Ros-diffs September 2021

ros-diffs@reactos.org

25 participants
144 discussions

[reactos] 01/02: [NTOS:SE] Check the privilege count against the maximum threshold

by George Bișoc

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=199f575342a9d4383f44e… commit 199f575342a9d4383f44e9d29fa8088985dd9b9d Author: George Bișoc <george.bisoc(a)reactos.org> AuthorDate: Sun Sep 26 11:38:45 2021 +0200 Commit: George Bișoc <george.bisoc(a)reactos.org> CommitDate: Mon Sep 27 09:37:28 2021 +0200 [NTOS:SE] Check the privilege count against the maximum threshold In SeCaptureLuidAndAttributesArray we must ensure that we don't go onto a potential integer overflow scenario by checking against the maximum limit threshold the kernel states. In addition, write an explicit name macro for the value. --- ntoskrnl/se/priv.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/ntoskrnl/se/priv.c b/ntoskrnl/se/priv.c index cae9103e210..a1013b1844b 100644 --- a/ntoskrnl/se/priv.c +++ b/ntoskrnl/se/priv.c @@ -15,6 +15,8 @@ /* GLOBALS ********************************************************************/ +#define SE_MAXIMUM_PRIVILEGE_LIMIT 0x3C + #define CONST_LUID(x1, x2) {x1, x2} const LUID SeCreateTokenPrivilege = CONST_LUID(SE_CREATE_TOKEN_PRIVILEGE, 0); const LUID SeAssignPrimaryTokenPrivilege = CONST_LUID(SE_ASSIGNPRIMARYTOKEN_PRIVILEGE, 0); @@ -427,7 +429,9 @@ SeCheckAuditPrivilege( * has been captured successfully. STATUS_INSUFFICIENT_RESOURCES is returned * if memory pool allocation for the captured buffer has failed. * STATUS_BUFFER_TOO_SMALL is returned if the buffer size is less than the - * required size. + * required size. STATUS_INVALID_PARAMETER is returned if the caller has + * submitted a privilege count that exceeds that maximum threshold the + * kernel can permit, for the purpose to avoid an integer overflow. */ NTSTATUS NTAPI @@ -454,15 +458,17 @@ SeCaptureLuidAndAttributesArray( return STATUS_SUCCESS; } + if (PrivilegeCount > SE_MAXIMUM_PRIVILEGE_LIMIT) + { + return STATUS_INVALID_PARAMETER; + } + if (PreviousMode == KernelMode && !CaptureIfKernel) { *Dest = Src; return STATUS_SUCCESS; } - /* FIXME - check PrivilegeCount for a valid number so we don't - cause an integer overflow or exhaust system resources! */ - BufferSize = PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES); *Length = ROUND_UP(BufferSize, 4); /* round up to a 4 byte alignment */

3 years, 2 months

[reactos] 01/01: [IMM32] Trivial tiny improvements

by Katayama Hirofumi MZ

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=a415bd46b1066706c9888… commit a415bd46b1066706c9888473e720ff63d90e7411 Author: Katayama Hirofumi MZ <katayama.hirofumi.mz(a)gmail.com> AuthorDate: Mon Sep 27 09:37:14 2021 +0900 Commit: Katayama Hirofumi MZ <katayama.hirofumi.mz(a)gmail.com> CommitDate: Mon Sep 27 09:37:14 2021 +0900 [IMM32] Trivial tiny improvements CORE-11700 --- dll/win32/imm32/ime.c | 9 +++------ dll/win32/imm32/imm.c | 1 - 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/dll/win32/imm32/ime.c b/dll/win32/imm32/ime.c index 1fd912b1a86..99c675dbfce 100644 --- a/dll/win32/imm32/ime.c +++ b/dll/win32/imm32/ime.c @@ -172,9 +172,9 @@ BOOL APIENTRY Imm32LoadImeInfo(PIMEINFOEX pImeInfoEx, PIMEDPI pImeDpi) do { \ fn = GetProcAddress(hIME, #name); \ if (fn) pImeDpi->name = (FN_##name)fn; \ - else if (!extended) goto Failed; \ + else if (!(extended)) goto Failed; \ } while (0); -#include "../../../win32ss/include/imetable.h" +#include "imetable.h" #undef DEFINE_IME_ENTRY if (!Imm32InquireIme(pImeDpi)) @@ -346,10 +346,7 @@ BOOL WINAPI ImmDisableLegacyIME(void) */ BOOL WINAPI CtfImmIsTextFrameServiceDisabled(VOID) { - PTEB pTeb = NtCurrentTeb(); - if (((PW32CLIENTINFO)pTeb->Win32ClientInfo)->CI_flags & CI_TFSDISABLED) - return TRUE; - return FALSE; + return !!(GetWin32ClientInfo()->CI_flags & CI_TFSDISABLED); } /*********************************************************************** diff --git a/dll/win32/imm32/imm.c b/dll/win32/imm32/imm.c index 383a395f15e..135b7afc6ee 100644 --- a/dll/win32/imm32/imm.c +++ b/dll/win32/imm32/imm.c @@ -1530,7 +1530,6 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) switch (fdwReason) { case DLL_PROCESS_ATTACH: - //Imm32GenerateRandomSeed(hinstDLL, 1, lpReserved); // Non-sense if (!Imm32InitInstance(hinstDLL)) { ERR("Imm32InitInstance failed\n");

