk/reactos/ntoskrnl/io/iomgr/driver.c Modified: trunk/reactos/ntoskrnl/io/iomgr/driver.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/io/iomgr/driver.c… ============================================================================== --- trunk/reactos/ntoskrnl/io/iomgr/driver.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/io/iomgr/driver.c [iso-8859-1] Mon Nov 7 15:51:56 2016 @@ -527,12 +527,13 @@ RtlFreeUnicodeString(&RegistryKey); RtlFreeUnicodeString(&DriverName); - *DriverObject = Driver; if (!NT_SUCCESS(Status)) { DPRINT("IopCreateDriver() failed (Status 0x%08lx)\n", Status); return Status; } + + *DriverObject = Driver; MmFreeDriverInitialization((PLDR_DATA_TABLE_ENTRY)Driver->DriverSection); @@ -1426,7 +1427,7 @@ &DriverReinitListLock); while (Entry) { - /* Get the item*/ + /* Get the item */ ReinitItem = CONTAINING_RECORD(Entry, DRIVER_REINIT_ITEM, ItemEntry); /* Increment reinitialization counter */ @@ -1462,7 +1463,7 @@ &DriverBootReinitListLock); while (Entry) { - /* Get the item*/ + /* Get the item */ ReinitItem = CONTAINING_RECORD(Entry, DRIVER_REINIT_ITEM, ItemEntry); /* Increment reinitialization counter */ @@ -1510,7 +1511,7 @@ /* First, create a unique name for the driver if we don't have one */ if (!DriverName) { - /* Create a random name and set up the string*/ + /* Create a random name and set up the string */ NameLength = (USHORT)swprintf(NameBuffer, DRIVER_ROOT_NAME L"%08u", KeTickCount.LowPart);

8 years, 1 month

[hbelusca] 73169: [TCPIP] - Enable logging now that IoWriteErrorLogEntry works. - Check for log event size before calling IoAllocateErrorLogEntry. - Reduce code indentation in the logging function.

by hbelusca＠svn.reactos.org

Author: hbelusca Date: Mon Nov 7 15:48:34 2016 New Revision: 73169 URL: http://svn.reactos.org/svn/reactos?rev=73169&view=rev Log: [TCPIP] - Enable logging now that IoWriteErrorLogEntry works. - Check for log event size before calling IoAllocateErrorLogEntry. - Reduce code indentation in the logging function. Modified: trunk/reactos/drivers/network/tcpip/tcpip/main.c Modified: trunk/reactos/drivers/network/tcpip/tcpip/main.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/network/tcpip/tcpi… ============================================================================== --- trunk/reactos/drivers/network/tcpip/tcpip/main.c [iso-8859-1] (original) +++ trunk/reactos/drivers/network/tcpip/tcpip/main.c [iso-8859-1] Mon Nov 7 15:48:34 2016 @@ -50,7 +50,6 @@ * DumpData = Pointer to dump data for the log entry */ { -#if 0 PIO_ERROR_LOG_PACKET LogEntry; UCHAR EntrySize; ULONG StringSize; @@ -65,35 +64,37 @@ EntrySize += (UCHAR)StringSize; } - LogEntry = (PIO_ERROR_LOG_PACKET)IoAllocateErrorLogEntry( - DriverContext, EntrySize); - - if (LogEntry) { - LogEntry->MajorFunctionCode = -1; - LogEntry->RetryCount = -1; - LogEntry->DumpDataSize = (USHORT)(DumpDataCount * sizeof(ULONG)); - LogEntry->NumberOfStrings = (String == NULL) ? 1 : 2; - LogEntry->StringOffset = sizeof(IO_ERROR_LOG_PACKET) + (DumpDataCount-1) * sizeof(ULONG); - LogEntry->EventCategory = 0; - LogEntry->ErrorCode = ErrorCode; - LogEntry->UniqueErrorValue = UniqueErrorValue; - LogEntry->FinalStatus = FinalStatus; - LogEntry->SequenceNumber = -1; - LogEntry->IoControlCode = 0; - - if (DumpDataCount) - RtlCopyMemory(LogEntry->DumpData, DumpData, DumpDataCount * sizeof(ULONG)); - - pString = ((PUCHAR)LogEntry) + LogEntry->StringOffset; - RtlCopyMemory(pString, DriverName, sizeof(DriverName)); - pString += sizeof(DriverName); - - if (String) - RtlCopyMemory(pString, String, StringSize); - - IoWriteErrorLogEntry(LogEntry); - } -#endif + /* Fail if the required error log entry is too large */ + if (EntrySize > ERROR_LOG_MAXIMUM_SIZE) + return; + + LogEntry = (PIO_ERROR_LOG_PACKET)IoAllocateErrorLogEntry(DriverContext, EntrySize); + if (!LogEntry) + return; + + LogEntry->MajorFunctionCode = -1; + LogEntry->RetryCount = -1; + LogEntry->DumpDataSize = (USHORT)(DumpDataCount * sizeof(ULONG)); + LogEntry->NumberOfStrings = (String == NULL) ? 1 : 2; + LogEntry->StringOffset = sizeof(IO_ERROR_LOG_PACKET) + (DumpDataCount * sizeof(ULONG)); + LogEntry->EventCategory = 0; + LogEntry->ErrorCode = ErrorCode; + LogEntry->UniqueErrorValue = UniqueErrorValue; + LogEntry->FinalStatus = FinalStatus; + LogEntry->SequenceNumber = -1; + LogEntry->IoControlCode = 0; + + if (DumpDataCount) + RtlCopyMemory(LogEntry->DumpData, DumpData, DumpDataCount * sizeof(ULONG)); + + pString = ((PUCHAR)LogEntry) + LogEntry->StringOffset; + RtlCopyMemory(pString, DriverName, sizeof(DriverName)); + pString += sizeof(DriverName); + + if (String) + RtlCopyMemory(pString, String, StringSize); + + IoWriteErrorLogEntry(LogEntry); } /*

8 years, 1 month

[hbelusca] 73168: [NTOS:IO]: An improvement for the total log size check (addendum to r73167).

by hbelusca＠svn.reactos.org

Author: hbelusca Date: Mon Nov 7 13:57:11 2016 New Revision: 73168 URL: http://svn.reactos.org/svn/reactos?rev=73168&view=rev Log: [NTOS:IO]: An improvement for the total log size check (addendum to r73167). Modified: trunk/reactos/ntoskrnl/io/iomgr/error.c Modified: trunk/reactos/ntoskrnl/io/iomgr/error.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/io/iomgr/error.c?… ============================================================================== --- trunk/reactos/ntoskrnl/io/iomgr/error.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/io/iomgr/error.c [iso-8859-1] Mon Nov 7 13:57:11 2016 @@ -554,10 +554,6 @@ return NULL; } - /* Check if we're past our buffer */ - // FIXME/TODO: Perform the checks by taking into account EntrySize. - if (IopTotalLogSize > IOP_MAXIMUM_LOG_SIZE) return NULL; - /* Check whether the size is too small or too large */ if ((EntrySize < sizeof(IO_ERROR_LOG_PACKET)) || (EntrySize > ERROR_LOG_MAXIMUM_SIZE)) @@ -566,11 +562,15 @@ return NULL; } - /* Round up the size */ + /* Round up the size and calculate the total size */ EntrySize = ROUND_UP(EntrySize, sizeof(PVOID)); - - /* Calculate the total size and allocate it */ LogEntrySize = sizeof(ERROR_LOG_ENTRY) + EntrySize; + + /* Check if we're past our buffer */ + // TODO: Improve (what happens in case of concurrent calls?) + if (IopTotalLogSize + LogEntrySize > IOP_MAXIMUM_LOG_SIZE) return NULL; + + /* Allocate the entry */ LogEntry = ExAllocatePoolWithTag(NonPagedPool, LogEntrySize, TAG_ERROR_LOG);

8 years, 1 month

[hbelusca] 73167: [NTOS:IO][INCLUDES][EVENTLOG]: Fix support for event logging through the "ErrorLogPort" LPC. See the details in CORE-12301 #resolve

