Ros-diffs

ros-diffs@reactos.org

81390 discussions

[tfaber] 69901: [ACPI] - Completely duplicate CompatibleIdList before freeing the original in acpi_bus_add. Fixes use after free
by tfaber＠svn.reactos.org 16 Nov '15

16 Nov '15

Author: tfaber Date: Mon Nov 16 20:01:04 2015 New Revision: 69901 URL: http://svn.reactos.org/svn/reactos?rev=69901&view=rev Log: [ACPI] - Completely duplicate CompatibleIdList before freeing the original in acpi_bus_add. Fixes use after free Modified: trunk/reactos/drivers/bus/acpi/busmgr/bus.c Modified: trunk/reactos/drivers/bus/acpi/busmgr/bus.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/bus/acpi/busmgr/bu… ============================================================================== --- trunk/reactos/drivers/bus/acpi/busmgr/bus.c [iso-8859-1] (original) +++ trunk/reactos/drivers/bus/acpi/busmgr/bus.c [iso-8859-1] Mon Nov 16 20:01:04 2015 @@ -1258,8 +1258,19 @@ if (info->Valid & ACPI_VALID_CID) { cid_list = &info->CompatibleIdList; device->pnp.cid_list = ExAllocatePoolWithTag(NonPagedPool,cid_list->ListSize, 'DpcA'); - if (device->pnp.cid_list) - memcpy(device->pnp.cid_list, cid_list, cid_list->ListSize); + if (device->pnp.cid_list) { + char *p = (char *)&device->pnp.cid_list->Ids[cid_list->Count]; + device->pnp.cid_list->Count = cid_list->Count; + device->pnp.cid_list->ListSize = cid_list->ListSize; + for (i = 0; i < cid_list->Count; i++) { + device->pnp.cid_list->Ids[i].Length = cid_list->Ids[i].Length; + device->pnp.cid_list->Ids[i].String = p; + ASSERT(p + cid_list->Ids[i].Length <= (char *)device->pnp.cid_list + cid_list->ListSize); + memcpy(device->pnp.cid_list->Ids[i].String, + cid_list->Ids[i].String, cid_list->Ids[i].Length); + p += cid_list->Ids[i].Length; + } + } else DPRINT("Memory allocation error\n"); }

1 0

[tfaber] 69900: [PARPORT] - Initialize DeviceRelations->Count in FdoQueryBusRelations - Don't fake success for unsupported PNP minor functions, it makes the kernel very unhappy Powered by Special Pool
by tfaber＠svn.reactos.org 16 Nov '15

16 Nov '15

Author: tfaber Date: Mon Nov 16 19:56:00 2015 New Revision: 69900 URL: http://svn.reactos.org/svn/reactos?rev=69900&view=rev Log: [PARPORT] - Initialize DeviceRelations->Count in FdoQueryBusRelations - Don't fake success for unsupported PNP minor functions, it makes the kernel very unhappy Powered by Special Pool Modified: trunk/reactos/drivers/parallel/parport/fdo.c trunk/reactos/drivers/parallel/parport/pdo.c Modified: trunk/reactos/drivers/parallel/parport/fdo.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/parallel/parport/f… ============================================================================== --- trunk/reactos/drivers/parallel/parport/fdo.c [iso-8859-1] (original) +++ trunk/reactos/drivers/parallel/parport/fdo.c [iso-8859-1] Mon Nov 16 19:56:00 2015 @@ -371,6 +371,7 @@ i = 0; ObReferenceObject(DeviceExtension->AttachedRawPdo); DeviceRelations->Objects[i] = DeviceExtension->AttachedRawPdo; + DeviceRelations->Count = 1; Irp->IoStatus.Information = (ULONG_PTR)DeviceRelations; Modified: trunk/reactos/drivers/parallel/parport/pdo.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/parallel/parport/p… ============================================================================== --- trunk/reactos/drivers/parallel/parport/pdo.c [iso-8859-1] (original) +++ trunk/reactos/drivers/parallel/parport/pdo.c [iso-8859-1] Mon Nov 16 19:56:00 2015 @@ -161,12 +161,12 @@ PdoPnp(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp) { + NTSTATUS Status; DPRINT("PdoPnp()\n"); - Irp->IoStatus.Information = 0; - Irp->IoStatus.Status = STATUS_SUCCESS; + Status = Irp->IoStatus.Status; IoCompleteRequest(Irp, IO_NO_INCREMENT); - return STATUS_SUCCESS; + return Status; }