3 years, 2 months

[reactos] 01/01: [IMM32] Rewrite ImmLockIMC (#3975)

by Katayama Hirofumi MZ

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=b3382d8d24ac7f9e098ed… commit b3382d8d24ac7f9e098ed77ec1ce1f2f42d167a8 Author: Katayama Hirofumi MZ <katayama.hirofumi.mz(a)gmail.com> AuthorDate: Mon Sep 27 09:32:24 2021 +0900 Commit: GitHub <noreply(a)github.com> CommitDate: Mon Sep 27 09:32:24 2021 +0900 [IMM32] Rewrite ImmLockIMC (#3975) - Add Imm32InitContext and Imm32LockIMCEx helper functions. - Re-implement ImmLockIMC function. - Modify CLIENTIMC and INPUTCONTEXTDX structures. CORE-11700 --- dll/win32/imm32/imm.c | 216 +++++++++++++++++++++++++--- dll/win32/imm32/utils.c | 8 +- modules/rostests/apitests/imm32/clientimc.c | 8 +- sdk/include/reactos/wine/ddk/imm.h | 10 +- win32ss/include/ntuser.h | 7 +- 5 files changed, 212 insertions(+), 37 deletions(-) diff --git a/dll/win32/imm32/imm.c b/dll/win32/imm32/imm.c index 9fecb94c183..383a395f15e 100644 --- a/dll/win32/imm32/imm.c +++ b/dll/win32/imm32/imm.c @@ -354,7 +354,7 @@ BOOL APIENTRY Imm32CleanupContext(HIMC hIMC, HKL hKL, BOOL bKeep) if (!pClientImc) return FALSE; - if (pClientImc->hImc == NULL) + if (pClientImc->hInputContext == NULL) { pClientImc->dwFlags |= CLIENTIMC_UNKNOWN1; ImmUnlockClientImc(pClientImc); @@ -390,11 +390,11 @@ BOOL APIENTRY Imm32CleanupContext(HIMC hIMC, HKL hKL, BOOL bKeep) pClientImc->hKL = NULL; } - ImmDestroyIMCC(pIC->hPrivate); - ImmDestroyIMCC(pIC->hMsgBuf); - ImmDestroyIMCC(pIC->hGuideLine); - ImmDestroyIMCC(pIC->hCandInfo); - ImmDestroyIMCC(pIC->hCompStr); + pIC->hPrivate = ImmDestroyIMCC(pIC->hPrivate); + pIC->hMsgBuf = ImmDestroyIMCC(pIC->hMsgBuf); + pIC->hGuideLine = ImmDestroyIMCC(pIC->hGuideLine); + pIC->hCandInfo = ImmDestroyIMCC(pIC->hCandInfo); + pIC->hCompStr = ImmDestroyIMCC(pIC->hCompStr); Imm32CleanupContextExtra(pIC); @@ -409,6 +409,182 @@ BOOL APIENTRY Imm32CleanupContext(HIMC hIMC, HKL hKL, BOOL bKeep) return TRUE; } +BOOL APIENTRY +Imm32InitContext(HIMC hIMC, LPINPUTCONTEXT pIC, PCLIENTIMC pClientImc, HKL hKL, BOOL fSelect) +{ + DWORD dwIndex, cbPrivate; + PIMEDPI pImeDpi = NULL; + LPCOMPOSITIONSTRING pCS; + LPCANDIDATEINFO pCI; + LPGUIDELINE pGL; + /* NOTE: Windows does recursive call ImmLockIMC here but we don't do so. */ + + /* Create IC components */ + pIC->hCompStr = ImmCreateIMCC(sizeof(COMPOSITIONSTRING)); + pIC->hCandInfo = ImmCreateIMCC(sizeof(CANDIDATEINFO)); + pIC->hGuideLine = ImmCreateIMCC(sizeof(GUIDELINE)); + pIC->hMsgBuf = ImmCreateIMCC(sizeof(UINT)); + if (!pIC->hCompStr || !pIC->hCandInfo || !pIC->hGuideLine || !pIC->hMsgBuf) + goto Fail; + + /* Initialize IC components */ + pCS = ImmLockIMCC(pIC->hCompStr); + if (!pCS) + goto Fail; + pCS->dwSize = sizeof(COMPOSITIONSTRING); + ImmUnlockIMCC(pIC->hCompStr); + + pCI = ImmLockIMCC(pIC->hCandInfo); + if (!pCI) + goto Fail; + pCI->dwSize = sizeof(CANDIDATEINFO); + ImmUnlockIMCC(pIC->hCandInfo); + + pGL = ImmLockIMCC(pIC->hGuideLine); + if (!pGL) + goto Fail; + pGL->dwSize = sizeof(GUIDELINE); + ImmUnlockIMCC(pIC->hGuideLine); + + pIC->dwNumMsgBuf = 0; + pIC->fOpen = FALSE; + pIC->fdwConversion = pIC->fdwSentence = 0; + + for (dwIndex = 0; dwIndex < MAX_CANDIDATEFORM; ++dwIndex) + pIC->cfCandForm[dwIndex].dwIndex = IMM_INVALID_CANDFORM; + + /* Get private data size */ + pImeDpi = ImmLockImeDpi(hKL); + if (!pImeDpi) + { + cbPrivate = sizeof(DWORD); + } + else + { + /* Update CLIENTIMC */ + pClientImc->uCodePage = pImeDpi->uCodePage; + if (ImeDpi_IsUnicode(pImeDpi)) + pClientImc->dwFlags |= CLIENTIMC_WIDE; + + cbPrivate = pImeDpi->ImeInfo.dwPrivateDataSize; + } + + /* Create private data */ + pIC->hPrivate = ImmCreateIMCC(cbPrivate); + if (!pIC->hPrivate) + goto Fail; + + if (pImeDpi) + { + /* Select the IME */ + if (fSelect) + { + if (IS_IME_HKL(hKL)) + pImeDpi->ImeSelect(hIMC, TRUE); + else