by hbelusca＠svn.reactos.org

Author: hbelusca Date: Mon Nov 7 13:29:09 2016 New Revision: 73167 URL: http://svn.reactos.org/svn/reactos?rev=73167&view=rev Log: [NTOS:IO][INCLUDES][EVENTLOG]: Fix support for event logging through the "ErrorLogPort" LPC. See the details in CORE-12301 #resolve Added: trunk/reactos/sdk/include/reactos/subsys/iolog/ trunk/reactos/sdk/include/reactos/subsys/iolog/iolog.h (with props) Modified: trunk/reactos/base/services/eventlog/CMakeLists.txt trunk/reactos/base/services/eventlog/eventlog.c trunk/reactos/base/services/eventlog/eventlog.h trunk/reactos/base/services/eventlog/file.c trunk/reactos/base/services/eventlog/logport.c trunk/reactos/base/services/eventlog/rpc.c trunk/reactos/ntoskrnl/include/internal/io.h trunk/reactos/ntoskrnl/io/iomgr/error.c Modified: trunk/reactos/base/services/eventlog/CMakeLists.txt URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/CMa… ============================================================================== --- trunk/reactos/base/services/eventlog/CMakeLists.txt [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/CMakeLists.txt [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -1,6 +1,7 @@ include_directories( ${REACTOS_SOURCE_DIR}/sdk/lib/evtlib + ${REACTOS_SOURCE_DIR}/sdk/include/reactos/subsys ${REACTOS_SOURCE_DIR}/sdk/include/reactos/idl ${CMAKE_CURRENT_BINARY_DIR}) Modified: trunk/reactos/base/services/eventlog/eventlog.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/eve… ============================================================================== --- trunk/reactos/base/services/eventlog/eventlog.c [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/eventlog.c [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -548,71 +548,73 @@ LARGE_INTEGER SystemTime; TIME_FIELDS Time; - DPRINT("Length = %lu\n", pRec->Length); - DPRINT("Reserved = 0x%x\n", pRec->Reserved); - DPRINT("RecordNumber = %lu\n", pRec->RecordNumber); + DPRINT1("PRINT_RECORD(0x%p)\n", pRec); + + DbgPrint("Length = %lu\n", pRec->Length); + DbgPrint("Reserved = 0x%x\n", pRec->Reserved); + DbgPrint("RecordNumber = %lu\n", pRec->RecordNumber); RtlSecondsSince1970ToTime(pRec->TimeGenerated, &SystemTime); RtlTimeToTimeFields(&SystemTime, &Time); - DPRINT("TimeGenerated = %hu.%hu.%hu %hu:%hu:%hu\n", - Time.Day, Time.Month, Time.Year, - Time.Hour, Time.Minute, Time.Second); + DbgPrint("TimeGenerated = %hu.%hu.%hu %hu:%hu:%hu\n", + Time.Day, Time.Month, Time.Year, + Time.Hour, Time.Minute, Time.Second); RtlSecondsSince1970ToTime(pRec->TimeWritten, &SystemTime); RtlTimeToTimeFields(&SystemTime, &Time); - DPRINT("TimeWritten = %hu.%hu.%hu %hu:%hu:%hu\n", - Time.Day, Time.Month, Time.Year, - Time.Hour, Time.Minute, Time.Second); - - DPRINT("EventID = %lu\n", pRec->EventID); + DbgPrint("TimeWritten = %hu.%hu.%hu %hu:%hu:%hu\n", + Time.Day, Time.Month, Time.Year, + Time.Hour, Time.Minute, Time.Second); + + DbgPrint("EventID = %lu\n", pRec->EventID); switch (pRec->EventType) { case EVENTLOG_ERROR_TYPE: - DPRINT("EventType = EVENTLOG_ERROR_TYPE\n"); + DbgPrint("EventType = EVENTLOG_ERROR_TYPE\n"); break; case EVENTLOG_WARNING_TYPE: - DPRINT("EventType = EVENTLOG_WARNING_TYPE\n"); + DbgPrint("EventType = EVENTLOG_WARNING_TYPE\n"); break; case EVENTLOG_INFORMATION_TYPE: - DPRINT("EventType = EVENTLOG_INFORMATION_TYPE\n"); + DbgPrint("EventType = EVENTLOG_INFORMATION_TYPE\n"); break; case EVENTLOG_AUDIT_SUCCESS: - DPRINT("EventType = EVENTLOG_AUDIT_SUCCESS\n"); + DbgPrint("EventType = EVENTLOG_AUDIT_SUCCESS\n"); break; case EVENTLOG_AUDIT_FAILURE: - DPRINT("EventType = EVENTLOG_AUDIT_FAILURE\n"); + DbgPrint("EventType = EVENTLOG_AUDIT_FAILURE\n"); break; default: - DPRINT("EventType = %hu\n", pRec->EventType); - } - - DPRINT("NumStrings = %hu\n", pRec->NumStrings); - DPRINT("EventCategory = %hu\n", pRec->EventCategory); - DPRINT("ReservedFlags = 0x%x\n", pRec->ReservedFlags); - DPRINT("ClosingRecordNumber = %lu\n", pRec->ClosingRecordNumber); - DPRINT("StringOffset = %lu\n", pRec->StringOffset); - DPRINT("UserSidLength = %lu\n", pRec->UserSidLength); - DPRINT("UserSidOffset = %lu\n", pRec->UserSidOffset); - DPRINT("DataLength = %lu\n", pRec->DataLength); - DPRINT("DataOffset = %lu\n", pRec->DataOffset); - - DPRINT("SourceName: %S\n", (PWSTR)((ULONG_PTR)pRec + sizeof(EVENTLOGRECORD))); - - i = (wcslen((PWSTR)((ULONG_PTR)pRec + sizeof(EVENTLOGRECORD))) + 1) * sizeof(WCHAR); - - DPRINT("ComputerName: %S\n", (PWSTR)((ULONG_PTR)pRec + sizeof(EVENTLOGRECORD) + i)); + DbgPrint("EventType = %hu\n", pRec->EventType); + } + + DbgPrint("NumStrings = %hu\n", pRec->NumStrings); + DbgPrint("EventCategory = %hu\n", pRec->EventCategory); + DbgPrint("ReservedFlags = 0x%x\n", pRec->ReservedFlags); + DbgPrint("ClosingRecordNumber = %lu\n", pRec->ClosingRecordNumber); + DbgPrint("StringOffset = %lu\n", pRec->StringOffset); + DbgPrint("UserSidLength = %lu\n", pRec->UserSidLength); + DbgPrint("UserSidOffset = %lu\n", pRec->UserSidOffset); + DbgPrint("DataLength = %lu\n", pRec->DataLength); + DbgPrint("DataOffset = %lu\n", pRec->DataOffset); + + i = sizeof(EVENTLOGRECORD); + DbgPrint("SourceName: %S\n", (PWSTR)((ULONG_PTR)pRec + i)); + + i += (wcslen((PWSTR)((ULONG_PTR)pRec + i)) + 1) * sizeof(WCHAR); + DbgPrint("ComputerName: %S\n", (PWSTR)((ULONG_PTR)pRec + i)); if (pRec->StringOffset < pRec->Length && pRec->NumStrings) { - DPRINT("Strings:\n"); + DbgPrint("Strings:\n"); str = (PWSTR)((ULONG_PTR)pRec + pRec->StringOffset); for (i = 0; i < pRec->NumStrings; i++) { - DPRINT("[%u] %S\n", i, str); + DbgPrint("[%u] %S\n", i, str); str += wcslen(str) + 1; } } - DPRINT("Length2 = %lu\n", *(PULONG)((ULONG_PTR)pRec + pRec->Length - 4)); -} + DbgPrint("Length2 = %lu\n", *(PULONG)((ULONG_PTR)pRec + pRec->Length - 4)); +} Modified: trunk/reactos/base/services/eventlog/eventlog.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/eve… ============================================================================== --- trunk/reactos/base/services/eventlog/eventlog.h [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/eventlog.h [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -27,15 +27,6 @@ #include <eventlogrpc_s.h> #include <strsafe.h> - -// FIXME: For that we may directly include NTOS header?? -typedef struct _IO_ERROR_LPC -{ - PORT_MESSAGE Header; - IO_ERROR_LOG_MESSAGE Message; -} IO_ERROR_LPC, *PIO_ERROR_LPC; - -// C_ASSERT(sizeof(IO_ERROR_LPC) == 0x100); /* Defined in evtlib.h */ // #define LOGFILE_SIGNATURE 0x654c664c // "LfLe" @@ -140,8 +131,8 @@ USHORT wType, USHORT wCategory, ULONG dwEventId, - PCWSTR SourceName, - PCWSTR ComputerName, + PUNICODE_STRING SourceName, + PUNICODE_STRING ComputerName, ULONG dwSidLength, PSID pUserSid, USHORT wNumStrings, Modified: trunk/reactos/base/services/eventlog/file.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/fil… ============================================================================== --- trunk/reactos/base/services/eventlog/file.c [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/file.c [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -898,8 +898,8 @@ USHORT wType, USHORT wCategory, ULONG dwEventId, - PCWSTR SourceName, - PCWSTR ComputerName, + PUNICODE_STRING SourceName, + PUNICODE_STRING ComputerName, ULONG dwSidLength, PSID pUserSid, USHORT wNumStrings, @@ -908,16 +908,17 @@ PVOID pRawData) { SIZE_T RecSize; + SIZE_T SourceNameSize, ComputerNameSize, StringLen; PBYTE Buffer; PEVENTLOGRECORD pRec; PWSTR str; UINT i, pos; - SIZE_T SourceNameLen, ComputerNameLen, StringLen; - - SourceNameLen = (SourceName ? wcslen(SourceName) : 0) + 1; - ComputerNameLen = (ComputerName ? wcslen(ComputerName) : 0) + 1; - - RecSize = sizeof(EVENTLOGRECORD) + (SourceNameLen + ComputerNameLen) * sizeof(WCHAR); + + SourceNameSize = (SourceName && SourceName->Buffer) ? SourceName->Length : 0; + ComputerNameSize = (ComputerName && ComputerName->Buffer) ? ComputerName->Length : 0; + + RecSize = sizeof(EVENTLOGRECORD) + /* Add the sizes of the strings, NULL-terminated */ + SourceNameSize + ComputerNameSize + 2*sizeof(UNICODE_NULL); /* Align on DWORD boundary for the SID */ RecSize = ROUND_UP(RecSize, sizeof(ULONG)); @@ -975,12 +976,19 @@ pos = sizeof(EVENTLOGRECORD); - if (SourceName) - StringCchCopyW((PWSTR)(Buffer + pos), SourceNameLen, SourceName); - pos += SourceNameLen * sizeof(WCHAR); - if (ComputerName) - StringCchCopyW((PWSTR)(Buffer + pos), ComputerNameLen, ComputerName); - pos += ComputerNameLen * sizeof(WCHAR); + /* NOTE: Equivalents of RtlStringCbCopyUnicodeString calls */ + if (SourceNameSize) + { + StringCbCopyNW((PWSTR)(Buffer + pos), SourceNameSize + sizeof(UNICODE_NULL), + SourceName->Buffer, SourceNameSize); + } + pos += SourceNameSize + sizeof(UNICODE_NULL); + if (ComputerNameSize) + { + StringCbCopyNW((PWSTR)(Buffer + pos), ComputerNameSize + sizeof(UNICODE_NULL), + ComputerName->Buffer, ComputerNameSize); + } + pos += ComputerNameSize + sizeof(UNICODE_NULL); /* Align on DWORD boundary for the SID */ pos = ROUND_UP(pos, sizeof(ULONG)); @@ -1035,20 +1043,24 @@ PVOID pRawData) { NTSTATUS Status; - WCHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1]; - DWORD dwComputerNameLength = MAX_COMPUTERNAME_LENGTH + 1; + UNICODE_STRING SourceName, ComputerName; PEVENTLOGRECORD LogBuffer; LARGE_INTEGER SystemTime; ULONG Time; SIZE_T RecSize; + DWORD dwComputerNameLength; + WCHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1]; if (!EventLogSource) return; + RtlInitUnicodeString(&SourceName, EventLogSource->szName); + + dwComputerNameLength = ARRAYSIZE(szComputerName); if (!GetComputerNameW(szComputerName, &dwComputerNameLength)) - { szComputerName[0] = L'\0'; - } + + RtlInitUnicodeString(&ComputerName, szComputerName); NtQuerySystemTime(&SystemTime); RtlTimeToSecondsSince1970(&SystemTime, &Time); @@ -1058,14 +1070,19 @@ wType, wCategory, dwEventId, - EventLogSource->szName, - szComputerName, + &SourceName, + &ComputerName, 0, NULL, wNumStrings, pStrings, dwDataSize, pRawData); + if (LogBuffer == NULL) + { + DPRINT1("LogfAllocAndBuildNewRecord failed!\n"); + return; + } Status = LogfWriteRecord(EventLogSource->LogFile, LogBuffer, RecSize); if (!NT_SUCCESS(Status)) Modified: trunk/reactos/base/services/eventlog/logport.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/log… ============================================================================== --- trunk/reactos/base/services/eventlog/logport.c [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/logport.c [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -11,6 +11,7 @@ #include "eventlog.h" #include <ndk/lpcfuncs.h> +#include <iolog/iolog.h> #define NDEBUG #include <debug.h> @@ -46,22 +47,20 @@ NTSTATUS InitLogPort(VOID) { NTSTATUS Status; - UNICODE_STRING PortName; + UNICODE_STRING PortName = RTL_CONSTANT_STRING(ELF_PORT_NAME); OBJECT_ATTRIBUTES ObjectAttributes; PORT_MESSAGE Request; ConnectPortHandle = NULL; MessagePortHandle = NULL; - RtlInitUnicodeString(&PortName, L"\\ErrorLogPort"); InitializeObjectAttributes(&ObjectAttributes, &PortName, 0, NULL, NULL); Status = NtCreatePort(&ConnectPortHandle, &ObjectAttributes, 0, - 0x100, - 0x2000); - + PORT_MAXIMUM_MESSAGE_LENGTH, // IO_ERROR_LOG_MESSAGE_LENGTH, + 2 * PAGE_SIZE); if (!NT_SUCCESS(Status)) { DPRINT1("NtCreatePort() failed (Status %lx)\n", Status); @@ -76,7 +75,7 @@ } Status = NtAcceptConnectPort(&MessagePortHandle, ConnectPortHandle, - NULL, TRUE, NULL, NULL); + &Request, TRUE, NULL, NULL); if (!NT_SUCCESS(Status)) { DPRINT1("NtAcceptConnectPort() failed (Status %lx)\n", Status); @@ -105,14 +104,17 @@ NTSTATUS ProcessPortMessage(VOID) { NTSTATUS Status; - IO_ERROR_LPC Request; - PIO_ERROR_LOG_MESSAGE Message; + PLOGFILE SystemLog = NULL; + UCHAR Buffer[PORT_MAXIMUM_MESSAGE_LENGTH]; // IO_ERROR_LOG_MESSAGE_LENGTH + PELF_API_MSG Message = (PELF_API_MSG)Buffer; + PIO_ERROR_LOG_MESSAGE ErrorMessage; + PEVENTLOGRECORD LogBuffer; + SIZE_T RecSize; ULONG Time; - PEVENTLOGRECORD pRec; - SIZE_T RecSize; - PLOGFILE SystemLog = NULL; + USHORT EventType; + UNICODE_STRING SourceName, ComputerName; + DWORD dwComputerNameLength; WCHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1]; - DWORD dwComputerNameLength = MAX_COMPUTERNAME_LENGTH + 1; DPRINT("ProcessPortMessage() called\n"); @@ -121,9 +123,9 @@ while (TRUE) { Status = NtReplyWaitReceivePort(MessagePortHandle, - 0, NULL, - &Request.Header); + NULL, + &Message->Header); if (!NT_SUCCESS(Status)) { @@ -133,69 +135,108 @@ DPRINT("Received message\n"); - if (Request.Header.u2.s2.Type == LPC_PORT_CLOSED) + if (Message->Header.u2.s2.Type == LPC_PORT_CLOSED) { DPRINT("Port closed\n"); return STATUS_SUCCESS; } - if (Request.Header.u2.s2.Type == LPC_REQUEST) + if (Message->Header.u2.s2.Type == LPC_REQUEST) { DPRINT("Received request\n"); } - else if (Request.Header.u2.s2.Type == LPC_DATAGRAM) - { - DPRINT("Received datagram\n"); - // Message = (PIO_ERROR_LOG_MESSAGE)&Request.Message; - Message = &Request.Message; - + else if (Message->Header.u2.s2.Type == LPC_DATAGRAM) + { + DPRINT("Received datagram (0x%x, 0x%x)\n", + Message->Unknown[0], Message->Unknown[1]); + ErrorMessage = &Message->IoErrorMessage; + + // ASSERT(ErrorMessage->Type == IO_TYPE_ERROR_MESSAGE); + + RtlInitEmptyUnicodeString(&SourceName, NULL, 0); + if (ErrorMessage->DriverNameLength > sizeof(UNICODE_NULL)) // DriverNameLength counts NULL-terminator + { + SourceName.Buffer = (PWSTR)((ULONG_PTR)ErrorMessage + ErrorMessage->DriverNameOffset); + SourceName.MaximumLength = ErrorMessage->DriverNameLength; + SourceName.Length = SourceName.MaximumLength - sizeof(UNICODE_NULL); + } + + dwComputerNameLength = ARRAYSIZE(szComputerName); if (!GetComputerNameW(szComputerName, &dwComputerNameLength)) - { szComputerName[0] = L'\0'; - } - - RtlTimeToSecondsSince1970(&Message->TimeStamp, &Time); - - // TODO: Log more information?? - - pRec = LogfAllocAndBuildNewRecord( - &RecSize, - Time, - Message->Type, - Message->EntryData.EventCategory, - Message->EntryData.ErrorCode, - (PWSTR)((ULONG_PTR)Message + Message->DriverNameOffset), // FIXME: Use DriverNameLength too! - szComputerName, - 0, - NULL, - Message->EntryData.NumberOfStrings, - (PWSTR)((ULONG_PTR)Message + Message->EntryData.StringOffset), - Message->EntryData.DumpDataSize, - (PVOID)((ULONG_PTR)Message + FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData))); - - if (pRec == NULL) - { - DPRINT("LogfAllocAndBuildNewRecord failed!\n"); - return STATUS_NO_MEMORY; - } - - DPRINT("RecSize = %d\n", RecSize); - - DPRINT("\n --- EVENTLOG RECORD ---\n"); - PRINT_RECORD(pRec); - DPRINT("\n"); + + RtlInitUnicodeString(&ComputerName, szComputerName); + + RtlTimeToSecondsSince1970(&ErrorMessage->TimeStamp, &Time); + + /* Set the event type based on the error code severity */ + EventType = (USHORT)(ErrorMessage->EntryData.ErrorCode >> 30); + if (EventType == STATUS_SEVERITY_SUCCESS) + { + EventType = EVENTLOG_SUCCESS; + } + else if (EventType == STATUS_SEVERITY_INFORMATIONAL) // NT_INFORMATION + { + EventType = EVENTLOG_INFORMATION_TYPE; + } + else if (EventType == STATUS_SEVERITY_WARNING) // NT_WARNING + { + EventType = EVENTLOG_WARNING_TYPE; + } + else if (EventType == STATUS_SEVERITY_ERROR) // NT_ERROR + { + EventType = EVENTLOG_ERROR_TYPE; + } + else + { + /* Unknown severity, set to error */ + EventType = EVENTLOG_ERROR_TYPE; + } + + /* + * The data being saved consists of the IO_ERROR_LOG_PACKET structure + * header, plus the additional raw data from the driver. + */ + LogBuffer = LogfAllocAndBuildNewRecord( + &RecSize, + Time, + EventType, + ErrorMessage->EntryData.EventCategory, + ErrorMessage->EntryData.ErrorCode, + &SourceName, + &ComputerName, + 0, + NULL, + ErrorMessage->EntryData.NumberOfStrings, + (PWSTR)((ULONG_PTR)ErrorMessage + + ErrorMessage->EntryData.StringOffset), + FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData) + + ErrorMessage->EntryData.DumpDataSize, + (PVOID)&ErrorMessage->EntryData); + if (LogBuffer == NULL) + { + DPRINT1("LogfAllocAndBuildNewRecord failed!\n"); + // return STATUS_NO_MEMORY; + continue; + } if (!onLiveCD && SystemLog) { - Status = LogfWriteRecord(SystemLog, pRec, RecSize); + Status = LogfWriteRecord(SystemLog, LogBuffer, RecSize); if (!NT_SUCCESS(Status)) { DPRINT1("ERROR writing to event log `%S' (Status 0x%08lx)\n", SystemLog->LogName, Status); } } - - LogfFreeRecord(pRec); + else + { + DPRINT1("\n--- EVENTLOG RECORD ---\n"); + PRINT_RECORD(LogBuffer); + DPRINT1("\n"); + } + + LogfFreeRecord(LogBuffer); } } Modified: trunk/reactos/base/services/eventlog/rpc.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/rpc… ============================================================================== --- trunk/reactos/base/services/eventlog/rpc.c [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/rpc.c [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -586,6 +586,7 @@ { NTSTATUS Status; PLOGHANDLE pLogHandle; + UNICODE_STRING LocalSourceName, LocalComputerName; PEVENTLOGRECORD LogBuffer; USHORT i; SIZE_T RecSize; @@ -655,21 +656,32 @@ if (UserSID) dwUserSidLength = FIELD_OFFSET(SID, SubAuthority[UserSID->SubAuthorityCount]); + if (SourceName && SourceName->Buffer) + LocalSourceName = *(PUNICODE_STRING)SourceName; + else + RtlInitUnicodeString(&LocalSourceName, pLogHandle->szName); + + LocalComputerName = *(PUNICODE_STRING)ComputerName; + LogBuffer = LogfAllocAndBuildNewRecord(&RecSize, Time, EventType, EventCategory, EventID, - (SourceName && SourceName->Buffer) - ? SourceName->Buffer - : pLogHandle->szName, - ComputerName->Buffer, + &LocalSourceName, + &LocalComputerName, dwUserSidLength, UserSID, NumStrings, lpStrings, DataSize, Data); + if (LogBuffer == NULL) + { + DPRINT1("LogfAllocAndBuildNewRecord failed!