1 0

[tfaber] 69899: [ACPI] - Addendum to r69867: free device info pointer at the end of acpi_bus_add to avoid use after free. Powered by Special Pool
by tfaber＠svn.reactos.org 16 Nov '15

16 Nov '15

Author: tfaber Date: Mon Nov 16 14:20:25 2015 New Revision: 69899 URL: http://svn.reactos.org/svn/reactos?rev=69899&view=rev Log: [ACPI] - Addendum to r69867: free device info pointer at the end of acpi_bus_add to avoid use after free. Powered by Special Pool Modified: trunk/reactos/drivers/bus/acpi/busmgr/bus.c Modified: trunk/reactos/drivers/bus/acpi/busmgr/bus.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/bus/acpi/busmgr/bu… ============================================================================== --- trunk/reactos/drivers/bus/acpi/busmgr/bus.c [iso-8859-1] (original) +++ trunk/reactos/drivers/bus/acpi/busmgr/bus.c [iso-8859-1] Mon Nov 16 14:20:25 2015 @@ -1138,7 +1138,7 @@ struct acpi_device *device = NULL; char bus_id[5] = {'?',0}; ACPI_BUFFER buffer; - ACPI_DEVICE_INFO *info; + ACPI_DEVICE_INFO *info = NULL; char *hid = NULL; char *uid = NULL; ACPI_PNP_DEVICE_ID_LIST *cid_list = NULL; @@ -1248,6 +1248,7 @@ ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Error reading device info\n")); result = AE_NOT_FOUND; + info = NULL; goto end; } if (info->Valid & ACPI_VALID_HID) @@ -1266,7 +1267,6 @@ device->pnp.bus_address = info->Address; device->flags.bus_address = 1; } - ACPI_FREE(info); break; case ACPI_BUS_TYPE_POWER: hid = ACPI_POWER_HID; @@ -1427,6 +1427,8 @@ acpi_bus_find_driver(device); end: + if (info != NULL) + ACPI_FREE(info); if (result) { if (device->pnp.cid_list) { ExFreePoolWithTag(device->pnp.cid_list, 'DpcA');

1 0

[tfaber] 69898: [FASTFAT] - Correctly track the buffer length in VfatGetAllInformation. Fixes pool corruption when running ntdll_winetest:file
by tfaber＠svn.reactos.org 16 Nov '15