if (Imm32IsCiceroMode() && !Imm32Is16BitMode() && pImeDpi->CtfImeSelectEx) + pImeDpi->CtfImeSelectEx(hIMC, TRUE, hKL); + } + + /* Set HKL */ + pClientImc->hKL = hKL; + + ImmUnlockImeDpi(pImeDpi); + } + + return TRUE; + +Fail: + if (pImeDpi) + ImmUnlockImeDpi(pImeDpi); + + pIC->hMsgBuf = ImmDestroyIMCC(pIC->hMsgBuf); + pIC->hGuideLine = ImmDestroyIMCC(pIC->hGuideLine); + pIC->hCandInfo = ImmDestroyIMCC(pIC->hCandInfo); + pIC->hCompStr = ImmDestroyIMCC(pIC->hCompStr); + return FALSE; +} + +LPINPUTCONTEXT APIENTRY Imm32LockIMCEx(HIMC hIMC, BOOL fSelect) +{ + HANDLE hIC; + LPINPUTCONTEXT pIC = NULL; + PCLIENTIMC pClientImc; + WORD Word; + DWORD dwThreadId; + HKL hKL, hNewKL; + PIMEDPI pImeDpi = NULL; + BOOL bInited; + + pClientImc = ImmLockClientImc(hIMC); + if (!pClientImc) + return NULL; + + RtlEnterCriticalSection(&pClientImc->cs); + + if (!pClientImc->hInputContext) + { + dwThreadId = (DWORD)NtUserQueryInputContext(hIMC, 1); + + if (dwThreadId == GetCurrentThreadId() && Imm32IsCiceroMode() && !Imm32Is16BitMode()) + { + hKL = GetKeyboardLayout(0); + Word = LOWORD(hKL); + hNewKL = (HKL)(DWORD_PTR)MAKELONG(Word, Word); + + pImeDpi = ImmLockOrLoadImeDpi(hNewKL); + if (pImeDpi) + { + FIXME("We have to do something here\n"); + } + } + + if (!NtUserQueryInputContext(hIMC, 2)) + { + RtlLeaveCriticalSection(&pClientImc->cs); + goto Quit; + } + + hIC = LocalAlloc(LHND, sizeof(INPUTCONTEXTDX)); + if (!hIC) + { + RtlLeaveCriticalSection(&pClientImc->cs); + goto Quit; + } + pClientImc->hInputContext = hIC; + + pIC = LocalLock(pClientImc->hInputContext); + if (!pIC) + { + pClientImc->hInputContext = LocalFree(pClientImc->hInputContext); + RtlLeaveCriticalSection(&pClientImc->cs); + goto Quit; + } + + hKL = GetKeyboardLayout(dwThreadId); + // bInited = Imm32InitContext(hIMC, hKL, fSelect); + bInited = Imm32InitContext(hIMC, pIC, pClientImc, hKL, fSelect); + LocalUnlock(pClientImc->hInputContext); + + if (!bInited) + { + pIC = NULL; + pClientImc->hInputContext = LocalFree(pClientImc->hInputContext); + RtlLeaveCriticalSection(&pClientImc->cs); + goto Quit; + } + } + + FIXME("We have to do something here\n"); + + RtlLeaveCriticalSection(&pClientImc->cs); + pIC = LocalLock(pClientImc->hInputContext); + InterlockedIncrement(&pClientImc->cLockObj); + +Quit: + ImmUnlockClientImc(pClientImc); + return pIC; +} + /*********************************************************************** * ImmDestroyContext (IMM32.@) */ @@ -481,7 +657,7 @@ PCLIENTIMC WINAPI ImmLockClientImc(HIMC hImc) VOID WINAPI ImmUnlockClientImc(PCLIENTIMC pClientImc) { LONG cLocks; - HIMC hImc; + HANDLE hInputContext; TRACE("(%p)\n", pClientImc); @@ -489,9 +665,9 @@ VOID WINAPI ImmUnlockClientImc(PCLIENTIMC pClientImc) if (cLocks != 0 || !(pClientImc->dwFlags & CLIENTIMC_UNKNOWN1)) return; - hImc = pClientImc->hImc; - if (hImc) - LocalFree(hImc); + hInputContext = pClientImc->hInputContext; + if (hInputContext) + LocalFree(hInputContext); RtlDeleteCriticalSection(&pClientImc->cs); Imm32HeapFree(pClientImc); @@ -925,16 +1101,14 @@ HKL WINAPI ImmInstallIMEW(LPCWSTR lpszIMEFileName, LPCWSTR lpszLayoutText) } /*********************************************************************** -* ImmLockIMC(IMM32.@) -*/ + * ImmLockIMC(IMM32.@) + * + * NOTE: This is not ImmLockIMCC. Don't confuse. + */ LPINPUTCONTEXT WINAPI ImmLockIMC(HIMC hIMC) { - InputContextData *data = get_imc_data(hIMC); - - if (!data) - return NULL; - data->dwLock++; - return &data->IMC; + TRACE("(%p)\n", hIMC); + return Imm32LockIMCEx(hIMC, TRUE); } /*********************************************************************** @@ -943,15 +1117,13 @@ LPINPUTCONTEXT WINAPI ImmLockIMC(HIMC hIMC) BOOL WINAPI ImmUnlockIMC(HIMC hIMC) { PCLIENTIMC pClientImc; - HIMC hClientImc; pClientImc = ImmLockClientImc(hIMC); if (pClientImc == NULL) return FALSE; - hClientImc = pClientImc->hImc; - if (hClientImc) - LocalUnlock(hClientImc); + if (pClientImc->hInputContext) + LocalUnlock(pClientImc->hInputContext); InterlockedDecrement(&pClientImc->cLockObj); ImmUnlockClientImc(pClientImc); diff --git a/dll/win32/imm32/utils.c b/dll/win32/imm32/utils.c index 17a7efb5179..64bd3d158be 100644 --- a/dll/win32/imm32/utils.c +++ b/dll/win32/imm32/utils.c @@ -276,7 +276,7 @@ DWORD WINAPI ImmGetIMCCSize(HIMCC imcc) DWORD WINAPI ImmGetIMCLockCount(HIMC hIMC) { DWORD ret; - HIMC hClientImc; + HANDLE hInputContext; PCLIENTIMC pClientImc; pClientImc = ImmLockClientImc(hIMC); @@ -284,9 +284,9 @@ DWORD WINAPI ImmGetIMCLockCount(HIMC hIMC) return 0; ret = 0; - hClientImc = pClientImc->hImc; - if (hClientImc) - ret = (LocalFlags(hClientImc) & LMEM_LOCKCOUNT); + hInputContext = pClientImc->hInputContext; + if (hInputContext) + ret = (LocalFlags(hInputContext) & LMEM_LOCKCOUNT); ImmUnlockClientImc(pClientImc); return ret; diff --git a/modules/rostests/apitests/imm32/clientimc.c b/modules/rostests/apitests/imm32/clientimc.c index 0f43024efd0..f0080c8112e 100644 --- a/modules/rostests/apitests/imm32/clientimc.c +++ b/modules/rostests/apitests/imm32/clientimc.c @@ -24,15 +24,15 @@ START_TEST(clientimc) DWORD dwCode; CLIENTIMC *pClientImc = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(CLIENTIMC)); - pClientImc->hImc = (HIMC)ImmCreateIMCC(4); + pClientImc->hInputContext = (HANDLE)ImmCreateIMCC(4); pClientImc->cLockObj = 2; pClientImc->dwFlags = 0x40; RtlInitializeCriticalSection(&pClientImc->cs); - ok_long(ImmGetIMCCSize((HIMCC)pClientImc->hImc), 4); + ok_long(ImmGetIMCCSize((HIMCC)pClientImc->hInputContext), 4); ImmUnlockClientImc(pClientImc); ok_long(pClientImc->cLockObj, 1); - ok_long(ImmGetIMCCSize((HIMCC)pClientImc->hImc), 4); + ok_long(ImmGetIMCCSize((HIMCC)pClientImc->hInputContext), 4); dwCode = 0; _SEH2_TRY @@ -47,7 +47,7 @@ START_TEST(clientimc) ok_long(dwCode, STATUS_ACCESS_VIOLATION); ok_long(pClientImc->cLockObj, 0); - ok_long(ImmGetIMCCSize((HIMCC)pClientImc->hImc), 0); + ok_long(ImmGetIMCCSize((HIMCC)pClientImc->hInputContext), 0); HeapFree(GetProcessHeap(), 0, pClientImc); } diff --git a/sdk/include/reactos/wine/ddk/imm.h b/sdk/include/reactos/wine/ddk/imm.h index f5b45fc6d1a..842c7cac015 100644 --- a/sdk/include/reactos/wine/ddk/imm.h +++ b/sdk/include/reactos/wine/ddk/imm.h @@ -92,17 +92,19 @@ typedef struct INPUTCONTEXTDX /* unconfirmed */ INPUTCONTEXT; UINT nVKey; BOOL bNeedsTrans; - DWORD dwUnknownCat; + DWORD dwUnknown1; DWORD dwUIFlags; - DWORD dwUnknownDog; - void *pUnknownFox; - /* ... */ + DWORD dwUnknown2; + void *pUnknown3; + DWORD dwUnknown4; + DWORD dwUnknown5; } INPUTCONTEXTDX, *LPINPUTCONTEXTDX; #ifndef _WIN64 C_ASSERT(offsetof(INPUTCONTEXTDX, nVKey) == 0x140); C_ASSERT(offsetof(INPUTCONTEXTDX, bNeedsTrans) == 0x144); C_ASSERT(offsetof(INPUTCONTEXTDX, dwUIFlags) == 0x14c); +C_ASSERT(sizeof(INPUTCONTEXTDX) == 0x160); #endif // bits of fdwInit of INPUTCONTEXT diff --git a/win32ss/include/ntuser.h b/win32ss/include/ntuser.h index 6d463ddb69a..482ea232926 100644 --- a/win32ss/include/ntuser.h +++ b/win32ss/include/ntuser.h @@ -1290,21 +1290,22 @@ C_ASSERT(sizeof(IMEDPI) == 0xa8); /* unconfirmed */ typedef struct tagCLIENTIMC { - HIMC hImc; + HANDLE hInputContext; /* LocalAlloc'ed LHND */ LONG cLockObj; DWORD dwFlags; DWORD unknown; RTL_CRITICAL_SECTION cs; - DWORD unknown2; + UINT uCodePage; HKL hKL; BOOL bUnknown4; } CLIENTIMC, *PCLIENTIMC; #ifndef _WIN64 -C_ASSERT(offsetof(CLIENTIMC, hImc) == 0x0); +C_ASSERT(offsetof(CLIENTIMC, hInputContext) == 0x0); C_ASSERT(offsetof(CLIENTIMC, cLockObj) == 0x4); C_ASSERT(offsetof(CLIENTIMC, dwFlags) == 0x8); C_ASSERT(offsetof(CLIENTIMC, cs) == 0x10); +C_ASSERT(offsetof(CLIENTIMC, uCodePage) == 0x28); C_ASSERT(offsetof(CLIENTIMC, hKL) == 0x2c); C_ASSERT(sizeof(CLIENTIMC) == 0x34); #endif