\n"); + HeapFree(GetProcessHeap(), 0, lpStrings); + return STATUS_NO_MEMORY; + } Status = LogfWriteRecord(pLogHandle->LogFile, LogBuffer, RecSize); if (!NT_SUCCESS(Status)) Modified: trunk/reactos/ntoskrnl/include/internal/io.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/include/internal/… ============================================================================== --- trunk/reactos/ntoskrnl/include/internal/io.h [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/include/internal/io.h [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -5,6 +5,7 @@ * PURPOSE: Internal header for the I/O Manager * PROGRAMMERS: Alex Ionescu (alex.ionescu(a)reactos.org) */ + #include "ntdddisk.h" // @@ -331,16 +332,6 @@ PDRIVER_OBJECT DriverObject; LARGE_INTEGER TimeStamp; } ERROR_LOG_ENTRY, *PERROR_LOG_ENTRY; - -// -// Event Log LPC Message -// -typedef struct _ELF_API_MSG -{ - PORT_MESSAGE h; - ULONG Unknown[2]; - IO_ERROR_LOG_MESSAGE IoErrorMessage; -} ELF_API_MSG, *PELF_API_MSG; // // To simplify matters, the kernel is made to support both the checked and free Modified: trunk/reactos/ntoskrnl/io/iomgr/error.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/io/iomgr/error.c?… ============================================================================== --- trunk/reactos/ntoskrnl/io/iomgr/error.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/io/iomgr/error.c [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -6,9 +6,12 @@ * PROGRAMMERS: Alex Ionescu (alex.ionescu(a)reactos.org) * Eric Kohl */ + /* INCLUDES *****************************************************************/ #include <ntoskrnl.h> +#include <subsys/iolog/iolog.h> + #define NDEBUG #include <debug.h> @@ -22,6 +25,7 @@ /* GLOBALS *******************************************************************/ +#define IOP_MAXIMUM_LOG_SIZE (100 * PAGE_SIZE) LONG IopTotalLogSize; LIST_ENTRY IopErrorLogListHead; KSPIN_LOCK IopLogListLock; @@ -105,16 +109,23 @@ NTAPI IopConnectLogPort(VOID) { - UNICODE_STRING PortName = RTL_CONSTANT_STRING(L"\\ErrorLogPort"); NTSTATUS Status; + UNICODE_STRING PortName = RTL_CONSTANT_STRING(ELF_PORT_NAME); + SECURITY_QUALITY_OF_SERVICE SecurityQos; /* Make sure we're not already connected */ if (IopLogPortConnected) return TRUE; + + /* Setup the QoS structure */ + SecurityQos.Length = sizeof(SecurityQos); + SecurityQos.ImpersonationLevel = SecurityIdentification; + SecurityQos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING; + SecurityQos.EffectiveOnly = TRUE; /* Connect the port */ Status = ZwConnectPort(&IopLogPort, &PortName, - NULL, + &SecurityQos, NULL, NULL, NULL, @@ -136,6 +147,9 @@ NTAPI IopLogWorker(IN PVOID Parameter) { +#define IO_ERROR_OBJECT_NAMES_LENGTH 100 + + NTSTATUS Status; PELF_API_MSG Message; PIO_ERROR_LOG_MESSAGE ErrorMessage; PLIST_ENTRY ListEntry; @@ -144,22 +158,24 @@ PCHAR StringBuffer; ULONG RemainingLength; PDRIVER_OBJECT DriverObject; - ULONG DriverNameLength = 0, DeviceNameLength; - UNICODE_STRING DriverNameString; - NTSTATUS Status; - UCHAR Buffer[256]; + PWCHAR NameString; + ULONG DriverNameLength, DeviceNameLength; + UCHAR Buffer[sizeof(OBJECT_NAME_INFORMATION) + IO_ERROR_OBJECT_NAMES_LENGTH]; POBJECT_NAME_INFORMATION ObjectNameInfo = (POBJECT_NAME_INFORMATION)&Buffer; - POBJECT_NAME_INFORMATION PoolObjectNameInfo = NULL; + POBJECT_NAME_INFORMATION PoolObjectNameInfo; ULONG ReturnedLength, MessageLength; + ULONG ExtraStringLength; PWCHAR p; - ULONG ExtraStringLength; + PAGED_CODE(); + + UNREFERENCED_PARAMETER(Parameter); /* Connect to the port */ if (!IopConnectLogPort()) return; /* Allocate the message */ - Message = ExAllocatePool(PagedPool, IO_ERROR_LOG_MESSAGE_LENGTH); + Message = ExAllocatePoolWithTag(PagedPool, IO_ERROR_LOG_MESSAGE_LENGTH, TAG_IO); if (!Message) { /* Couldn't allocate, try again */ @@ -167,10 +183,8 @@ return; } - /* Copy the message */ - RtlZeroMemory(Message, sizeof(ELF_API_MSG)); - - /* Get the actual I/O Structure */ + /* Zero out the message and get the actual I/O structure */ + RtlZeroMemory(Message, sizeof(*Message)); ErrorMessage = &Message->IoErrorMessage; /* Start loop */ @@ -225,21 +239,28 @@ IO_ERROR_LOG_MESSAGE_LENGTH - (ULONG_PTR)StringBuffer); + NameString = NULL; + DriverNameLength = 0; DeviceNameLength = 0; + PoolObjectNameInfo = NULL; + ObjectNameInfo = (POBJECT_NAME_INFORMATION)&Buffer; + /* Now check if there is a driver object */ DriverObject = LogEntry->DriverObject; if (DriverObject) { - /* Check if the driver has a name */ + /* Check if the driver has a name, and use it if so */ if (DriverObject->DriverName.Buffer) { - /* Use its name */ - DriverNameString.Buffer = DriverObject->DriverName.Buffer; + NameString = DriverObject->DriverName.Buffer; DriverNameLength = DriverObject->DriverName.Length; } else - DriverNameString.Buffer = NULL; - - /* Check if there isn't a valid name*/ + { + NameString = NULL; + DriverNameLength = 0; + } + + /* Check if there isn't a valid name */ if (!DriverNameLength) { /* Query the name directly */ @@ -247,30 +268,35 @@ ObjectNameInfo, sizeof(Buffer), &ReturnedLength); - if (!(NT_SUCCESS(Status)) || !(ObjectNameInfo->Name.Length)) + if (!NT_SUCCESS(Status) || (ObjectNameInfo->Name.Length == 0)) { /* We don't have a name */ DriverNameLength = 0; } + else + { + NameString = ObjectNameInfo->Name.Buffer; + DriverNameLength = ObjectNameInfo->Name.Length; + } } } else { /* Use default name */ - DriverNameString.Buffer = L"Application Popup"; - DriverNameLength = (ULONG)wcslen(DriverNameString.Buffer) * sizeof(WCHAR); - } - - /* Check if we have a driver name by here */ + NameString = L"Application Popup"; + DriverNameLength = (ULONG)wcslen(NameString) * sizeof(WCHAR); + } + + /* Check if we have a driver name */ if (DriverNameLength) { /* Skip to the end of the driver's name */ - p = &DriverNameString.Buffer[DriverNameLength / sizeof(WCHAR)]; + p = &NameString[DriverNameLength / sizeof(WCHAR)]; /* Now we'll walk backwards and assume the minimum size */ DriverNameLength = sizeof(WCHAR); p--; - while ((*p != L'\\') && (p != DriverNameString.Buffer)) + while ((*p != L'\\') && (p != NameString)) { /* No backslash found, keep going */ p--; @@ -285,8 +311,9 @@ } /* - * Now make sure that the driver name fits in our buffer, minus 3 - * NULL chars, and copy the name in our string buffer + * Now make sure that the driver name fits in the buffer, minus + * 3 NULL chars (driver name, device name, and remaining strings), + * and copy the driver name in the string buffer. */ DriverNameLength = min(DriverNameLength, RemainingLength - 3 * sizeof(UNICODE_NULL)); @@ -294,29 +321,29 @@ } /* Null-terminate the driver name */ - *((PWSTR)(StringBuffer + DriverNameLength)) = L'\0'; + *((PWSTR)(StringBuffer + DriverNameLength)) = UNICODE_NULL; DriverNameLength += sizeof(WCHAR); /* Go to the next string buffer position */ StringBuffer += DriverNameLength; RemainingLength -= DriverNameLength; - /* Update the string offset and check if we have a device object */ - ErrorMessage->EntryData.StringOffset = (USHORT) - ((ULONG_PTR)StringBuffer - - (ULONG_PTR)ErrorMessage); + /* Update the string offset */ + ErrorMessage->EntryData.StringOffset = + (USHORT)((ULONG_PTR)StringBuffer - (ULONG_PTR)ErrorMessage); + + /* Check if we have a device object */ if (LogEntry->DeviceObject) { /* We do, query its name */ Status = ObQueryNameString(LogEntry->DeviceObject, ObjectNameInfo, - sizeof(Buffer), + sizeof(Buffer) - DriverNameLength, &ReturnedLength); if (!NT_SUCCESS(Status) || (ObjectNameInfo->Name.Length == 0)) { /* Setup an empty name */ - ObjectNameInfo->Name.Length = 0; - ObjectNameInfo->Name.Buffer = L""; + RtlInitEmptyUnicodeString(&ObjectNameInfo->Name, L"", 0); /* Check if we failed because our buffer wasn't large enough */ if (Status == STATUS_INFO_LENGTH_MISMATCH) @@ -337,39 +364,40 @@ { /* Success, update the information */ ObjectNameInfo->Name.Length = - 100 - (USHORT)DriverNameLength; + IO_ERROR_OBJECT_NAMES_LENGTH - (USHORT)DriverNameLength; } } } } + + NameString = ObjectNameInfo->Name.Buffer; + DeviceNameLength = ObjectNameInfo->Name.Length; } else { /* No device object, setup an empty name */ - ObjectNameInfo->Name.Length = 0; - ObjectNameInfo->Name.Buffer = L""; + NameString = L""; + DeviceNameLength = 0; } /* - * Now make sure that the device name fits in our buffer, minus 2 - * NULL chars, and copy the name in our string buffer + * Now make sure that the device name fits in the buffer, minus + * 2 NULL chars (device name, and remaining strings), and copy + * the device name in the string buffer. */ - DeviceNameLength = min(ObjectNameInfo->Name.Length, + DeviceNameLength = min(DeviceNameLength, RemainingLength - 2 * sizeof(UNICODE_NULL)); - RtlCopyMemory(StringBuffer, - ObjectNameInfo->Name.Buffer, - DeviceNameLength); + RtlCopyMemory(StringBuffer, NameString, DeviceNameLength); /* Null-terminate the device name */ - *((PWSTR)(StringBuffer + DeviceNameLength)) = L'\0'; + *((PWSTR)(StringBuffer + DeviceNameLength)) = UNICODE_NULL; DeviceNameLength += sizeof(WCHAR); /* Free the buffer if we had one */ if (PoolObjectNameInfo) { - ExFreePool(PoolObjectNameInfo); + ExFreePoolWithTag(PoolObjectNameInfo, TAG_IO); PoolObjectNameInfo = NULL; - ObjectNameInfo = (POBJECT_NAME_INFORMATION)&Buffer; } /* Go to the next string buffer position */ @@ -384,6 +412,9 @@ ExtraStringLength = LogEntry->Size - sizeof(ERROR_LOG_ENTRY) - Packet->StringOffset; + + /* Round up the length */ + ExtraStringLength = ROUND_UP(ExtraStringLength, sizeof(WCHAR)); /* Make sure that the extra strings fit in our buffer */ if (ExtraStringLength > (RemainingLength - sizeof(UNICODE_NULL))) @@ -399,50 +430,58 @@ ExtraStringLength); /* Null-terminate them */ - *((PWSTR)(StringBuffer + ExtraStringLength)) = L'\0'; + *((PWSTR)(StringBuffer + ExtraStringLength)) = UNICODE_NULL; } /* Set the driver name length */ ErrorMessage->DriverNameLength = (USHORT)DriverNameLength; - /* Update the message length to include the device and driver names */ - MessageLength += DeviceNameLength + DriverNameLength; + /* Update the message length to include the driver and device names */ + MessageLength += DriverNameLength + DeviceNameLength; ErrorMessage->Size = (USHORT)MessageLength; - /* Now update it again, internally, for the size of the actual LPC */ + /* Now update it again for the size of the actual LPC */ MessageLength += (FIELD_OFFSET(ELF_API_MSG, IoErrorMessage) - FIELD_OFFSET(ELF_API_MSG, Unknown[0])); /* Set the total and data lengths */ - Message->h.u1.s1.TotalLength = (USHORT)(sizeof(PORT_MESSAGE) + - MessageLength); - Message->h.u1.s1.DataLength = (USHORT)(MessageLength); + Message->Header.u1.s1.TotalLength = + (USHORT)(sizeof(PORT_MESSAGE) + MessageLength); + Message->Header.u1.s1.DataLength = (USHORT)MessageLength; /* Send the message */ - Status = NtRequestPort(IopLogPort, (PPORT_MESSAGE)Message); + Status = ZwRequestPort(IopLogPort, &Message->Header); if (!NT_SUCCESS(Status)) { - /* Requeue log message and restart the worker */ - ExInterlockedInsertTailList(&IopErrorLogListHead, + /* + * An error happened while sending the message on the port. + * Close the port, requeue the log message on top of the list + * and restart the worker. + */ + ZwClose(IopLogPort); + IopLogPortConnected = FALSE; + + ExInterlockedInsertHeadList(&IopErrorLogListHead, &LogEntry->ListEntry, &IopLogListLock); - IopLogWorkerRunning = FALSE; + IopRestartLogWorker(); break; } - /* Dereference the device object */ + /* NOTE: The following is basically 'IoFreeErrorLogEntry(Packet)' */ + + /* Dereference both objects */ if (LogEntry->DeviceObject) ObDereferenceObject(LogEntry->DeviceObject); - if (DriverObject) ObDereferenceObject(LogEntry->DriverObject); - - /* Update size */ - InterlockedExchangeAdd(&IopTotalLogSize, - -(LONG)(LogEntry->Size - - sizeof(ERROR_LOG_ENTRY))); + if (LogEntry->DriverObject) ObDereferenceObject(LogEntry->DriverObject); + + /* Decrease the total allocation size and free the entry */ + InterlockedExchangeAdd(&IopTotalLogSize, -(LONG)LogEntry->Size); + ExFreePoolWithTag(LogEntry, TAG_ERROR_LOG); } /* Free the LPC Message */ - ExFreePool(Message); + ExFreePoolWithTag(Message, TAG_IO); } VOID @@ -495,17 +534,15 @@ /* Make sure we have an object */ if (!IoObject) return NULL; - /* Check if we're past our buffer */ - if (IopTotalLogSize > PAGE_SIZE) return NULL; - /* Check if this is a device object or driver object */ - if (((PDEVICE_OBJECT)IoObject)->Type == IO_TYPE_DEVICE) + DeviceObject = (PDEVICE_OBJECT)IoObject; + if (DeviceObject->Type == IO_TYPE_DEVICE) { /* It's a device, get the driver */ - DeviceObject = (PDEVICE_OBJECT)IoObject; + // DeviceObject = (PDEVICE_OBJECT)IoObject; DriverObject = DeviceObject->DriverObject; } - else if (((PDEVICE_OBJECT)IoObject)->Type == IO_TYPE_DRIVER) + else if (DeviceObject->Type == IO_TYPE_DRIVER) { /* It's a driver, so we don't have a device */ DeviceObject = NULL; @@ -516,6 +553,21 @@ /* Fail */ return NULL; } + + /* Check if we're past our buffer */ + // FIXME/TODO: Perform the checks by taking into account EntrySize. + if (IopTotalLogSize > IOP_MAXIMUM_LOG_SIZE) return NULL; + + /* Check whether the size is too small or too large */ + if ((EntrySize < sizeof(IO_ERROR_LOG_PACKET)) || + (EntrySize > ERROR_LOG_MAXIMUM_SIZE)) + { + /* Fail */ + return NULL; + } + + /* Round up the size */ + EntrySize = ROUND_UP(EntrySize, sizeof(PVOID)); /* Calculate the total size and allocate it */ LogEntrySize = sizeof(ERROR_LOG_ENTRY) + EntrySize; @@ -529,12 +581,12 @@ if (DriverObject) ObReferenceObject(DriverObject); /* Update log size */ - InterlockedExchangeAdd(&IopTotalLogSize, EntrySize); + InterlockedExchangeAdd(&IopTotalLogSize, LogEntrySize); /* Clear the entry and set it up */ - RtlZeroMemory(LogEntry, EntrySize); + RtlZeroMemory(LogEntry, LogEntrySize); LogEntry->Type = IO_TYPE_ERROR_LOG; - LogEntry->Size = EntrySize; + LogEntry->Size = LogEntrySize; LogEntry->DeviceObject = DeviceObject; LogEntry->DriverObject = DriverObject; @@ -551,7 +603,7 @@ { PERROR_LOG_ENTRY LogEntry; - /* Make sure there's an entry */ + /* Make sure there is an entry */ if (!ElEntry) return; /* Get the actual header */ @@ -561,10 +613,9 @@ if (LogEntry->DeviceObject) ObDereferenceObject(LogEntry->DeviceObject); if (LogEntry->DriverObject) ObDereferenceObject(LogEntry->DriverObject); - /* Decrease total allocation size and free the entry */ - InterlockedExchangeAdd(&IopTotalLogSize, - -(LONG)(LogEntry->Size - sizeof(ERROR_LOG_ENTRY))); - ExFreePool(LogEntry); + /* Decrease the total allocation size and free the entry */ + InterlockedExchangeAdd(&IopTotalLogSize, -(LONG)LogEntry->Size); + ExFreePoolWithTag(LogEntry, TAG_ERROR_LOG); } /* @@ -577,9 +628,11 @@ PERROR_LOG_ENTRY LogEntry; KIRQL Irql; - /* Get the main header */ - LogEntry = (PERROR_LOG_ENTRY)((ULONG_PTR)ElEntry - - sizeof(ERROR_LOG_ENTRY)); + /* Make sure there is an entry */ + if (!ElEntry) return; + + /* Get the actual header */ + LogEntry = (PERROR_LOG_ENTRY)((ULONG_PTR)ElEntry - sizeof(ERROR_LOG_ENTRY)); /* Get time stamp */ KeQuerySystemTime(&LogEntry->TimeStamp); @@ -591,14 +644,10 @@ /* Check if the worker is running */ if (!IopLogWorkerRunning) { -#if 0 /* It's not, initialize it and queue it */ - ExInitializeWorkItem(&IopErrorLogWorkItem, - IopLogWorker, - &IopErrorLogWorkItem); + IopLogWorkerRunning = TRUE; + ExInitializeWorkItem(&IopErrorLogWorkItem, IopLogWorker, NULL); ExQueueWorkItem(&IopErrorLogWorkItem, DelayedWorkQueue); - IopLogWorkerRunning = TRUE; -#endif } /* Release the lock and return */ Added: trunk/reactos/sdk/include/reactos/subsys/iolog/iolog.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/sdk/include/reactos/subsys… ============================================================================== --- trunk/reactos/sdk/include/reactos/subsys/iolog/iolog.h (added) +++ trunk/reactos/sdk/include/reactos/subsys/iolog/iolog.h [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -0,0 +1,31 @@ +/* + * PROJECT: ReactOS EventLog Service + * LICENSE: GPL - See COPYING in the top level directory + * FILE: include/reactos/subsys/iolog/iolog.h + * PURPOSE: EventLog LPC API definitions + */ + +#ifndef _IOLOG_H +#define _IOLOG_H + +#pragma once + +// #include <iotypes.h> // For IO_ERROR_LOG_MESSAGE and associated + +#define ELF_PORT_NAME L"\\ErrorLogPort" + +typedef struct _ELF_API_MSG +{ + PORT_MESSAGE Header; + ULONG Unknown[2]; // FIXME + IO_ERROR_LOG_MESSAGE IoErrorMessage; +} ELF_API_MSG, *PELF_API_MSG; + +/* + * NOTE: The maximum data size sent to the EventLog LPC port + * is equal to: PORT_MAXIMUM_MESSAGE_LENGTH == 0x100 . + */ + +#endif // _IOLOG_H + +/* EOF */ Propchange: trunk/reactos/sdk/include/reactos/subsys/iolog/iolog.h ------------------------------------------------------------------------------ svn:eol-style = native

8 years, 1 month

[hbelusca] 73166: [NTOS:LPC] - Capture the ServerView/ClientView *only* when those pointers are not NULL. - Fix a LpcRequest vs. CapturedLpcRequest in a call to LpcpMoveMessage. Caught by Thomas. C...

by hbelusca＠svn.reactos.org

Author: hbelusca Date: Mon Nov 7 12:35:09 2016 New Revision: 73166 URL: http://svn.reactos.org/svn/reactos?rev=73166&view=rev Log: [NTOS:LPC] - Capture the ServerView/ClientView *only* when those pointers are not NULL. - Fix a LpcRequest vs. CapturedLpcRequest in a call to LpcpMoveMessage. Caught by Thomas. CORE-7371 CR-100 Modified: trunk/reactos/ntoskrnl/lpc/complete.c trunk/reactos/ntoskrnl/lpc/connect.c trunk/reactos/ntoskrnl/lpc/send.c Modified: trunk/reactos/ntoskrnl/lpc/complete.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/complete.c?re… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] Mon Nov 7 12:35:09 2016 @@ -84,7 +84,9 @@ ProbeForRead(ReplyMessage + 1, ConnectionInfoLength, 1); /* The following parameters are optional */ - if (ServerView != NULL) + + /* Capture the server view */ + if (ServerView) { ProbeForWrite(ServerView, sizeof(*ServerView), sizeof(ULONG)); CapturedServerView = *(volatile PORT_VIEW*)ServerView; @@ -97,7 +99,8 @@ } } - if (ClientView != NULL) + /* Capture the client view */ + if (ClientView) { ProbeForWrite(ClientView, sizeof(*ClientView), sizeof(ULONG)); @@ -121,19 +124,27 @@ CapturedReplyMessage = *ReplyMessage; ConnectionInfoLength = CapturedReplyMessage.u1.s1.DataLength; - /* Validate the size of the server view */ - if ((ServerView) && (ServerView->Length != sizeof(*ServerView))) - { - /* Invalid size */ - return STATUS_INVALID_PARAMETER; - } - CapturedServerView = *ServerView; - - /* Validate the size of the client view */ - if ((ClientView) && (ClientView->Length != sizeof(*ClientView))) - { - /* Invalid size */ - return STATUS_INVALID_PARAMETER; + /* Capture the server view */ + if (ServerView) + { + /* Validate the size of the server view */ + if (ServerView->Length != sizeof(*ServerView)) + { + /* Invalid size */ + return STATUS_INVALID_PARAMETER; + } + CapturedServerView = *ServerView; + } + + /* Capture the client view */ + if (ClientView) + { + /* Validate the size of the client view */ + if (ClientView->Length != sizeof(*ClientView)) + { + /* Invalid size */ + return STATUS_INVALID_PARAMETER; + } } } Modified: trunk/reactos/ntoskrnl/lpc/connect.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/connect.c?rev… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] Mon Nov 7 12:35:09 2016 @@ -130,7 +130,7 @@ /* The following parameters are optional */ /* Capture the client view */ - if (ClientView != NULL) + if (ClientView) { ProbeForWrite(ClientView, sizeof(*ClientView), sizeof(ULONG)); CapturedClientView = *(volatile PORT_VIEW*)ClientView; @@ -145,7 +145,7 @@ } /* Capture the server view */ - if (ServerView != NULL) + if (ServerView) { ProbeForWrite(ServerView, sizeof(*ServerView), sizeof(ULONG)); @@ -202,7 +202,7 @@ /* The following parameters are optional */ /* Capture the client view */ - if (ClientView != NULL) + if (ClientView) { /* Validate the size of the client view */ if (ClientView->Length != sizeof(*ClientView)) @@ -214,7 +214,7 @@ } /* Capture the server view */ - if (ServerView != NULL) + if (ServerView) { /* Validate the size of the server view */ if (ServerView->Length != sizeof(*ServerView)) Modified: trunk/reactos/ntoskrnl/lpc/send.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/send.c?rev=73… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/send.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/send.c [iso-8859-1] Mon Nov 7 12:35:09 2016 @@ -857,7 +857,7 @@ /* Copy it */ LpcpMoveMessage(&Message->Request, - LpcRequest, + &CapturedLpcRequest, LpcRequest + 1, MessageType, &Thread->Cid);

8 years, 1 month

[phater] 73165: [MSAFD] Implement SOL_SOCKET/SO_ERROR. CORE-12104

by phater＠svn.reactos.org

Author: phater Date: Mon Nov 7 08:50:31 2016 New Revision: 73165 URL: http://svn.reactos.org/svn/reactos?rev=73165&view=rev Log: [MSAFD] Implement SOL_SOCKET/SO_ERROR. CORE-12104 Modified: trunk/reactos/dll/win32/msafd/misc/dllmain.c Modified: trunk/reactos/dll/win32/msafd/misc/dllmain.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/msafd/misc/dllma… ============================================================================== --- trunk/reactos/dll/win32/msafd/misc/dllmain.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/msafd/misc/dllmain.c [iso-8859-1] Mon Nov 7 08:50:31 2016 @@ -914,6 +914,7 @@ NtClose( SockEvent ); HeapFree(GlobalHeap, 0, BindData); + Socket->SharedData->SocketLastError = TranslateNtStatusError(Status); if (Status != STATUS_SUCCESS) return MsafdReturnWithErrno ( Status, lpErrno, 0, NULL ); @@ -997,6 +998,7 @@ NtClose( SockEvent ); + Socket->SharedData->SocketLastError = TranslateNtStatusError(Status); if (Status != STATUS_SUCCESS) return MsafdReturnWithErrno ( Status, lpErrno, 0, NULL ); @@ -1250,6 +1252,10 @@ TRACE("Event %x on handle %x\n", Events, Handle); + if ((Events & x) == AFD_EVENT_DISCONNECT || (Events & x) == AFD_EVENT_CLOSE) + Socket->SharedData->SocketLastError = WSAECONNRESET; + if ((Events & x) == AFD_EVENT_ABORT) + Socket->SharedData->SocketLastError = WSAECONNABORTED; if( readfds ) FD_SET(Handle, readfds); break; @@ -1643,6 +1649,7 @@ Status = IOSB.Status; } + Socket->SharedData->SocketLastError = TranslateNtStatusError(Status); if (!NT_SUCCESS(Status)) { NtClose(SockEvent); @@ -1871,6 +1878,7 @@ Status = IOSB.Status; } + Socket->SharedData->SocketLastError = TranslateNtStatusError(Status); if (Status != STATUS_SUCCESS) goto notify; @@ -2017,6 +2025,7 @@ NtClose( SockEvent ); + Socket->SharedData->SocketLastError = TranslateNtStatusError(Status); return MsafdReturnWithErrno( Status, lpErrno, 0, NULL ); } @@ -2428,8 +2437,9 @@ PVOID Buffer; INT BufferSize; BOOL BoolBuffer; - INT IntBuffer; INT Errno; + + TRACE("Called\n"); /* Get the Socket Structure associate to this Socket*/ Socket = GetSocketStructure(Handle); @@ -2438,8 +2448,11 @@ if (lpErrno) *lpErrno = WSAENOTSOCK; return SOCKET_ERROR; } - - TRACE("Called\n"); + if (!OptionLength || !OptionValue) + { + if (lpErrno) *lpErrno = WSAEFAULT; + return SOCKET_ERROR; + } switch (Level) { @@ -2525,13 +2538,10 @@ break; case SO_ERROR: - /* HACK: This needs to be properly tracked */ - IntBuffer = 0; - DbgPrint("MSAFD: Hacked SO_ERROR returning error %d\n", IntBuffer); - - Buffer = &IntBuffer; + Buffer = &Socket->SharedData->SocketLastError; BufferSize = sizeof(INT); break; + case SO_SNDTIMEO: Buffer = &Socket->SharedData->SendTimeout; BufferSize = sizeof(DWORD); @@ -2603,6 +2613,11 @@ if (lpErrno) *lpErrno = WSAENOTSOCK; return SOCKET_ERROR; } + if (!optval) + { + if (lpErrno) *lpErrno = WSAEFAULT; + return SOCKET_ERROR; + } /* FIXME: We should handle some more cases here */ @@ -2675,6 +2690,18 @@ /* TODO: The total per-socket buffer space reserved for sends */ ERR("Setting send buf to %x is not implemented yet\n", optval); + return NO_ERROR; + + case SO_ERROR: + if (optlen < sizeof(INT)) + { + if (lpErrno) *lpErrno = WSAEFAULT; + return SOCKET_ERROR; + } + + RtlCopyMemory(&Socket->SharedData->SocketLastError, + optval, + sizeof(INT)); return NO_ERROR; case SO_SNDTIMEO:

8 years, 1 month

[hbelusca] 73164: [NTOS:LPC] - Fix the usage, or add support (for NtSecureConnectPort based on patches by Alexander Andrejevic, and for NtReplyPort, NtReplyWaitReceivePortEx, NtListenPort by me) fo...