3 years, 2 months

[reactos] 01/01: [IMM32] Improve Imm32CleanupContext and ImmLockClientImc (#3974)

by Katayama Hirofumi MZ

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=be9a788f8bb2c75974ca2… commit be9a788f8bb2c75974ca219502d861c499cac439 Author: Katayama Hirofumi MZ <katayama.hirofumi.mz(a)gmail.com> AuthorDate: Mon Sep 27 09:31:16 2021 +0900 Commit: GitHub <noreply(a)github.com> CommitDate: Mon Sep 27 09:31:16 2021 +0900 [IMM32] Improve Imm32CleanupContext and ImmLockClientImc (#3974) - Improve Imm32CleanupContext and ImmLockClientImc functions. - Add ValidateHandleNoErr and Imm32CheckImcProcess helper functions. CORE-11700 --- dll/win32/imm32/imm.c | 27 ++++++++++++--------------- dll/win32/imm32/precomp.h | 2 ++ dll/win32/imm32/utils.c | 39 ++++++++++++++++++++++++++++----------- 3 files changed, 42 insertions(+), 26 deletions(-) diff --git a/dll/win32/imm32/imm.c b/dll/win32/imm32/imm.c index 3297fa085e9..9fecb94c183 100644 --- a/dll/win32/imm32/imm.c +++ b/dll/win32/imm32/imm.c @@ -336,23 +336,21 @@ static VOID APIENTRY Imm32CleanupContextExtra(LPINPUTCONTEXT pIC) FIXME("We have to do something do here"); } -static PCLIENTIMC APIENTRY Imm32FindClientImc(HIMC hIMC) -{ - // FIXME - return NULL; -} - BOOL APIENTRY Imm32CleanupContext(HIMC hIMC, HKL hKL, BOOL bKeep) { PIMEDPI pImeDpi; LPINPUTCONTEXT pIC; PCLIENTIMC pClientImc; + PIMC pIMC; if (!Imm32IsImmMode() || hIMC == NULL) return FALSE; - FIXME("We have do something to do here\n"); - pClientImc = Imm32FindClientImc(hIMC); + pIMC = ValidateHandleNoErr(hIMC, TYPE_INPUTCONTEXT); + if (!pIMC || pIMC->head.pti != NtCurrentTeb()->Win32ThreadInfo) + return FALSE; + + pClientImc = (PCLIENTIMC)pIMC->dwClientImcData; if (!pClientImc) return FALSE; @@ -430,17 +428,12 @@ BOOL WINAPI ImmDestroyContext(HIMC hIMC) return Imm32CleanupContext(hIMC, hKL, FALSE); } -static PCLIENTIMC APIENTRY Imm32GetClientImcCache(void) -{ - // FIXME: Do something properly here - return NULL; -} - /*********************************************************************** * ImmLockClientImc (IMM32.@) */ PCLIENTIMC WINAPI ImmLockClientImc(HIMC hImc) { + PIMC pIMC; PCLIENTIMC pClientImc; TRACE("(%p)\n", hImc); @@ -448,7 +441,11 @@ PCLIENTIMC WINAPI ImmLockClientImc(HIMC hImc) if (hImc == NULL) return NULL; - pClientImc = Imm32GetClientImcCache(); + pIMC = ValidateHandleNoErr(hImc, TYPE_INPUTCONTEXT); + if (pIMC == NULL || !Imm32CheckImcProcess(pIMC)) + return NULL; + + pClientImc = (PCLIENTIMC)pIMC->dwClientImcData; if (!pClientImc) { pClientImc = Imm32HeapAlloc(HEAP_ZERO_MEMORY, sizeof(CLIENTIMC)); diff --git a/dll/win32/imm32/precomp.h b/dll/win32/imm32/precomp.h index b914f8f625a..7bab3b95031 100644 --- a/dll/win32/imm32/precomp.h +++ b/dll/win32/imm32/precomp.h @@ -72,6 +72,8 @@ BOOL Imm32GetSystemLibraryPath(LPWSTR pszPath, DWORD cchPath, LPCWSTR pszFileNam VOID APIENTRY LogFontAnsiToWide(const LOGFONTA *plfA, LPLOGFONTW plfW); VOID APIENTRY LogFontWideToAnsi(const LOGFONTW *plfW, LPLOGFONTA plfA); PWND FASTCALL ValidateHwndNoErr(HWND hwnd); +LPVOID FASTCALL ValidateHandleNoErr(HANDLE hObject, UINT uType); +BOOL APIENTRY Imm32CheckImcProcess(PIMC pIMC); LPVOID APIENTRY Imm32HeapAlloc(DWORD dwFlags, DWORD dwBytes); #define Imm32HeapFree(lpData) HeapFree(g_hImm32Heap, 0, (lpData)) diff --git a/dll/win32/imm32/utils.c b/dll/win32/imm32/utils.c index 2289ea895e0..17a7efb5179 100644 --- a/dll/win32/imm32/utils.c +++ b/dll/win32/imm32/utils.c @@ -72,19 +72,14 @@ VOID APIENTRY LogFontWideToAnsi(const LOGFONTW *plfW, LPLOGFONTA plfA) plfA->lfFaceName[cch] = 0; } -PWND FASTCALL ValidateHwndNoErr(HWND hwnd) +LPVOID FASTCALL ValidateHandleNoErr(HANDLE hObject, UINT uType) { - PCLIENTINFO ClientInfo = GetWin32ClientInfo(); INT index; PUSER_HANDLE_TABLE ht; PUSER_HANDLE_ENTRY he; WORD generation; - /* See if the window is cached */ - if (hwnd == ClientInfo->CallbackWnd.hWnd) - return ClientInfo->CallbackWnd.pWnd; - - if (!NtUserValidateHandleSecure(hwnd)) + if (!NtUserValidateHandleSecure(hObject)) return NULL; ht = g_SharedInfo.aheList; /* handle table */ @@ -93,15 +88,37 @@ PWND FASTCALL ValidateHwndNoErr(HWND hwnd) ASSERT(g_SharedInfo.ulSharedDelta != 0); he = (PUSER_HANDLE_ENTRY)((ULONG_PTR)ht->handles - g_SharedInfo.ulSharedDelta); - index = (LOWORD(hwnd) - FIRST_USER_HANDLE) >> 1; - if (index < 0 || index >= ht->nb_handles || he[index].type != TYPE_WINDOW) + index = (LOWORD(hObject) - FIRST_USER_HANDLE) >> 1; + if (index < 0 || ht->nb_handles <= index || he[index].type != uType) return NULL; - generation = HIWORD(hwnd); + generation = HIWORD(hObject); if (generation != he[index].generation && generation && generation != 0xFFFF) return NULL; - return (PWND)&he[index]; + return &he[index]; +} + +PWND FASTCALL ValidateHwndNoErr(HWND hwnd) +{ + /* See if the window is cached */ + PCLIENTINFO ClientInfo = GetWin32ClientInfo(); + if (hwnd == ClientInfo->CallbackWnd.hWnd) + return ClientInfo->CallbackWnd.pWnd; + + return ValidateHandleNoErr(hwnd, TYPE_WINDOW); +} + +BOOL APIENTRY Imm32CheckImcProcess(PIMC pIMC) +{ + HIMC hIMC; + DWORD dwProcessID; + if (pIMC->head.pti == NtCurrentTeb()->Win32ThreadInfo) + return TRUE; + + hIMC = pIMC->head.h; + dwProcessID = NtUserQueryInputContext(hIMC, 0); + return dwProcessID == (DWORD_PTR)NtCurrentTeb()->ClientId.UniqueProcess; } LPVOID APIENTRY Imm32HeapAlloc(DWORD dwFlags, DWORD dwBytes)