by hbelusca＠svn.reactos.org

Author: hbelusca Date: Mon Nov 7 01:24:24 2016 New Revision: 73164 URL: http://svn.reactos.org/svn/reactos?rev=73164&view=rev Log: [NTOS:LPC] - Fix the usage, or add support (for NtSecureConnectPort based on patches by Alexander Andrejevic, and for NtReplyPort, NtReplyWaitReceivePortEx, NtListenPort by me) for capturing user-mode parameters and using SEH in LPC functions. CORE-7371 #resolve - Make NtSecureConnectPort call SeQueryInformationToken, now that the latter is implemented since r73122. - Fix ObDereferenceObject usage for Port vs. ClientPort in NtSecureConnectPort. - ObCloseHandle certainly needs to be called with the actual 'PreviousMode'. Modified: trunk/reactos/ntoskrnl/lpc/complete.c trunk/reactos/ntoskrnl/lpc/connect.c trunk/reactos/ntoskrnl/lpc/create.c trunk/reactos/ntoskrnl/lpc/listen.c trunk/reactos/ntoskrnl/lpc/port.c trunk/reactos/ntoskrnl/lpc/reply.c trunk/reactos/ntoskrnl/lpc/send.c Modified: trunk/reactos/ntoskrnl/lpc/complete.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/complete.c?re… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -46,6 +46,8 @@ { NTSTATUS Status; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); + PORT_VIEW CapturedServerView; + PORT_MESSAGE CapturedReplyMessage; ULONG ConnectionInfoLength; PLPCP_PORT_OBJECT ConnectionPort, ServerPort, ClientPort; PLPCP_CONNECTION_MESSAGE ConnectMessage; @@ -55,8 +57,6 @@ PEPROCESS ClientProcess; PETHREAD ClientThread; LARGE_INTEGER SectionOffset; - CLIENT_ID ClientId; - ULONG MessageId; PAGED_CODE(); LPCTRACE(LPC_COMPLETE_DEBUG, @@ -70,18 +70,15 @@ /* Check if the call comes from user mode */ if (PreviousMode != KernelMode) { - /* Enter SEH for probing the parameters */ _SEH2_TRY { + /* Probe the PortHandle */ ProbeForWriteHandle(PortHandle); /* Probe the basic ReplyMessage structure */ - ProbeForRead(ReplyMessage, sizeof(PORT_MESSAGE), sizeof(ULONG)); - - /* Grab some values */ - ClientId = ReplyMessage->ClientId; - MessageId = ReplyMessage->MessageId; - ConnectionInfoLength = ReplyMessage->u1.s1.DataLength; + ProbeForRead(ReplyMessage, sizeof(*ReplyMessage), sizeof(ULONG)); + CapturedReplyMessage = *(volatile PORT_MESSAGE*)ReplyMessage; + ConnectionInfoLength = CapturedReplyMessage.u1.s1.DataLength; /* Probe the connection info */ ProbeForRead(ReplyMessage + 1, ConnectionInfoLength, 1); @@ -89,10 +86,11 @@ /* The following parameters are optional */ if (ServerView != NULL) { - ProbeForWrite(ServerView, sizeof(PORT_VIEW), sizeof(ULONG)); + ProbeForWrite(ServerView, sizeof(*ServerView), sizeof(ULONG)); + CapturedServerView = *(volatile PORT_VIEW*)ServerView; /* Validate the size of the server view */ - if (ServerView->Length != sizeof(PORT_VIEW)) + if (CapturedServerView.Length != sizeof(CapturedServerView)) { /* Invalid size */ _SEH2_YIELD(return STATUS_INVALID_PARAMETER); @@ -101,10 +99,10 @@ if (ClientView != NULL) { - ProbeForWrite(ClientView, sizeof(REMOTE_PORT_VIEW), sizeof(ULONG)); + ProbeForWrite(ClientView, sizeof(*ClientView), sizeof(ULONG)); /* Validate the size of the client view */ - if (ClientView->Length != sizeof(REMOTE_PORT_VIEW)) + if (((volatile REMOTE_PORT_VIEW*)ClientView)->Length != sizeof(*ClientView)) { /* Invalid size */ _SEH2_YIELD(return STATUS_INVALID_PARAMETER); @@ -120,20 +118,19 @@ } else { - /* Grab some values */ - ClientId = ReplyMessage->ClientId; - MessageId = ReplyMessage->MessageId; - ConnectionInfoLength = ReplyMessage->u1.s1.DataLength; + CapturedReplyMessage = *ReplyMessage; + ConnectionInfoLength = CapturedReplyMessage.u1.s1.DataLength; /* Validate the size of the server view */ - if ((ServerView) && (ServerView->Length != sizeof(PORT_VIEW))) + if ((ServerView) && (ServerView->Length != sizeof(*ServerView))) { /* Invalid size */ return STATUS_INVALID_PARAMETER; } + CapturedServerView = *ServerView; /* Validate the size of the client view */ - if ((ClientView) && (ClientView->Length != sizeof(REMOTE_PORT_VIEW))) + if ((ClientView) && (ClientView->Length != sizeof(*ClientView))) { /* Invalid size */ return STATUS_INVALID_PARAMETER; @@ -141,7 +138,7 @@ } /* Get the client process and thread */ - Status = PsLookupProcessThreadByCid(&ClientId, + Status = PsLookupProcessThreadByCid(&CapturedReplyMessage.ClientId, &ClientProcess, &ClientThread); if (!NT_SUCCESS(Status)) return Status; @@ -151,8 +148,8 @@ /* Make sure that the client wants a reply, and this is the right one */ if (!(LpcpGetMessageFromThread(ClientThread)) || - !(MessageId) || - (ClientThread->LpcReplyMessageId != MessageId)) + !(CapturedReplyMessage.MessageId) || + (ClientThread->LpcReplyMessageId != CapturedReplyMessage.MessageId)) { /* Not the reply asked for, or no reply wanted, fail */ KeReleaseGuardedMutex(&LpcpLock); @@ -203,8 +200,8 @@ /* Setup the reply message */ Message->Request.u2.s2.Type = LPC_REPLY; Message->Request.u2.s2.DataInfoOffset = 0; - Message->Request.ClientId = ClientId; - Message->Request.MessageId = MessageId; + Message->Request.ClientId = CapturedReplyMessage.ClientId; + Message->Request.MessageId = CapturedReplyMessage.MessageId; Message->Request.ClientViewSize = 0; _SEH2_TRY @@ -310,6 +307,7 @@ if (ServerView) { /* FIXME: TODO */ + UNREFERENCED_PARAMETER(CapturedServerView); ASSERT(FALSE); } @@ -347,7 +345,7 @@ _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { /* Cleanup and return the exception code */ - ObCloseHandle(Handle, UserMode); + ObCloseHandle(Handle, PreviousMode); ObDereferenceObject(ServerPort); Status = _SEH2_GetExceptionCode(); _SEH2_YIELD(goto Cleanup); Modified: trunk/reactos/ntoskrnl/lpc/connect.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/connect.c?rev… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -90,6 +90,9 @@ NTSTATUS Status = STATUS_SUCCESS; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); PETHREAD Thread = PsGetCurrentThread(); + SECURITY_QUALITY_OF_SERVICE CapturedQos; + PORT_VIEW CapturedClientView; + PSID CapturedServerSid; ULONG ConnectionInfoLength = 0; PLPCP_PORT_OBJECT Port, ClientPort; PLPCP_MESSAGE Message; @@ -110,25 +113,122 @@ ServerView, ServerSid); - /* Validate client view */ - if ((ClientView) && (ClientView->Length != sizeof(PORT_VIEW))) - { - /* Fail */ - return STATUS_INVALID_PARAMETER; - } - - /* Validate server view */ - if ((ServerView) && (ServerView->Length != sizeof(REMOTE_PORT_VIEW))) - { - /* Fail */ - return STATUS_INVALID_PARAMETER; - } - - /* Check if caller sent connection information length */ - if (ConnectionInformationLength) - { - /* Retrieve the input length */ - ConnectionInfoLength = *ConnectionInformationLength; + /* Check if the call comes from user mode */ + if (PreviousMode != KernelMode) + { + /* Enter SEH for probing the parameters */ + _SEH2_TRY + { + /* Probe the PortHandle */ + ProbeForWriteHandle(PortHandle); + + /* Probe and capture the QoS */ + ProbeForRead(SecurityQos, sizeof(*SecurityQos), sizeof(ULONG)); + CapturedQos = *(volatile SECURITY_QUALITY_OF_SERVICE*)SecurityQos; + /* NOTE: Do not care about CapturedQos.Length */ + + /* The following parameters are optional */ + + /* Capture the client view */ + if (ClientView != NULL) + { + ProbeForWrite(ClientView, sizeof(*ClientView), sizeof(ULONG)); + CapturedClientView = *(volatile PORT_VIEW*)ClientView; + + /* Validate the size of the client view */ + if (CapturedClientView.Length != sizeof(CapturedClientView)) + { + /* Invalid size */ + _SEH2_YIELD(return STATUS_INVALID_PARAMETER); + } + + } + + /* Capture the server view */ + if (ServerView != NULL) + { + ProbeForWrite(ServerView, sizeof(*ServerView), sizeof(ULONG)); + + /* Validate the size of the server view */ + if (((volatile REMOTE_PORT_VIEW*)ServerView)->Length != sizeof(*ServerView)) + { + /* Invalid size */ + _SEH2_YIELD(return STATUS_INVALID_PARAMETER); + } + } + + if (MaxMessageLength) + ProbeForWriteUlong(MaxMessageLength); + + /* Capture connection information length */ + if (ConnectionInformationLength) + { + ProbeForWriteUlong(ConnectionInformationLength); + ConnectionInfoLength = *(volatile ULONG*)ConnectionInformationLength; + } + + /* Probe the ConnectionInformation */ + if (ConnectionInformation) + ProbeForWrite(ConnectionInformation, ConnectionInfoLength, sizeof(ULONG)); + + CapturedServerSid = ServerSid; + if (ServerSid != NULL) + { + /* Capture it */ + Status = SepCaptureSid(ServerSid, + PreviousMode, + PagedPool, + TRUE, + &CapturedServerSid); + if (!NT_SUCCESS(Status)) + { + DPRINT1("Failed to capture ServerSid!\n"); + _SEH2_YIELD(return Status); + } + } + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + /* There was an exception, return the exception code */ + _SEH2_YIELD(return _SEH2_GetExceptionCode()); + } + _SEH2_END; + } + else + { + CapturedQos = *SecurityQos; + /* NOTE: Do not care about CapturedQos.Length */ + + /* The following parameters are optional */ + + /* Capture the client view */ + if (ClientView != NULL) + { + /* Validate the size of the client view */ + if (ClientView->Length != sizeof(*ClientView)) + { + /* Invalid size */ + return STATUS_INVALID_PARAMETER; + } + CapturedClientView = *ClientView; + } + + /* Capture the server view */ + if (ServerView != NULL) + { + /* Validate the size of the server view */ + if (ServerView->Length != sizeof(*ServerView)) + { + /* Invalid size */ + return STATUS_INVALID_PARAMETER; + } + } + + /* Capture connection information length */ + if (ConnectionInformationLength) + ConnectionInfoLength = *ConnectionInformationLength; + + CapturedServerSid = ServerSid; } /* Get the port */ @@ -143,6 +243,10 @@ if (!NT_SUCCESS(Status)) { DPRINT1("Failed to reference port '%wZ': 0x%lx\n", PortName, Status); + + if (CapturedServerSid != ServerSid) + SepReleaseSid(CapturedServerSid, PreviousMode, TRUE); + return Status; } @@ -151,10 +255,14 @@ { /* It isn't, so fail */ ObDereferenceObject(Port); + + if (CapturedServerSid != ServerSid) + SepReleaseSid(CapturedServerSid, PreviousMode, TRUE); + return STATUS_INVALID_PORT_HANDLE; } - /* Check if we have a SID */ + /* Check if we have a (captured) SID */ if (ServerSid) { /* Make sure that we have a server */ @@ -162,18 +270,14 @@ { /* Get its token and query user information */ Token = PsReferencePrimaryToken(Port->ServerProcess); - //Status = SeQueryInformationToken(Token, TokenUser, (PVOID*)&TokenUserInfo); - // FIXME: Need SeQueryInformationToken - Status = STATUS_SUCCESS; - TokenUserInfo = ExAllocatePoolWithTag(PagedPool, sizeof(TOKEN_USER), TAG_SE); - TokenUserInfo->User.Sid = ServerSid; + Status = SeQueryInformationToken(Token, TokenUser, (PVOID*)&TokenUserInfo); PsDereferencePrimaryToken(Token); /* Check for success */ if (NT_SUCCESS(Status)) { /* Compare the SIDs */ - if (!RtlEqualSid(ServerSid, TokenUserInfo->User.Sid)) + if (!RtlEqualSid(CapturedServerSid, TokenUserInfo->User.Sid)) { /* Fail */ Status = STATUS_SERVER_SID_MISMATCH; @@ -188,6 +292,10 @@ /* Invalid SID */ Status = STATUS_SERVER_SID_MISMATCH; } + + /* Finally release the captured SID, we don't need it anymore */ + if (CapturedServerSid != ServerSid) + SepReleaseSid(CapturedServerSid, PreviousMode, TRUE); /* Check if SID failed */ if (!NT_SUCCESS(Status)) @@ -215,17 +323,20 @@ return Status; } - /* Setup the client port */ + /* + * Setup the client port -- From now on, dereferencing the client port + * will automatically dereference the connection port too. + */ RtlZeroMemory(ClientPort, sizeof(LPCP_PORT_OBJECT)); ClientPort->Flags = LPCP_CLIENT_PORT; ClientPort->ConnectionPort = Port; ClientPort->MaxMessageLength = Port->MaxMessageLength; - ClientPort->SecurityQos = *Qos; + ClientPort->SecurityQos = CapturedQos; InitializeListHead(&ClientPort->LpcReplyChainHead); InitializeListHead(&ClientPort->LpcDataInfoChainHead); /* Check if we have dynamic security */ - if (Qos->ContextTrackingMode == SECURITY_DYNAMIC_TRACKING) + if (CapturedQos.ContextTrackingMode == SECURITY_DYNAMIC_TRACKING) { /* Remember that */ ClientPort->Flags |= LPCP_SECURITY_DYNAMIC; @@ -234,7 +345,7 @@ { /* Create our own client security */ Status = SeCreateClientSecurity(Thread, - Qos, + &CapturedQos, FALSE, &ClientPort->StaticSecurity); if (!NT_SUCCESS(Status)) @@ -258,7 +369,7 @@ if (ClientView) { /* Get the section handle */ - Status = ObReferenceObjectByHandle(ClientView->SectionHandle, + Status = ObReferenceObjectByHandle(CapturedClientView.SectionHandle, SECTION_MAP_READ | SECTION_MAP_WRITE, MmSectionObjectType, @@ -268,12 +379,12 @@ if (!NT_SUCCESS(Status)) { /* Fail */ - ObDereferenceObject(Port); + ObDereferenceObject(ClientPort); return Status; } /* Set the section offset */ - SectionOffset.QuadPart = ClientView->SectionOffset; + SectionOffset.QuadPart = CapturedClientView.SectionOffset; /* Map it */ Status = MmMapViewOfSection(SectionToMap, @@ -282,25 +393,25 @@ 0, 0, &SectionOffset, - &ClientView->ViewSize, + &CapturedClientView.ViewSize, ViewUnmap, 0, PAGE_READWRITE); /* Update the offset */ - ClientView->SectionOffset = SectionOffset.LowPart; + CapturedClientView.SectionOffset = SectionOffset.LowPart; /* Check for failure */ if (!NT_SUCCESS(Status)) { /* Fail */ ObDereferenceObject(SectionToMap); - ObDereferenceObject(Port); + ObDereferenceObject(ClientPort); return Status; } /* Update the base */ - ClientView->ViewBase = ClientPort->ClientSectionBase; + CapturedClientView.ViewBase = ClientPort->ClientSectionBase; /* Reference and remember the process */ ClientPort->MappingProcess = PsGetCurrentProcess(); @@ -337,12 +448,12 @@ if (ClientView) { /* Set the view size */ - Message->Request.ClientViewSize = ClientView->ViewSize; + Message->Request.ClientViewSize = CapturedClientView.ViewSize; /* Copy the client view and clear the server view */ RtlCopyMemory(&ConnectMessage->ClientView, - ClientView, - sizeof(PORT_VIEW)); + &CapturedClientView, + sizeof(CapturedClientView)); RtlZeroMemory(&ConnectMessage->ServerView, sizeof(REMOTE_PORT_VIEW)); } else @@ -366,11 +477,32 @@ /* Check if we have connection information */ if (ConnectionInformation) { - /* Copy it in */ - RtlCopyMemory(ConnectMessage + 1, - ConnectionInformation, - ConnectionInfoLength); - } + _SEH2_TRY + { + /* Copy it in */ + RtlCopyMemory(ConnectMessage + 1, + ConnectionInformation, + ConnectionInfoLength); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + /* Cleanup and return the exception code */ + + /* Free the message we have */ + LpcpFreeToPortZone(Message, 0); + + /* Dereference other objects */ + if (SectionToMap) ObDereferenceObject(SectionToMap); + ObDereferenceObject(ClientPort); + + /* Return status */ + _SEH2_YIELD(return _SEH2_GetExceptionCode()); + } + _SEH2_END; + } + + /* Reset the status code */ + Status = STATUS_SUCCESS; /* Acquire the port lock */ KeAcquireGuardedMutex(&LpcpLock); @@ -433,11 +565,25 @@ LpcpConnectWait(&Thread->LpcReplySemaphore, PreviousMode); } + /* Now, always free the connection message */ + SectionToMap = LpcpFreeConMsg(&Message, &ConnectMessage, Thread); + /* Check for failure */ - if (!NT_SUCCESS(Status)) goto Cleanup; - - /* Free the connection message */ - SectionToMap = LpcpFreeConMsg(&Message, &ConnectMessage, Thread); + if (!NT_SUCCESS(Status)) + { + /* Check if the semaphore got signaled in the meantime */ + if (KeReadStateSemaphore(&Thread->LpcReplySemaphore)) + { + /* Wait on it */ + KeWaitForSingleObject(&Thread->LpcReplySemaphore, + WrExecutive, + KernelMode, + FALSE, + NULL); + } + + goto Failure; + } /* Check if we got a message back */ if (Message) @@ -451,20 +597,27 @@ sizeof(LPCP_CONNECTION_MESSAGE); } - /* Check if we had connection information */ + /* Check if the caller had connection information */ if (ConnectionInformation) { - /* Check if we had a length pointer */ - if (ConnectionInformationLength) - { - /* Return the length */ - *ConnectionInformationLength = ConnectionInfoLength; - } - - /* Return the connection information */ - RtlCopyMemory(ConnectionInformation, - ConnectMessage + 1, - ConnectionInfoLength ); + _SEH2_TRY + { + /* Return the connection information length if needed */ + if (ConnectionInformationLength) + *ConnectionInformationLength = ConnectionInfoLength; + + /* Return the connection information */ + RtlCopyMemory(ConnectionInformation, + ConnectMessage + 1, + ConnectionInfoLength); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + /* Cleanup and return the exception code */ + Status = _SEH2_GetExceptionCode(); + _SEH2_YIELD(goto Failure); + } + _SEH2_END; } /* Make sure we had a connected port */ @@ -482,33 +635,45 @@ &Handle); if (NT_SUCCESS(Status)) { - /* Return the handle */ - *PortHandle = Handle; LPCTRACE(LPC_CONNECT_DEBUG, "Handle: %p. Length: %lx\n", Handle, PortMessageLength); - /* Check if maximum length was requested */ - if (MaxMessageLength) *MaxMessageLength = PortMessageLength; - - /* Check if we had a client view */ - if (ClientView) + _SEH2_TRY { - /* Copy it back */ - RtlCopyMemory(ClientView, - &ConnectMessage->ClientView, - sizeof(PORT_VIEW)); + /* Return the handle */ + *PortHandle = Handle; + + /* Check if maximum length was requested */ + if (MaxMessageLength) + *MaxMessageLength = PortMessageLength; + + /* Check if we had a client view */ + if (ClientView) + { + /* Copy it back */ + RtlCopyMemory(ClientView, + &ConnectMessage->ClientView, + sizeof(*ClientView)); + } + + /* Check if we had a server view */ + if (ServerView) + { + /* Copy it back */ + RtlCopyMemory(ServerView, + &ConnectMessage->ServerView, + sizeof(*ServerView)); + } } - - /* Check if we had a server view */ - if (ServerView) + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - /* Copy it back */ - RtlCopyMemory(ServerView, - &ConnectMessage->ServerView, - sizeof(REMOTE_PORT_VIEW)); + /* An exception happened, close the opened handle */ + ObCloseHandle(Handle, PreviousMode); + Status = _SEH2_GetExceptionCode(); } + _SEH2_END; } } else @@ -545,39 +710,25 @@ else { /* No reply message, fail */ - if (SectionToMap) ObDereferenceObject(SectionToMap); - ObDereferenceObject(ClientPort); Status = STATUS_PORT_CONNECTION_REFUSED; - } + goto Failure; + } + + ObDereferenceObject(Port); /* Return status */ - ObDereferenceObject(Port); return Status; -Cleanup: - /* We failed, free the message */ - SectionToMap = LpcpFreeConMsg(&Message, &ConnectMessage, Thread); - - /* Check if the semaphore got signaled */ - if (KeReadStateSemaphore(&Thread->LpcReplySemaphore)) - { - /* Wait on it */ - KeWaitForSingleObject(&Thread->LpcReplySemaphore, - WrExecutive, - KernelMode, - FALSE, - NULL); - } - +Failure: /* Check if we had a message and free it */ if (Message) LpcpFreeToPortZone(Message, 0); /* Dereference other objects */ if (SectionToMap) ObDereferenceObject(SectionToMap); ObDereferenceObject(ClientPort); + ObDereferenceObject(Port); /* Return status */ - ObDereferenceObject(Port); return Status; } Modified: trunk/reactos/ntoskrnl/lpc/create.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/create.c?rev=… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/create.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/create.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -49,13 +49,14 @@ { NTSTATUS Status; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); + UNICODE_STRING CapturedObjectName, *ObjectName; PLPCP_PORT_OBJECT Port; HANDLE Handle; - PUNICODE_STRING ObjectName; - BOOLEAN NoName; PAGED_CODE(); LPCTRACE(LPC_CREATE_DEBUG, "Name: %wZ\n", ObjectAttributes->ObjectName); + + RtlInitEmptyUnicodeString(&CapturedObjectName, NULL, 0); /* Check if the call comes from user mode */ if (PreviousMode != KernelMode) @@ -65,15 +66,14 @@ /* Probe the PortHandle */ ProbeForWriteHandle(PortHandle); - /* Probe the ObjectAttributes */ - ProbeForRead(ObjectAttributes, sizeof(OBJECT_ATTRIBUTES), sizeof(ULONG)); - - /* Get the object name and probe the unicode string */ - ObjectName = ObjectAttributes->ObjectName; - ProbeForRead(ObjectName, sizeof(UNICODE_STRING), 1); - - /* Check if we have no name */ - NoName = (ObjectName->Buffer == NULL) || (ObjectName->Length == 0); + /* Probe the ObjectAttributes and its object name (not the buffer) */ + ProbeForRead(ObjectAttributes, sizeof(*ObjectAttributes), sizeof(ULONG)); + ObjectName = ((volatile OBJECT_ATTRIBUTES*)ObjectAttributes)->ObjectName; + if (ObjectName) + { + ProbeForRead(ObjectName, sizeof(*ObjectName), 1); + CapturedObjectName = *(volatile UNICODE_STRING*)ObjectName; + } } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { @@ -84,10 +84,13 @@ } else { - /* Check if we have no name */ - NoName = (ObjectAttributes->ObjectName->Buffer == NULL) || - (ObjectAttributes->ObjectName->Length == 0); - } + if (ObjectAttributes->ObjectName) + CapturedObjectName = *(ObjectAttributes->ObjectName); + } + + /* Normalize the buffer pointer in case we don't have a name */ + if (CapturedObjectName.Length == 0) + CapturedObjectName.Buffer = NULL; /* Create the Object */ Status = ObCreateObject(PreviousMode, @@ -109,7 +112,7 @@ InitializeListHead(&Port->LpcReplyChainHead); /* Check if we don't have a name */ - if (NoName) + if (CapturedObjectName.Buffer == NULL) { /* Set up for an unconnected port */ Port->Flags = LPCP_UNCONNECTED_PORT; @@ -187,7 +190,8 @@ } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - ObCloseHandle(Handle, UserMode); + /* An exception happened, close the opened handle */ + ObCloseHandle(Handle, PreviousMode); Status = _SEH2_GetExceptionCode(); } _SEH2_END; Modified: trunk/reactos/ntoskrnl/lpc/listen.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/listen.c?rev=… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/listen.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/listen.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -36,13 +36,22 @@ NULL, ConnectMessage); - /* Accept only LPC_CONNECTION_REQUEST requests */ - if ((Status != STATUS_SUCCESS) || - (LpcpGetMessageType(ConnectMessage) == LPC_CONNECTION_REQUEST)) + _SEH2_TRY { - /* Break out */ - break; + /* Accept only LPC_CONNECTION_REQUEST requests */ + if ((Status != STATUS_SUCCESS) || + (LpcpGetMessageType(ConnectMessage) == LPC_CONNECTION_REQUEST)) + { + /* Break out */ + _SEH2_YIELD(break); + } } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + Status = _SEH2_GetExceptionCode(); + _SEH2_YIELD(break); + } + _SEH2_END; } /* Return status */ Modified: trunk/reactos/ntoskrnl/lpc/port.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/port.c?rev=73… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/port.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/port.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -136,27 +136,25 @@ PAGED_CODE(); - /* Check the previous mode */ - PreviousMode = ExGetPreviousMode(); - if (PreviousMode == KernelMode) - { - ClientId = ClientMessage->ClientId; - MessageId = ClientMessage->MessageId; - } - else + /* Check if the call comes from user mode */ + if (PreviousMode != KernelMode) { _SEH2_TRY { ProbeForRead(ClientMessage, sizeof(*ClientMessage), sizeof(PVOID)); - ClientId = ClientMessage->ClientId; - MessageId = ClientMessage->MessageId; + ClientId = ((volatile PORT_MESSAGE*)ClientMessage)->ClientId; + MessageId = ((volatile PORT_MESSAGE*)ClientMessage)->MessageId; } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - DPRINT1("Got exception!\n"); _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; + } + else + { + ClientId = ClientMessage->ClientId; + MessageId = ClientMessage->MessageId; } /* Reference the port handle */ Modified: trunk/reactos/ntoskrnl/lpc/reply.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/reply.c?rev=7… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/reply.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/reply.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -192,7 +192,7 @@ { NTSTATUS Status; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); - // PORT_MESSAGE CapturedReplyMessage; + PORT_MESSAGE CapturedReplyMessage; PLPCP_PORT_OBJECT Port; PLPCP_MESSAGE Message; PETHREAD Thread = PsGetCurrentThread(), WakeupThread; @@ -203,32 +203,35 @@ PortHandle, ReplyMessage); - if (KeGetPreviousMode() == UserMode) + /* Check if the call comes from user mode */ + if (PreviousMode != KernelMode) { _SEH2_TRY { - ProbeForRead(ReplyMessage, sizeof(PORT_MESSAGE), sizeof(ULONG)); - /*RtlCopyMemory(&CapturedReplyMessage, ReplyMessage, sizeof(PORT_MESSAGE)); - ReplyMessage = &CapturedReplyMessage;*/ - } - _SEH2_EXCEPT(ExSystemExceptionFilter()) - { - DPRINT1("SEH crash [1]\n"); + ProbeForRead(ReplyMessage, sizeof(*ReplyMessage), sizeof(ULONG)); + CapturedReplyMessage = *(volatile PORT_MESSAGE*)ReplyMessage; + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; } + else + { + CapturedReplyMessage = *ReplyMessage; + } /* Validate its length */ - if (((ULONG)ReplyMessage->u1.s1.DataLength + sizeof(PORT_MESSAGE)) > - (ULONG)ReplyMessage->u1.s1.TotalLength) + if (((ULONG)CapturedReplyMessage.u1.s1.DataLength + sizeof(PORT_MESSAGE)) > + (ULONG)CapturedReplyMessage.u1.s1.TotalLength) { /* Fail */ return STATUS_INVALID_PARAMETER; } /* Make sure it has a valid ID */ - if (!ReplyMessage->MessageId) return STATUS_INVALID_PARAMETER; + if (!CapturedReplyMessage.MessageId) return STATUS_INVALID_PARAMETER; /* Get the Port object */ Status = ObReferenceObjectByHandle(PortHandle, @@ -240,9 +243,9 @@ if (!NT_SUCCESS(Status)) return Status; /* Validate its length in respect to the port object */ - if (((ULONG)ReplyMessage->u1.s1.TotalLength > Port->MaxMessageLength) || - ((ULONG)ReplyMessage->u1.s1.TotalLength <= - (ULONG)ReplyMessage->u1.s1.DataLength)) + if (((ULONG)CapturedReplyMessage.u1.s1.TotalLength > Port->MaxMessageLength) || + ((ULONG)CapturedReplyMessage.u1.s1.TotalLength <= + (ULONG)CapturedReplyMessage.u1.s1.DataLength)) { /* Too large, fail */ ObDereferenceObject(Port); @@ -250,7 +253,7 @@ } /* Get the ETHREAD corresponding to it */ - Status = PsLookupProcessThreadByCid(&ReplyMessage->ClientId, + Status = PsLookupProcessThreadByCid(&CapturedReplyMessage.ClientId, NULL, &WakeupThread); if (!NT_SUCCESS(Status)) @@ -274,7 +277,7 @@ KeAcquireGuardedMutex(&LpcpLock); /* Make sure this is the reply the thread is waiting for */ - if ((WakeupThread->LpcReplyMessageId != ReplyMessage->MessageId) || + if ((WakeupThread->LpcReplyMessageId != CapturedReplyMessage.MessageId) || ((LpcpGetMessageFromThread(WakeupThread)) && (LpcpGetMessageType(&LpcpGetMessageFromThread(WakeupThread)-> Request) != LPC_REQUEST))) @@ -290,7 +293,7 @@ _SEH2_TRY { LpcpMoveMessage(&Message->Request, - ReplyMessage, + &CapturedReplyMessage, ReplyMessage + 1, LPC_REPLY, NULL); @@ -324,7 +327,7 @@ /* Check if this is the message the thread had received */ if ((Thread->LpcReceivedMsgIdValid) && - (Thread->LpcReceivedMessageId == ReplyMessage->MessageId)) + (Thread->LpcReceivedMessageId == CapturedReplyMessage.MessageId)) { /* Clear this data */ Thread->LpcReceivedMessageId = 0; @@ -333,9 +336,9 @@ /* Free any data information */ LpcpFreeDataInfoMessage(Port, - ReplyMessage->MessageId, - ReplyMessage->CallbackId, - ReplyMessage->ClientId); + CapturedReplyMessage.MessageId, + CapturedReplyMessage.CallbackId, + CapturedReplyMessage.ClientId); /* Release the lock and release the LPC semaphore to wake up waiters */ KeReleaseGuardedMutex(&LpcpLock); @@ -362,7 +365,7 @@ { NTSTATUS Status; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(), WaitMode = PreviousMode; - // PORT_MESSAGE CapturedReplyMessage; + PORT_MESSAGE CapturedReplyMessage; LARGE_INTEGER CapturedTimeout; PLPCP_PORT_OBJECT Port, ReceivePort, ConnectionPort = NULL; PLPCP_MESSAGE Message; @@ -378,30 +381,29 @@ ReceiveMessage, PortContext); - if (KeGetPreviousMode() == UserMode) + /* Check if the call comes from user mode */ + if (PreviousMode != KernelMode) { _SEH2_TRY { + if (PortContext != NULL) + ProbeForWritePointer(PortContext); + if (ReplyMessage != NULL) { - ProbeForRead(ReplyMessage, sizeof(PORT_MESSAGE), sizeof(ULONG)); - /*RtlCopyMemory(&CapturedReplyMessage, ReplyMessage, sizeof(PORT_MESSAGE)); - ReplyMessage = &CapturedReplyMessage;*/ + ProbeForRead(ReplyMessage, sizeof(*ReplyMessage), sizeof(ULONG)); + CapturedReplyMessage = *(volatile PORT_MESSAGE*)ReplyMessage; } if (Timeout != NULL) { ProbeForReadLargeInteger(Timeout); - RtlCopyMemory(&CapturedTimeout, Timeout, sizeof(LARGE_INTEGER)); + CapturedTimeout = *(volatile LARGE_INTEGER*)Timeout; Timeout = &CapturedTimeout; } - - if (PortContext != NULL) - ProbeForWritePointer(PortContext); - } - _SEH2_EXCEPT(ExSystemExceptionFilter()) - { - DPRINT1("SEH crash [1]\n"); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; @@ -410,21 +412,24 @@ { /* If this is a system thread, then let it page out its stack */ if (Thread->SystemThread) WaitMode = UserMode; + + if (ReplyMessage != NULL) + CapturedReplyMessage = *ReplyMessage; } /* Check if caller has a reply message */ if (ReplyMessage) { /* Validate its length */ - if (((ULONG)ReplyMessage->u1.s1.DataLength + sizeof(PORT_MESSAGE)) > - (ULONG)ReplyMessage->u1.s1.TotalLength) + if (((ULONG)CapturedReplyMessage.u1.s1.DataLength + sizeof(PORT_MESSAGE)) > + (ULONG)CapturedReplyMessage.u1.s1.TotalLength) { /* Fail */ return STATUS_INVALID_PARAMETER; } /* Make sure it has a valid ID */ - if (!ReplyMessage->MessageId) return STATUS_INVALID_PARAMETER; + if (!CapturedReplyMessage.MessageId) return STATUS_INVALID_PARAMETER; } /* Get the Port object */ @@ -440,9 +445,9 @@ if (ReplyMessage) { /* Validate its length in respect to the port object */ - if (((ULONG)ReplyMessage->u1.s1.TotalLength > Port->MaxMessageLength) || - ((ULONG)ReplyMessage->u1.s1.TotalLength <= - (ULONG)ReplyMessage->u1.s1.DataLength)) + if (((ULONG)CapturedReplyMessage.u1.s1.TotalLength > Port->MaxMessageLength) || + ((ULONG)CapturedReplyMessage.u1.s1.TotalLength <= + (ULONG)CapturedReplyMessage.u1.s1.DataLength)) { /* Too large, fail */ ObDereferenceObject(Port); @@ -490,7 +495,7 @@ if (ReplyMessage) { /* Get the ETHREAD corresponding to it */ - Status = PsLookupProcessThreadByCid(&ReplyMessage->ClientId, + Status = PsLookupProcessThreadByCid(&CapturedReplyMessage.ClientId, NULL, &WakeupThread); if (!NT_SUCCESS(Status)) @@ -516,7 +521,7 @@ KeAcquireGuardedMutex(&LpcpLock); /* Make sure this is the reply the thread is waiting for */ - if ((WakeupThread->LpcReplyMessageId != ReplyMessage->MessageId) || + if ((WakeupThread->LpcReplyMessageId != CapturedReplyMessage.MessageId) || ((LpcpGetMessageFromThread(WakeupThread)) && (LpcpGetMessageType(&LpcpGetMessageFromThread(WakeupThread)->Request) != LPC_REQUEST))) @@ -530,11 +535,24 @@ } /* Copy the message */ - LpcpMoveMessage(&Message->Request, - ReplyMessage, - ReplyMessage + 1, - LPC_REPLY, - NULL); + _SEH2_TRY + { + LpcpMoveMessage(&Message->Request, + &CapturedReplyMessage, + ReplyMessage + 1, + LPC_REPLY, + NULL); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + /* Cleanup and return the exception code */ + LpcpFreeToPortZone(Message, LPCP_LOCK_HELD | LPCP_LOCK_RELEASE); + if (ConnectionPort) ObDereferenceObject(ConnectionPort); + ObDereferenceObject(WakeupThread); + ObDereferenceObject(Port); + _SEH2_YIELD(return _SEH2_GetExceptionCode()); + } + _SEH2_END; /* Reference the thread while we use it */ ObReferenceObject(WakeupThread); @@ -555,7 +573,7 @@ /* Check if this is the message the thread had received */ if ((Thread->LpcReceivedMsgIdValid) && - (Thread->LpcReceivedMessageId == ReplyMessage->MessageId)) + (Thread->LpcReceivedMessageId == CapturedReplyMessage.MessageId)) { /* Clear this data */ Thread->LpcReceivedMessageId = 0; @@ -564,9 +582,9 @@ /* Free any data information */ LpcpFreeDataInfoMessage(Port, - ReplyMessage->MessageId, - ReplyMessage->CallbackId, - ReplyMessage->ClientId); + CapturedReplyMessage.MessageId, + CapturedReplyMessage.CallbackId, + CapturedReplyMessage.ClientId); /* Release the lock and release the LPC semaphore to wake up waiters */ KeReleaseGuardedMutex(&LpcpLock); @@ -688,9 +706,8 @@ ASSERT(FALSE); } } - _SEH2_EXCEPT(ExSystemExceptionFilter()) - { - DPRINT1("SEH crash [2]\n"); + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { Status = _SEH2_GetExceptionCode(); } _SEH2_END; @@ -771,25 +788,23 @@ PAGED_CODE(); - /* Check the previous mode */ - PreviousMode = ExGetPreviousMode(); - if (PreviousMode == KernelMode) + /* Check if the call comes from user mode */ + if (PreviousMode != KernelMode) + { + _SEH2_TRY + { + ProbeForRead(Message, sizeof(*Message), sizeof(PVOID)); + CapturedMessage = *(volatile PORT_MESSAGE*)Message; + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + _SEH2_YIELD(return _SEH2_GetExceptionCode()); + } + _SEH2_END; + } + else { CapturedMessage = *Message; - } - else - { - _SEH2_TRY - { - ProbeForRead(Message, sizeof(*Message), sizeof(PVOID)); - CapturedMessage = *Message; - } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) - { - DPRINT1("Got exception!\n"); - _SEH2_YIELD(return _SEH2_GetExceptionCode()); - } - _SEH2_END; } /* Make sure there is any data to copy */ Modified: trunk/reactos/ntoskrnl/lpc/send.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/send.c?rev=73… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/send.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/send.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -461,9 +461,8 @@ _SEH2_TRY { /* Probe and capture the LpcRequest */ - ProbeForRead(LpcRequest, sizeof(PORT_MESSAGE), sizeof(ULONG)); - ProbeForRead(LpcRequest, LpcRequest->u1.s1.TotalLength, sizeof(ULONG)); - CapturedLpcRequest = *LpcRequest; + ProbeForRead(LpcRequest, sizeof(*LpcRequest), sizeof(ULONG)); + CapturedLpcRequest = *(volatile PORT_MESSAGE*)LpcRequest; } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { @@ -523,7 +522,7 @@ { /* Copy it */ LpcpMoveMessage(&Message->Request, - LpcRequest, + &CapturedLpcRequest, LpcRequest + 1, MessageType, &Thread->Cid); @@ -725,10 +724,9 @@ { _SEH2_TRY { - /* Probe the full request message and copy the base structure */ + /* Probe and capture the LpcRequest */ ProbeForRead(LpcRequest, sizeof(*LpcRequest), sizeof(ULONG)); - ProbeForRead(LpcRequest, LpcRequest->u1.s1.TotalLength, sizeof(ULONG)); - CapturedLpcRequest = *LpcRequest; + CapturedLpcRequest = *(volatile PORT_MESSAGE*)LpcRequest; /* Probe the reply message for write */ ProbeForWrite(LpcReply, sizeof(*LpcReply), sizeof(ULONG));