3 years, 2 months

[reactos] 01/01: [USER32] GetUserObjectSecurity/SetUserObjectSecurity: Just use UserSetLastNTError() in failure path.

by Hermès Bélusca-Maïto

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=31c4c2efe90818bf430c2… commit 31c4c2efe90818bf430c2a876750326ba0a9ba80 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Sun Sep 26 18:58:28 2021 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Sun Sep 26 19:04:08 2021 +0200 [USER32] GetUserObjectSecurity/SetUserObjectSecurity: Just use UserSetLastNTError() in failure path. --- win32ss/user/user32/misc/misc.c | 44 ++++++++++++++++------------------------- 1 file changed, 17 insertions(+), 27 deletions(-) diff --git a/win32ss/user/user32/misc/misc.c b/win32ss/user/user32/misc/misc.c index 5c8e961c305..621ec567f8e 100644 --- a/win32ss/user/user32/misc/misc.c +++ b/win32ss/user/user32/misc/misc.c @@ -80,21 +80,16 @@ GetUserObjectSecurity( OUT PDWORD pdwLengthNeeded ) { -DWORD dwWin32Error; -NTSTATUS Status; - - - Status = NtQuerySecurityObject( - hObject, // Object Handle - *pSecurityInfo, // Security Information - pSecurityDescriptor,// Security Descriptor - dwLength, // Buffer Length - pdwLengthNeeded // Actual Length - ); - - if ( ! NT_SUCCESS( Status ) ) { - dwWin32Error = RtlNtStatusToDosError( Status ); - NtCurrentTeb()->LastErrorValue = dwWin32Error; + NTSTATUS Status; + + Status = NtQuerySecurityObject(hObject, + *pSecurityInfo, + pSecurityDescriptor, + dwLength, + pdwLengthNeeded); + if (!NT_SUCCESS(Status)) + { + UserSetLastNTError(Status); return FALSE; } @@ -128,19 +123,14 @@ SetUserObjectSecurity( IN PSECURITY_DESCRIPTOR pSecurityDescriptor ) { -DWORD dwWin32Error; -NTSTATUS Status; + NTSTATUS Status; - - Status = NtSetSecurityObject( - hObject, // Object Handle - *pSecurityInfo, // Security Information - pSecurityDescriptor // Security Descriptor - ); - - if ( ! NT_SUCCESS( Status ) ) { - dwWin32Error = RtlNtStatusToDosError( Status ); - NtCurrentTeb()->LastErrorValue = dwWin32Error; + Status = NtSetSecurityObject(hObject, + *pSecurityInfo, + pSecurityDescriptor); + if (!NT_SUCCESS(Status)) + { + UserSetLastNTError(Status); return FALSE; }

3 years, 3 months

[reactos] 01/01: [IMAGESOFT] Fix build. Addendum to commit 516c8829.

by Hermès Bélusca-Maïto

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=acde1e0e7b2c249eb74c5… commit acde1e0e7b2c249eb74c5a6f5c0bdf351c3fb0d8 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Sun Sep 26 03:50:13 2021 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Sun Sep 26 03:50:13 2021 +0200 [IMAGESOFT] Fix build. Addendum to commit 516c8829. --- modules/rosapps/applications/imagesoft/mainwnd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/rosapps/applications/imagesoft/mainwnd.c b/modules/rosapps/applications/imagesoft/mainwnd.c index 86b0b3f10cf..f78e831e2d6 100644 --- a/modules/rosapps/applications/imagesoft/mainwnd.c +++ b/modules/rosapps/applications/imagesoft/mainwnd.c @@ -493,7 +493,7 @@ MainWndMoveFloatingWindows(PMAIN_WND_INFO Info, CopyMemory(wndOldPos, &wndNewPos, - sizeof(wndOldPos)); + sizeof(wndNewPos)); } }

3 years, 3 months

[reactos] 04/04: [NTOS:RAWFS] LE JOKE! - Commit 7716bddd (r24564) claimed to "actually create the \\Device names so that user-mode can even talk to it", yet didn't bother to do that!

by Hermès Bélusca-Maïto

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=9462350a92bdde70c4cd5… commit 9462350a92bdde70c4cd5623b6d9408174ebf1ca Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Fri Sep 24 00:45:56 2021 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Sun Sep 26 03:02:58 2021 +0200 [NTOS:RAWFS] LE JOKE! - Commit 7716bddd (r24564) claimed to "actually create the \\Device names so that user-mode can even talk to it", yet didn't bother to do that! Certainly due to copy-pasta error from the original code. A consequence of this oversight, was that the IoGetDeviceObjectPointer() calls on these device names, in fltmgr!DriverEntry() couldn't work. (See drivers/filters/fltmgr/Interface.c, line 1880 and below.) --- ntoskrnl/io/iomgr/rawfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ntoskrnl/io/iomgr/rawfs.c b/ntoskrnl/io/iomgr/rawfs.c index c1dfe0c20c0..5c4d70c75f7 100644 --- a/ntoskrnl/io/iomgr/rawfs.c +++ b/ntoskrnl/io/iomgr/rawfs.c @@ -1202,7 +1202,7 @@ RawFsDriverEntry(IN PDRIVER_OBJECT DriverObject, RtlInitUnicodeString(&DeviceName, L"\\Device\\RawDisk"); Status = IoCreateDevice(DriverObject, 0, - NULL, + &DeviceName, FILE_DEVICE_DISK_FILE_SYSTEM, 0, FALSE, @@ -1216,7 +1216,7 @@ RawFsDriverEntry(IN PDRIVER_OBJECT DriverObject, RtlInitUnicodeString(&DeviceName, L"\\Device\\RawCdRom"); Status = IoCreateDevice(DriverObject, 0, - NULL, + &DeviceName, FILE_DEVICE_CD_ROM_FILE_SYSTEM, 0, FALSE, @@ -1231,7 +1231,7 @@ RawFsDriverEntry(IN PDRIVER_OBJECT DriverObject, RtlInitUnicodeString(&DeviceName, L"\\Device\\RawTape"); Status = IoCreateDevice(DriverObject, 0, - NULL, + &DeviceName, FILE_DEVICE_TAPE_FILE_SYSTEM, 0, FALSE,

3 years, 3 months

[reactos] 03/04: [NTOS:RAWFS] Delete the previously-created devices in case the IoCreateDevice() calls fail.

by Hermès Bélusca-Maïto

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=5ccd45ea58f8d3338d969… commit 5ccd45ea58f8d3338d969d815cf5ee46c73b34c7 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Fri Sep 24 00:41:32 2021 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Sun Sep 26 03:02:57 2021 +0200 [NTOS:RAWFS] Delete the previously-created devices in case the IoCreateDevice() calls fail. --- ntoskrnl/io/iomgr/rawfs.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/ntoskrnl/io/iomgr/rawfs.c b/ntoskrnl/io/iomgr/rawfs.c index b903fe3a31d..c1dfe0c20c0 100644 --- a/ntoskrnl/io/iomgr/rawfs.c +++ b/ntoskrnl/io/iomgr/rawfs.c @@ -1193,8 +1193,10 @@ NTAPI RawFsDriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) { - UNICODE_STRING DeviceName; NTSTATUS Status; + UNICODE_STRING DeviceName; + + UNREFERENCED_PARAMETER(RegistryPath); /* Create the raw disk device */ RtlInitUnicodeString(&DeviceName, L"\\Device\\RawDisk"); @@ -1205,7 +1207,10 @@ RawFsDriverEntry(IN PDRIVER_OBJECT DriverObject, 0, FALSE, &RawDiskDeviceObject); - if (!NT_SUCCESS(Status)) return Status; + if (!NT_SUCCESS(Status)) + { + return Status; + } /* Create the raw CDROM device */ RtlInitUnicodeString(&DeviceName, L"\\Device\\RawCdRom"); @@ -1216,7 +1221,11 @@ RawFsDriverEntry(IN PDRIVER_OBJECT DriverObject, 0, FALSE, &RawCdromDeviceObject); - if (!NT_SUCCESS(Status)) return Status; + if (!NT_SUCCESS(Status)) + { + IoDeleteDevice(RawDiskDeviceObject); + return Status; + } /* Create the raw tape device */ RtlInitUnicodeString(&DeviceName, L"\\Device\\RawTape"); @@ -1227,7 +1236,12 @@ RawFsDriverEntry(IN PDRIVER_OBJECT DriverObject, 0, FALSE, &RawTapeDeviceObject); - if (!NT_SUCCESS(Status)) return Status; + if (!NT_SUCCESS(Status)) + { + IoDeleteDevice(RawDiskDeviceObject); + IoDeleteDevice(RawCdromDeviceObject); + return Status; + } /* Set Direct I/O for all devices */ RawDiskDeviceObject->Flags |= DO_DIRECT_IO;