8 years, 1 month

[hbelusca] 73163: [NTOS:LPC]: Fix the function prototypes (reference: Process Hacker + how the parameters are used in the code). [NOTS][NDK]: Fix whitespace in header files. [XDK]: Define PORT_MAXI...

by hbelusca＠svn.reactos.org

Author: hbelusca Date: Mon Nov 7 01:06:24 2016 New Revision: 73163 URL: http://svn.reactos.org/svn/reactos?rev=73163&view=rev Log: [NTOS:LPC]: Fix the function prototypes (reference: Process Hacker + how the parameters are used in the code). [NOTS][NDK]: Fix whitespace in header files. [XDK]: Define PORT_MAXIMUM_MESSAGE_LENGTH before actually using it in the different IO_ERROR_LOG_xxx #defines, for consistency purposes. Modified: trunk/reactos/ntoskrnl/include/internal/io_x.h trunk/reactos/ntoskrnl/lpc/complete.c trunk/reactos/ntoskrnl/lpc/connect.c trunk/reactos/sdk/include/ndk/iotypes.h trunk/reactos/sdk/include/ndk/lpcfuncs.h trunk/reactos/sdk/include/xdk/iotypes.h Modified: trunk/reactos/ntoskrnl/include/internal/io_x.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/include/internal/… ============================================================================== --- trunk/reactos/ntoskrnl/include/internal/io_x.h [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/include/internal/io_x.h [iso-8859-1] Mon Nov 7 01:06:24 2016 @@ -11,7 +11,7 @@ VOID IopLockFileObject(IN PFILE_OBJECT FileObject) { - /* Lock the FO and check for contention */ + /* Lock the FO and check for contention */ InterlockedIncrement((PLONG)&FileObject->Waiters); while (InterlockedCompareExchange((PLONG)&FileObject->Busy, TRUE, FALSE) != FALSE) { Modified: trunk/reactos/ntoskrnl/lpc/complete.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/complete.c?re… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] Mon Nov 7 01:06:24 2016 @@ -41,8 +41,8 @@ IN PVOID PortContext OPTIONAL, IN PPORT_MESSAGE ReplyMessage, IN BOOLEAN AcceptConnection, - IN PPORT_VIEW ServerView, - IN PREMOTE_PORT_VIEW ClientView) + IN OUT PPORT_VIEW ServerView OPTIONAL, + OUT PREMOTE_PORT_VIEW ClientView OPTIONAL) { NTSTATUS Status; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); Modified: trunk/reactos/ntoskrnl/lpc/connect.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/connect.c?rev… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] Mon Nov 7 01:06:24 2016 @@ -79,7 +79,7 @@ NTAPI NtSecureConnectPort(OUT PHANDLE PortHandle, IN PUNICODE_STRING PortName, - IN PSECURITY_QUALITY_OF_SERVICE Qos, + IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, IN OUT PPORT_VIEW ClientView OPTIONAL, IN PSID ServerSid OPTIONAL, IN OUT PREMOTE_PORT_VIEW ServerView OPTIONAL, @@ -103,9 +103,9 @@ PAGED_CODE(); LPCTRACE(LPC_CONNECT_DEBUG, - "Name: %wZ. Qos: %p. Views: %p/%p. Sid: %p\n", + "Name: %wZ. SecurityQos: %p. Views: %p/%p. Sid: %p\n", PortName, - Qos, + SecurityQos, ClientView, ServerView, ServerSid); @@ -588,17 +588,17 @@ NTAPI NtConnectPort(OUT PHANDLE PortHandle, IN PUNICODE_STRING PortName, - IN PSECURITY_QUALITY_OF_SERVICE Qos, - IN PPORT_VIEW ClientView, - IN PREMOTE_PORT_VIEW ServerView, - OUT PULONG MaxMessageLength, - IN PVOID ConnectionInformation, - OUT PULONG ConnectionInformationLength) + IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, + IN OUT PPORT_VIEW ClientView OPTIONAL, + IN OUT PREMOTE_PORT_VIEW ServerView OPTIONAL, + OUT PULONG MaxMessageLength OPTIONAL, + IN OUT PVOID ConnectionInformation OPTIONAL, + IN OUT PULONG ConnectionInformationLength OPTIONAL) { /* Call the newer API */ return NtSecureConnectPort(PortHandle, PortName, - Qos, + SecurityQos, ClientView, NULL, ServerView, Modified: trunk/reactos/sdk/include/ndk/iotypes.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/sdk/include/ndk/iotypes.h?… ============================================================================== --- trunk/reactos/sdk/include/ndk/iotypes.h [iso-8859-1] (original) +++ trunk/reactos/sdk/include/ndk/iotypes.h [iso-8859-1] Mon Nov 7 01:06:24 2016 @@ -722,7 +722,7 @@ ULONG IoControlCode; LARGE_INTEGER DeviceOffset; ULONG DumpData[1]; -}IO_ERROR_LOG_PACKET, *PIO_ERROR_LOG_PACKET; +} IO_ERROR_LOG_PACKET, *PIO_ERROR_LOG_PACKET; typedef struct _IO_ERROR_LOG_MESSAGE { Modified: trunk/reactos/sdk/include/ndk/lpcfuncs.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/sdk/include/ndk/lpcfuncs.h… ============================================================================== --- trunk/reactos/sdk/include/ndk/lpcfuncs.h [iso-8859-1] (original) +++ trunk/reactos/sdk/include/ndk/lpcfuncs.h [iso-8859-1] Mon Nov 7 01:06:24 2016 @@ -56,8 +56,8 @@ _In_opt_ PVOID PortContext, _In_ PPORT_MESSAGE ConnectionRequest, _In_ BOOLEAN AcceptConnection, - _In_opt_ PPORT_VIEW ServerView, - _In_opt_ PREMOTE_PORT_VIEW ClientView + _Inout_opt_ PPORT_VIEW ServerView, + _Out_opt_ PREMOTE_PORT_VIEW ClientView ); NTSYSCALLAPI @@ -74,11 +74,11 @@ _Out_ PHANDLE PortHandle, _In_ PUNICODE_STRING PortName, _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos, - _In_opt_ PPORT_VIEW ClientView, - _In_opt_ PREMOTE_PORT_VIEW ServerView, - _In_opt_ PULONG MaxMessageLength, - _In_opt_ PVOID ConnectionInformation, - _In_opt_ PULONG ConnectionInformationLength + _Inout_opt_ PPORT_VIEW ClientView, + _Inout_opt_ PREMOTE_PORT_VIEW ServerView, + _Out_opt_ PULONG MaxMessageLength, + _Inout_opt_ PVOID ConnectionInformation, + _Inout_opt_ PULONG ConnectionInformationLength ); NTSYSCALLAPI @@ -209,12 +209,12 @@ _Out_ PHANDLE PortHandle, _In_ PUNICODE_STRING PortName, _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos, - _In_opt_ PPORT_VIEW ClientView, - _In_opt_ PSID Sid, - _In_opt_ PREMOTE_PORT_VIEW ServerView, - _In_opt_ PULONG MaxMessageLength, - _In_opt_ PVOID ConnectionInformation, - _Out_opt_ PULONG ConnectionInformationLength + _Inout_opt_ PPORT_VIEW ClientView, + _In_opt_ PSID ServerSid, + _Inout_opt_ PREMOTE_PORT_VIEW ServerView, + _Out_opt_ PULONG MaxMessageLength, + _Inout_opt_ PVOID ConnectionInformation, + _Inout_opt_ PULONG ConnectionInformationLength ); NTSYSCALLAPI Modified: trunk/reactos/sdk/include/xdk/iotypes.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/sdk/include/xdk/iotypes.h?… ============================================================================== --- trunk/reactos/sdk/include/xdk/iotypes.h [iso-8859-1] (original) +++ trunk/reactos/sdk/include/xdk/iotypes.h [iso-8859-1] Mon Nov 7 01:06:24 2016 @@ -1973,6 +1973,13 @@ IO_ERROR_LOG_PACKET EntryData; } IO_ERROR_LOG_MESSAGE, *PIO_ERROR_LOG_MESSAGE; +/* See ndk/lpctypes.h */ +#ifdef _WIN64 +#define PORT_MAXIMUM_MESSAGE_LENGTH 512 +#else +#define PORT_MAXIMUM_MESSAGE_LENGTH 256 +#endif + #define ERROR_LOG_LIMIT_SIZE 240 #define IO_ERROR_LOG_MESSAGE_HEADER_LENGTH (sizeof(IO_ERROR_LOG_MESSAGE) - \ sizeof(IO_ERROR_LOG_PACKET) + \ @@ -1985,12 +1992,6 @@ PORT_MAXIMUM_MESSAGE_LENGTH) #define ERROR_LOG_MAXIMUM_SIZE (IO_ERROR_LOG_MESSAGE_LENGTH - \ IO_ERROR_LOG_MESSAGE_HEADER_LENGTH) - -#ifdef _WIN64 -#define PORT_MAXIMUM_MESSAGE_LENGTH 512 -#else -#define PORT_MAXIMUM_MESSAGE_LENGTH 256 -#endif typedef enum _DMA_WIDTH { Width8Bits,

8 years, 1 month

[hbelusca] 73162: [NTOS:LPC]: Improve the lisibility of some functions: - Group together the local parameters used for capturing user variables; - Add some space between the list of parameters and ...