3 years, 3 months

[reactos] 02/04: [FS_REC] Fix load-lock acquisition.

by Hermès Bélusca-Maïto

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=38ce67162f705c46ed33d… commit 38ce67162f705c46ed33d06a959b23def370dfd0 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Fri Sep 24 17:51:40 2021 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Sun Sep 26 03:02:56 2021 +0200 [FS_REC] Fix load-lock acquisition. --- drivers/filesystems/fs_rec/fs_rec.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/filesystems/fs_rec/fs_rec.c b/drivers/filesystems/fs_rec/fs_rec.c index 2bd4da6da64..4ccb99f5952 100644 --- a/drivers/filesystems/fs_rec/fs_rec.c +++ b/drivers/filesystems/fs_rec/fs_rec.c @@ -23,21 +23,22 @@ NTAPI FsRecLoadFileSystem(IN PDEVICE_OBJECT DeviceObject, IN PWCHAR DriverServiceName) { - UNICODE_STRING DriverName; - PDEVICE_EXTENSION DeviceExtension = DeviceObject->DeviceExtension; NTSTATUS Status = STATUS_IMAGE_ALREADY_LOADED; + PDEVICE_EXTENSION DeviceExtension = DeviceObject->DeviceExtension; + UNICODE_STRING DriverName; + PAGED_CODE(); /* Make sure we haven't already been called */ if (DeviceExtension->State != Loaded) { /* Acquire the load lock */ + KeEnterCriticalRegion(); KeWaitForSingleObject(FsRecLoadSync, Executive, KernelMode, FALSE, NULL); - KeEnterCriticalRegion(); /* Make sure we're active */ if (DeviceExtension->State == Pending) @@ -67,11 +68,10 @@ FsRecLoadFileSystem(IN PDEVICE_OBJECT DeviceObject, } /* Release the lock */ - KeSetEvent(FsRecLoadSync, 0, FALSE); + KeSetEvent(FsRecLoadSync, IO_NO_INCREMENT, FALSE); KeLeaveCriticalRegion(); } - /* Return */ return Status; }

3 years, 3 months

[reactos] 01/04: [FS_REC] Register a recognizer for FAT filesystem on CD-ROMs.

by Hermès Bélusca-Maïto

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=618076dc4760f7e131785… commit 618076dc4760f7e13178570827844c3b88d7d318 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Thu Sep 23 21:21:53 2021 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Sun Sep 26 03:02:56 2021 +0200 [FS_REC] Register a recognizer for FAT filesystem on CD-ROMs. This handles the \FatCdrom device, supported by MS fastfat. --- drivers/filesystems/fs_rec/fs_rec.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/filesystems/fs_rec/fs_rec.c b/drivers/filesystems/fs_rec/fs_rec.c index 185d37cd4d0..2bd4da6da64 100644 --- a/drivers/filesystems/fs_rec/fs_rec.c +++ b/drivers/filesystems/fs_rec/fs_rec.c @@ -318,10 +318,12 @@ NTAPI DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) { - ULONG DeviceCount = 0; NTSTATUS Status; + ULONG DeviceCount = 0; PDEVICE_OBJECT CdfsObject; PDEVICE_OBJECT UdfsObject; + PDEVICE_OBJECT FatObject; + PAGED_CODE(); UNREFERENCED_PARAMETER(RegistryPath); @@ -392,7 +394,7 @@ DriverEntry(IN PDRIVER_OBJECT DriverObject, /* Register FAT */ Status = FsRecRegisterFs(DriverObject, NULL, - NULL, + &FatObject, L"\\Fat", L"\\FileSystem\\FatRecognizer", FS_TYPE_VFAT, @@ -400,6 +402,17 @@ DriverEntry(IN PDRIVER_OBJECT DriverObject, 0); if (NT_SUCCESS(Status)) DeviceCount++; + /* Register FAT for CDs */ + Status = FsRecRegisterFs(DriverObject, + FatObject, + NULL, + L"\\FatCdrom", + L"\\FileSystem\\FatCdRomRecognizer", + FS_TYPE_VFAT, + FILE_DEVICE_CD_ROM_FILE_SYSTEM, + 0); + if (NT_SUCCESS(Status)) DeviceCount++; + /* Register NTFS */ Status = FsRecRegisterFs(DriverObject, NULL,

3 years, 3 months

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Ros-diffs September 2021