by hbelusca＠svn.reactos.org

Author: hbelusca Date: Mon Nov 7 00:55:34 2016 New Revision: 73162 URL: http://svn.reactos.org/svn/reactos?rev=73162&view=rev Log: [NTOS:LPC]: Improve the lisibility of some functions: - Group together the local parameters used for capturing user variables; - Add some space between the list of parameters and the beginning of the code proper; - Rename some variables or move some code to make some different functions look more similar (helps in finding functionality-similar functions in the code); - Improve some comments; - Whitespace fixes; - Few code formatting. - Use a ExFreePoolWithTag instead of ExFreePool, but otherwise no other functional code changes. Modified: trunk/reactos/ntoskrnl/lpc/close.c trunk/reactos/ntoskrnl/lpc/complete.c trunk/reactos/ntoskrnl/lpc/connect.c trunk/reactos/ntoskrnl/lpc/create.c trunk/reactos/ntoskrnl/lpc/listen.c trunk/reactos/ntoskrnl/lpc/port.c trunk/reactos/ntoskrnl/lpc/reply.c trunk/reactos/ntoskrnl/lpc/send.c Modified: trunk/reactos/ntoskrnl/lpc/close.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/close.c?rev=7… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/close.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/close.c [iso-8859-1] Mon Nov 7 00:55:34 2016 @@ -116,6 +116,8 @@ PLPCP_MESSAGE Message; PLPCP_PORT_OBJECT ConnectionPort = NULL; PLPCP_CONNECTION_MESSAGE ConnectMessage; + PLPCP_NONPAGED_PORT_QUEUE MessageQueue; + PAGED_CODE(); LPCTRACE(LPC_CLOSE_DEBUG, "Port: %p. Flags: %lx\n", Port, Port->Flags); @@ -229,9 +231,10 @@ if (Port->MsgQueue.Semaphore) { /* Use the semaphore to find the port queue and free it */ - ExFreePool(CONTAINING_RECORD(Port->MsgQueue.Semaphore, - LPCP_NONPAGED_PORT_QUEUE, - Semaphore)); + MessageQueue = CONTAINING_RECORD(Port->MsgQueue.Semaphore, + LPCP_NONPAGED_PORT_QUEUE, + Semaphore); + ExFreePoolWithTag(MessageQueue, 'troP'); } } } @@ -245,6 +248,7 @@ IN ULONG SystemHandleCount) { PLPCP_PORT_OBJECT Port = (PLPCP_PORT_OBJECT)Object; + LPCTRACE(LPC_CLOSE_DEBUG, "Port: %p. Flags: %lx\n", Port, Port->Flags); /* Only Server-side Connection Ports need clean up*/ @@ -305,9 +309,11 @@ PLIST_ENTRY ListHead, NextEntry; HANDLE Pid; CLIENT_DIED_MSG ClientDiedMsg; - Timeout.QuadPart = -1000000; + PAGED_CODE(); LPCTRACE(LPC_CLOSE_DEBUG, "Port: %p. Flags: %lx\n", Port, Port->Flags); + + Timeout.QuadPart = -1000000; /* Check if this is a communication port */ if ((Port->Flags & LPCP_PORT_TYPE_MASK) == LPCP_COMMUNICATION_PORT) @@ -347,8 +353,8 @@ for (;;) { /* Send the message */ - if (LpcRequestPort(Port, - &ClientDiedMsg.h) != STATUS_NO_MEMORY) break; + if (LpcRequestPort(Port, &ClientDiedMsg.h) != STATUS_NO_MEMORY) + break; /* Wait until trying again */ KeDelayExecutionThread(KernelMode, FALSE, &Timeout); Modified: trunk/reactos/ntoskrnl/lpc/complete.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/complete.c?re… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] Mon Nov 7 00:55:34 2016 @@ -44,19 +44,20 @@ IN PPORT_VIEW ServerView, IN PREMOTE_PORT_VIEW ClientView) { + NTSTATUS Status; + KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); + ULONG ConnectionInfoLength; PLPCP_PORT_OBJECT ConnectionPort, ServerPort, ClientPort; + PLPCP_CONNECTION_MESSAGE ConnectMessage; + PLPCP_MESSAGE Message; PVOID ClientSectionToMap = NULL; HANDLE Handle; - KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); - NTSTATUS Status; - ULONG ConnectionInfoLength; - PLPCP_MESSAGE Message; - PLPCP_CONNECTION_MESSAGE ConnectMessage; PEPROCESS ClientProcess; PETHREAD ClientThread; LARGE_INTEGER SectionOffset; CLIENT_ID ClientId; ULONG MessageId; + PAGED_CODE(); LPCTRACE(LPC_COMPLETE_DEBUG, "Context: %p. Message: %p. Accept: %lx. Views: %p/%p\n", @@ -407,9 +408,10 @@ NtCompleteConnectPort(IN HANDLE PortHandle) { NTSTATUS Status; + KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); PLPCP_PORT_OBJECT Port; - KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); PETHREAD Thread; + PAGED_CODE(); LPCTRACE(LPC_COMPLETE_DEBUG, "Handle: %p\n", PortHandle); @@ -462,7 +464,7 @@ KeReleaseGuardedMutex(&LpcpLock); LpcpCompleteWait(&Thread->LpcReplySemaphore); - /* Dereference the Thread and Port and return */ + /* Dereference the Thread and Port and return */ ObDereferenceObject(Port); ObDereferenceObject(Thread); LPCTRACE(LPC_COMPLETE_DEBUG, "Port: %p. Thread: %p\n", Port, Thread); Modified: trunk/reactos/ntoskrnl/lpc/connect.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/connect.c?rev… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] Mon Nov 7 00:55:34 2016 @@ -87,19 +87,20 @@ IN OUT PVOID ConnectionInformation OPTIONAL, IN OUT PULONG ConnectionInformationLength OPTIONAL) { + NTSTATUS Status = STATUS_SUCCESS; + KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); + PETHREAD Thread = PsGetCurrentThread(); ULONG ConnectionInfoLength = 0; PLPCP_PORT_OBJECT Port, ClientPort; - KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); - NTSTATUS Status = STATUS_SUCCESS; + PLPCP_MESSAGE Message; + PLPCP_CONNECTION_MESSAGE ConnectMessage; + ULONG PortMessageLength; HANDLE Handle; PVOID SectionToMap; - PLPCP_MESSAGE Message; - PLPCP_CONNECTION_MESSAGE ConnectMessage; - PETHREAD Thread = PsGetCurrentThread(); - ULONG PortMessageLength; LARGE_INTEGER SectionOffset; PTOKEN Token; PTOKEN_USER TokenUserInfo; + PAGED_CODE(); LPCTRACE(LPC_CONNECT_DEBUG, "Name: %wZ. Qos: %p. Views: %p/%p. Sid: %p\n", @@ -138,7 +139,7 @@ LpcPortObjectType, PreviousMode, NULL, - (PVOID *)&Port); + (PVOID*)&Port); if (!NT_SUCCESS(Status)) { DPRINT1("Failed to reference port '%wZ': 0x%lx\n", PortName, Status); @@ -206,7 +207,7 @@ sizeof(LPCP_PORT_OBJECT), 0, 0, - (PVOID *)&ClientPort); + (PVOID*)&ClientPort); if (!NT_SUCCESS(Status)) { /* Failed, dereference the server port and return */ @@ -395,7 +396,7 @@ InsertTailList(&Port->LpcReplyChainHead, &Thread->LpcReplyChain); Thread->LpcReplyMessage = Message; - /* Now we can finally reference the client port and link it*/ + /* Now we can finally reference the client port and link it */ ObReferenceObject(ClientPort); ConnectMessage->ClientPort = ClientPort; @@ -421,15 +422,14 @@ Status); /* If this is a waitable port, set the event */ - if (Port->Flags & LPCP_WAITABLE_PORT) KeSetEvent(&Port->WaitEvent, - 1, - FALSE); + if (Port->Flags & LPCP_WAITABLE_PORT) + KeSetEvent(&Port->WaitEvent, 1, FALSE); /* Release the queue semaphore and leave the critical region */ LpcpCompleteWait(Port->MsgQueue.Semaphore); KeLeaveCriticalRegion(); - /* Now wait for a reply */ + /* Now wait for a reply and set 'Status' */ LpcpConnectWait(&Thread->LpcReplySemaphore, PreviousMode); } @@ -478,7 +478,7 @@ NULL, PORT_ALL_ACCESS, 0, - (PVOID *)NULL, + NULL, &Handle); if (NT_SUCCESS(Status)) { Modified: trunk/reactos/ntoskrnl/lpc/create.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/create.c?rev=… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/create.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/create.c [iso-8859-1] Mon Nov 7 00:55:34 2016 @@ -19,11 +19,12 @@ LpcpInitializePortQueue(IN PLPCP_PORT_OBJECT Port) { PLPCP_NONPAGED_PORT_QUEUE MessageQueue; + PAGED_CODE(); /* Allocate the queue */ MessageQueue = ExAllocatePoolWithTag(NonPagedPool, - sizeof(LPCP_NONPAGED_PORT_QUEUE), + sizeof(*MessageQueue), 'troP'); if (!MessageQueue) return STATUS_INSUFFICIENT_RESOURCES; @@ -46,12 +47,13 @@ IN ULONG MaxPoolUsage, IN BOOLEAN Waitable) { + NTSTATUS Status; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); - NTSTATUS Status; PLPCP_PORT_OBJECT Port; HANDLE Handle; PUNICODE_STRING ObjectName; BOOLEAN NoName; + PAGED_CODE(); LPCTRACE(LPC_CREATE_DEBUG, "Name: %wZ\n", ObjectAttributes->ObjectName); @@ -170,7 +172,7 @@ Port->MaxMessageLength = MaxMessageLength; /* Insert it now */ - Status = ObInsertObject((PVOID)Port, + Status = ObInsertObject(Port, NULL, PORT_ALL_ACCESS, 0, Modified: trunk/reactos/ntoskrnl/lpc/listen.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/listen.c?rev=… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/listen.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/listen.c [iso-8859-1] Mon Nov 7 00:55:34 2016 @@ -23,10 +23,11 @@ OUT PPORT_MESSAGE ConnectMessage) { NTSTATUS Status; + PAGED_CODE(); LPCTRACE(LPC_LISTEN_DEBUG, "Handle: %p\n", PortHandle); - /* Wait forever for a connection request. */ + /* Wait forever for a connection request */ for (;;) { /* Do the wait */ @@ -35,7 +36,7 @@ NULL, ConnectMessage); - /* Accept only LPC_CONNECTION_REQUEST requests. */ + /* Accept only LPC_CONNECTION_REQUEST requests */ if ((Status != STATUS_SUCCESS) || (LpcpGetMessageType(ConnectMessage) == LPC_CONNECTION_REQUEST)) { @@ -48,5 +49,4 @@ return Status; } - /* EOF */ Modified: trunk/reactos/ntoskrnl/lpc/port.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/port.c?rev=73… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/port.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/port.c [iso-8859-1] Mon Nov 7 00:55:34 2016 @@ -60,6 +60,7 @@ NULL, &LpcPortObjectType); + /* Create the Waitable Port Object Type */ RtlInitUnicodeString(&Name, L"WaitablePort"); ObjectTypeInitializer.PoolType = NonPagedPool; ObjectTypeInitializer.DefaultNonPagedPoolCharge += sizeof(LPCP_PORT_OBJECT); @@ -125,13 +126,14 @@ NtImpersonateClientOfPort(IN HANDLE PortHandle, IN PPORT_MESSAGE ClientMessage) { - KPROCESSOR_MODE PreviousMode; + NTSTATUS Status; + KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); CLIENT_ID ClientId; ULONG MessageId; PLPCP_PORT_OBJECT Port = NULL, ConnectedPort = NULL; PETHREAD ClientThread = NULL; SECURITY_CLIENT_CONTEXT ClientContext; - NTSTATUS Status; + PAGED_CODE(); /* Check the previous mode */ @@ -192,8 +194,7 @@ /* Get the connected port and try to reference it */ ConnectedPort = Port->ConnectedPort; - if ((ConnectedPort == NULL) || - !ObReferenceObjectSafe(ConnectedPort)) + if ((ConnectedPort == NULL) || !ObReferenceObjectSafe(ConnectedPort)) { DPRINT1("Failed to reference the connected port\n"); ConnectedPort = NULL; @@ -254,24 +255,23 @@ /* Get rid of the security context */ SeDeleteClientSecurity(&ClientContext); - goto Cleanup; +Cleanup: + + if (ConnectedPort != NULL) + ObDereferenceObject(ConnectedPort); + + if (ClientThread != NULL) + ObDereferenceObject(ClientThread); + + ObDereferenceObject(Port); + + return Status; CleanupWithLock: /* Release the lock */ KeReleaseGuardedMutex(&LpcpLock); - -Cleanup: - - if (ConnectedPort != NULL) - ObDereferenceObject(ConnectedPort); - - if (ClientThread != NULL) - ObDereferenceObject(ClientThread); - - ObDereferenceObject(Port); - - return Status; + goto Cleanup; } NTSTATUS Modified: trunk/reactos/ntoskrnl/lpc/reply.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/reply.c?rev=7… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/reply.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/reply.c [iso-8859-1] Mon Nov 7 00:55:34 2016 @@ -99,6 +99,7 @@ { PLPCP_MESSAGE Message; PLIST_ENTRY ListEntry; + PAGED_CODE(); /* Check if the port we want is the connection port */ @@ -141,13 +142,14 @@ IN ULONG MessageType, IN PCLIENT_ID ClientId) { - /* Set the Message size */ LPCTRACE((LPC_REPLY_DEBUG | LPC_SEND_DEBUG), "Destination/Origin: %p/%p. Data: %p. Length: %lx\n", Destination, Origin, Data, Origin->u1.Length); + + /* Set the Message size */ Destination->u1.Length = Origin->u1.Length; /* Set the Message Type */ @@ -188,12 +190,12 @@ NtReplyPort(IN HANDLE PortHandle, IN PPORT_MESSAGE ReplyMessage) { + NTSTATUS Status; + KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); + // PORT_MESSAGE CapturedReplyMessage; PLPCP_PORT_OBJECT Port; - KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); - NTSTATUS Status; PLPCP_MESSAGE Message; PETHREAD Thread = PsGetCurrentThread(), WakeupThread; - //PORT_MESSAGE CapturedReplyMessage; PAGED_CODE(); LPCTRACE(LPC_REPLY_DEBUG, @@ -274,8 +276,8 @@ /* Make sure this is the reply the thread is waiting for */ if ((WakeupThread->LpcReplyMessageId != ReplyMessage->MessageId) || ((LpcpGetMessageFromThread(WakeupThread)) && - (LpcpGetMessageType(&LpcpGetMessageFromThread(WakeupThread)-> - Request) != LPC_REQUEST))) + (LpcpGetMessageType(&LpcpGetMessageFromThread(WakeupThread)-> Request) + != LPC_REQUEST))) { /* It isn't, fail */ LpcpFreeToPortZone(Message, LPCP_LOCK_HELD | LPCP_LOCK_RELEASE); @@ -295,7 +297,7 @@ } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - /* Fail */ + /* Cleanup and return the exception code */ LpcpFreeToPortZone(Message, LPCP_LOCK_HELD | LPCP_LOCK_RELEASE); ObDereferenceObject(WakeupThread); ObDereferenceObject(Port); @@ -358,15 +360,15 @@ OUT PPORT_MESSAGE ReceiveMessage, IN PLARGE_INTEGER Timeout OPTIONAL) { + NTSTATUS Status; + KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(), WaitMode = PreviousMode; + // PORT_MESSAGE CapturedReplyMessage; + LARGE_INTEGER CapturedTimeout; PLPCP_PORT_OBJECT Port, ReceivePort, ConnectionPort = NULL; - KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(), WaitMode = PreviousMode; - NTSTATUS Status; PLPCP_MESSAGE Message; PETHREAD Thread = PsGetCurrentThread(), WakeupThread; PLPCP_CONNECTION_MESSAGE ConnectMessage; ULONG ConnectionInfoLength; - //PORT_MESSAGE CapturedReplyMessage; - LARGE_INTEGER CapturedTimeout; PAGED_CODE(); LPCTRACE(LPC_REPLY_DEBUG, @@ -516,8 +518,8 @@ /* Make sure this is the reply the thread is waiting for */ if ((WakeupThread->LpcReplyMessageId != ReplyMessage->MessageId) || ((LpcpGetMessageFromThread(WakeupThread)) && - (LpcpGetMessageType(&LpcpGetMessageFromThread(WakeupThread)-> - Request) != LPC_REQUEST))) + (LpcpGetMessageType(&LpcpGetMessageFromThread(WakeupThread)->Request) + != LPC_REQUEST))) { /* It isn't, fail */ LpcpFreeToPortZone(Message, LPCP_LOCK_HELD | LPCP_LOCK_RELEASE); @@ -599,8 +601,7 @@ } /* Get the message on the queue */ - Message = CONTAINING_RECORD(RemoveHeadList(&ReceivePort-> - MsgQueue.ReceiveHead), + Message = CONTAINING_RECORD(RemoveHeadList(&ReceivePort->MsgQueue.ReceiveHead), LPCP_MESSAGE, Entry); @@ -756,17 +757,18 @@ IN ULONG Index, IN PVOID Buffer, IN ULONG BufferLength, - OUT PULONG Returnlength) -{ - KPROCESSOR_MODE PreviousMode; + OUT PULONG ReturnLength) +{ + NTSTATUS Status; + KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); PORT_MESSAGE CapturedMessage; PLPCP_PORT_OBJECT Port = NULL; PETHREAD ClientThread = NULL; - SIZE_T LocalReturnlength; + SIZE_T LocalReturnLength; PLPCP_MESSAGE InfoMessage; PLPCP_DATA_INFO DataInfo; PVOID DataInfoBaseAddress; - NTSTATUS Status; + PAGED_CODE(); /* Check the previous mode */ @@ -889,7 +891,7 @@ DataInfoBaseAddress, BufferLength, PreviousMode, - &LocalReturnlength); + &LocalReturnLength); } else { @@ -900,7 +902,7 @@ Buffer, BufferLength, PreviousMode, - &LocalReturnlength); + &LocalReturnLength); } if (!NT_SUCCESS(Status)) @@ -910,16 +912,16 @@ } /* Check if the caller asked to return the copied length */ - if (Returnlength != NULL) + if (ReturnLength != NULL) { _SEH2_TRY { - *Returnlength = LocalReturnlength; + *ReturnLength = LocalReturnLength; } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { /* Ignore */ - DPRINT1("Exception writing Returnlength, ignoring\n"); + DPRINT1("Exception writing ReturnLength, ignoring\n"); } _SEH2_END; } @@ -941,7 +943,7 @@ } /* - * @unimplemented + * @implemented */ NTSTATUS NTAPI @@ -963,7 +965,7 @@ } /* - * @unimplemented + * @implemented */ NTSTATUS NTAPI Modified: trunk/reactos/ntoskrnl/lpc/send.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/send.c?rev=73… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/send.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/send.c [iso-8859-1] Mon Nov 7 00:55:34 2016 @@ -179,17 +179,17 @@ IN PPORT_MESSAGE LpcRequest, OUT PPORT_MESSAGE LpcReply) { - PLPCP_PORT_OBJECT Port, QueuePort, ReplyPort, ConnectionPort = NULL; + NTSTATUS Status = STATUS_SUCCESS; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); - NTSTATUS Status = STATUS_SUCCESS; + PETHREAD Thread = PsGetCurrentThread(); + PLPCP_PORT_OBJECT Port = (PLPCP_PORT_OBJECT)PortObject; + PLPCP_PORT_OBJECT QueuePort, ReplyPort, ConnectionPort = NULL; + USHORT MessageType; PLPCP_MESSAGE Message; - PETHREAD Thread = PsGetCurrentThread(); BOOLEAN Callback = FALSE; PKSEMAPHORE Semaphore; - USHORT MessageType; + PAGED_CODE(); - - Port = (PLPCP_PORT_OBJECT)PortObject; LPCTRACE(LPC_SEND_DEBUG, "Port: %p. Messages: %p/%p. Type: %lx\n", @@ -205,33 +205,26 @@ MessageType = LpcpGetMessageType(LpcRequest); switch (MessageType) { - /* No type */ + /* No type, assume LPC request */ case 0: - - /* Assume LPC request */ MessageType = LPC_REQUEST; break; /* LPC request callback */ case LPC_REQUEST: - - /* This is a callback */ Callback = TRUE; break; - /* Anything else */ + /* Anything else, nothing to do */ case LPC_CLIENT_DIED: case LPC_PORT_CLOSED: case LPC_EXCEPTION: case LPC_DEBUG_EVENT: case LPC_ERROR_EVENT: - - /* Nothing to do */ break; + /* Invalid message type */ default: - - /* Invalid message type */ return STATUS_INVALID_PARAMETER; } @@ -448,15 +441,14 @@ IN PPORT_MESSAGE LpcRequest) { NTSTATUS Status; + KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); + PETHREAD Thread = PsGetCurrentThread(); + PORT_MESSAGE CapturedLpcRequest; PLPCP_PORT_OBJECT Port, QueuePort, ConnectionPort = NULL; ULONG MessageType; PLPCP_MESSAGE Message; - KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); - PETHREAD Thread = PsGetCurrentThread(); - PORT_MESSAGE CapturedLpcRequest; PAGED_CODE(); - LPCTRACE(LPC_SEND_DEBUG, "Handle: %p. Message: %p. Type: %lx\n", PortHandle, @@ -538,7 +530,7 @@ } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - /* Fail */ + /* Cleanup and return the exception code */ LpcpFreeToPortZone(Message, 0); ObDereferenceObject(Port); _SEH2_YIELD(return _SEH2_GetExceptionCode()); @@ -578,8 +570,7 @@ return STATUS_PORT_DISCONNECTED; } } - else if ((Port->Flags & LPCP_PORT_TYPE_MASK) != - LPCP_COMMUNICATION_PORT) + else if ((Port->Flags & LPCP_PORT_TYPE_MASK) != LPCP_COMMUNICATION_PORT) { /* Use the connection port for anything but communication ports */ ConnectionPort = QueuePort = Port->ConnectionPort; @@ -706,17 +697,18 @@ IN PPORT_MESSAGE LpcRequest, IN OUT PPORT_MESSAGE LpcReply) { - PORT_MESSAGE LocalLpcRequest; + NTSTATUS Status; + PORT_MESSAGE CapturedLpcRequest; ULONG NumberOfDataEntries; PLPCP_PORT_OBJECT Port, QueuePort, ReplyPort, ConnectionPort = NULL; + PLPCP_MESSAGE Message; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); - NTSTATUS Status; - PLPCP_MESSAGE Message; PETHREAD Thread = PsGetCurrentThread(); BOOLEAN Callback; PKSEMAPHORE Semaphore; ULONG MessageType; PLPCP_DATA_INFO DataInfo; + PAGED_CODE(); LPCTRACE(LPC_SEND_DEBUG, "Handle: %p. Messages: %p/%p. Type: %lx\n", @@ -736,7 +728,7 @@ /* Probe the full request message and copy the base structure */ ProbeForRead(LpcRequest, sizeof(*LpcRequest), sizeof(ULONG)); ProbeForRead(LpcRequest, LpcRequest->u1.s1.TotalLength, sizeof(ULONG)); - LocalLpcRequest = *LpcRequest; + CapturedLpcRequest = *LpcRequest; /* Probe the reply message for write */ ProbeForWrite(LpcReply, sizeof(*LpcReply), sizeof(ULONG)); @@ -758,7 +750,7 @@ } else { - LocalLpcRequest = *LpcRequest; + CapturedLpcRequest = *LpcRequest; Status = LpcpVerifyMessageDataInfo(LpcRequest, &NumberOfDataEntries); if (!NT_SUCCESS(Status)) { @@ -768,15 +760,15 @@ } /* This flag is undocumented. Remove it before continuing */ - LocalLpcRequest.u2.s2.Type &= ~0x4000; + CapturedLpcRequest.u2.s2.Type &= ~0x4000; /* Check if this is an LPC Request */ - if (LpcpGetMessageType(&LocalLpcRequest) == LPC_REQUEST) + if (LpcpGetMessageType(&CapturedLpcRequest) == LPC_REQUEST) { /* Then it's a callback */ Callback = TRUE; } - else if (LpcpGetMessageType(&LocalLpcRequest)) + else if (LpcpGetMessageType(&CapturedLpcRequest)) { /* This is a not kernel-mode message */ DPRINT1("Not a kernel-mode message!\n"); @@ -785,24 +777,24 @@ else { /* This is a kernel-mode message without a callback */ - LocalLpcRequest.u2.s2.Type |= LPC_REQUEST; + CapturedLpcRequest.u2.s2.Type |= LPC_REQUEST; Callback = FALSE; } /* Get the message type */ - MessageType = LocalLpcRequest.u2.s2.Type; + MessageType = CapturedLpcRequest.u2.s2.Type; /* Due to the above probe, we know that TotalLength is positive */ - ASSERT(LocalLpcRequest.u1.s1.TotalLength >= 0); + ASSERT(CapturedLpcRequest.u1.s1.TotalLength >= 0); /* Validate the length */ - if ((((ULONG)(USHORT)LocalLpcRequest.u1.s1.DataLength + sizeof(PORT_MESSAGE)) > - (ULONG)LocalLpcRequest.u1.s1.TotalLength)) + if ((((ULONG)(USHORT)CapturedLpcRequest.u1.s1.DataLength + sizeof(PORT_MESSAGE)) > + (ULONG)CapturedLpcRequest.u1.s1.TotalLength)) { /* Fail */ DPRINT1("Invalid message length: %u, %u\n", - LocalLpcRequest.u1.s1.DataLength, - LocalLpcRequest.u1.s1.TotalLength); + CapturedLpcRequest.u1.s1.DataLength, + CapturedLpcRequest.u1.s1.TotalLength); return STATUS_INVALID_PARAMETER; } @@ -816,13 +808,13 @@ if (!NT_SUCCESS(Status)) return Status; /* Validate the message length */ - if (((ULONG)LocalLpcRequest.u1.s1.TotalLength > Port->MaxMessageLength) || - ((ULONG)LocalLpcRequest.u1.s1.TotalLength <= (ULONG)LocalLpcRequest.u1.s1.DataLength)) + if (((ULONG)CapturedLpcRequest.u1.s1.TotalLength > Port->MaxMessageLength) || + ((ULONG)CapturedLpcRequest.u1.s1.TotalLength <= (ULONG)CapturedLpcRequest.u1.s1.DataLength)) { /* Fail */ DPRINT1("Invalid message length: %u, %u\n", - LocalLpcRequest.u1.s1.DataLength, - LocalLpcRequest.u1.s1.TotalLength); + CapturedLpcRequest.u1.s1.DataLength, + CapturedLpcRequest.u1.s1.TotalLength); ObDereferenceObject(Port); return STATUS_PORT_MESSAGE_TOO_LONG; } @@ -874,7 +866,7 @@ } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - /* Fail */ + /* Cleanup and return the exception code */ DPRINT1("Got exception!\n"); LpcpFreeToPortZone(Message, 0); ObDereferenceObject(Port);

8 years, 1 month

[gadamopoulos] 73161: [SHELL32] - CShellLink: Zero the pointer to mDropTarget by releasing the smart pointer instead of just releasing the object. This lead to a crash every time CShellLink::DragLe...

by gadamopoulos＠svn.reactos.org

Author: gadamopoulos Date: Sun Nov 6 23:34:22 2016 New Revision: 73161 URL: http://svn.reactos.org/svn/reactos?rev=73161&view=rev Log: [SHELL32] - CShellLink: Zero the pointer to mDropTarget by releasing the smart pointer instead of just releasing the object. This lead to a crash every time CShellLink::DragLeave was called. CORE-11956 Modified: trunk/reactos/dll/win32/shell32/CShellLink.cpp Modified: trunk/reactos/dll/win32/shell32/CShellLink.cpp URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/shell32/CShellLi… ============================================================================== --- trunk/reactos/dll/win32/shell32/CShellLink.cpp [iso-8859-1] (original) +++ trunk/reactos/dll/win32/shell32/CShellLink.cpp [iso-8859-1] Sun Nov 6 23:34:22 2016 @@ -2248,7 +2248,7 @@ if (mDropTarget) { hr = mDropTarget->DragLeave(); - mDropTarget->Release(); + mDropTarget.Release(); } return hr;

8 years, 1 month

← Newer
1
...
22
23
24
25
26
27
28
...
32
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Ros-diffs November 2016