16 Nov '15

Author: tfaber Date: Mon Nov 16 13:58:39 2015 New Revision: 69898 URL: http://svn.reactos.org/svn/reactos?rev=69898&view=rev Log: [FASTFAT] - Correctly track the buffer length in VfatGetAllInformation. Fixes pool corruption when running ntdll_winetest:file Modified: trunk/reactos/drivers/filesystems/fastfat/finfo.c Modified: trunk/reactos/drivers/filesystems/fastfat/finfo.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/filesystems/fastfa… ============================================================================== --- trunk/reactos/drivers/filesystems/fastfat/finfo.c [iso-8859-1] (original) +++ trunk/reactos/drivers/filesystems/fastfat/finfo.c [iso-8859-1] Mon Nov 16 13:58:39 2015 @@ -1070,12 +1070,11 @@ PULONG BufferLength) { NTSTATUS Status; - ULONG InitialBufferLength = *BufferLength; ASSERT(Info); ASSERT(Fcb); - if (*BufferLength < sizeof(FILE_ALL_INFORMATION)) + if (*BufferLength < FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName)) return STATUS_BUFFER_OVERFLOW; /* Basic Information */ @@ -1088,19 +1087,19 @@ Status = VfatGetInternalInformation(Fcb, &Info->InternalInformation, BufferLength); if (!NT_SUCCESS(Status)) return Status; /* EA Information */ - Info->EaInformation.EaSize = 0; + Status = VfatGetEaInformation(FileObject, Fcb, DeviceObject, &Info->EaInformation, BufferLength); + if (!NT_SUCCESS(Status)) return Status; /* Access Information: The IO-Manager adds this information */ + *BufferLength -= sizeof(FILE_ACCESS_INFORMATION); /* Position Information */ Status = VfatGetPositionInformation(FileObject, Fcb, DeviceObject, &Info->PositionInformation, BufferLength); if (!NT_SUCCESS(Status)) return Status; /* Mode Information: The IO-Manager adds this information */ + *BufferLength -= sizeof(FILE_MODE_INFORMATION); /* Alignment Information: The IO-Manager adds this information */ + *BufferLength -= sizeof(FILE_ALIGNMENT_INFORMATION); /* Name Information */ Status = VfatGetNameInformation(FileObject, Fcb, DeviceObject, &Info->NameInformation, BufferLength); - - *BufferLength = InitialBufferLength - sizeof(FILE_ALL_INFORMATION); - if (InitialBufferLength > sizeof(FILE_ALL_INFORMATION)) - *BufferLength -= min(InitialBufferLength - sizeof(FILE_ALL_INFORMATION), Fcb->PathNameU.Length); return Status; }

1 0

[tfaber] 69897: [KMTESTS:IO] - Add a test for FileAllInformation
by tfaber＠svn.reactos.org 16 Nov '15

16 Nov '15

Author: tfaber Date: Mon Nov 16 13:53:03 2015 New Revision: 69897 URL: http://svn.reactos.org/svn/reactos?rev=69897&view=rev Log: [KMTESTS:IO] - Add a test for FileAllInformation Modified: trunk/rostests/kmtests/ntos_io/IoFilesystem.c Modified: trunk/rostests/kmtests/ntos_io/IoFilesystem.c URL: http://svn.reactos.org/svn/reactos/trunk/rostests/kmtests/ntos_io/IoFilesys… ============================================================================== --- trunk/rostests/kmtests/ntos_io/IoFilesystem.c [iso-8859-1] (original) +++ trunk/rostests/kmtests/ntos_io/IoFilesystem.c [iso-8859-1] Mon Nov 16 13:53:03 2015 @@ -8,6 +8,201 @@ #include <kmt_test.h> /* FIXME: Test this stuff on non-FAT volumes */ + +static +NTSTATUS +QueryFileInfo( + _In_ HANDLE FileHandle, + _Out_ PVOID *Info, + _Inout_ PSIZE_T Length, + _In_ FILE_INFORMATION_CLASS FileInformationClass) +{ + NTSTATUS Status; + IO_STATUS_BLOCK IoStatus; + PVOID Buffer; + + *Info = NULL; + if (*Length) + { + Buffer = KmtAllocateGuarded(*Length); + if (skip(Buffer != NULL, "Failed to allocate %Iu bytes\n", *Length)) + return STATUS_INSUFFICIENT_RESOURCES; + } + else + { + Buffer = NULL; + } + RtlFillMemory(Buffer, *Length, 0xDD); + RtlFillMemory(&IoStatus, sizeof(IoStatus), 0x55); + _SEH2_TRY + { + Status = ZwQueryInformationFile(FileHandle, + &IoStatus, + Buffer, + *Length, + FileInformationClass); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + Status = _SEH2_GetExceptionCode(); + ok(0, "Exception %lx querying class %d with length %Iu\n", + Status, FileInformationClass, *Length); + } + _SEH2_END; + if (Status == STATUS_PENDING) + { + Status = ZwWaitForSingleObject(FileHandle, FALSE, NULL); + ok_eq_hex(Status, STATUS_SUCCESS); + Status = IoStatus.Status; + } + *Length = IoStatus.Information; + *Info = Buffer; + return Status; +} + +static +VOID +TestAllInformation(VOID) +{ + NTSTATUS Status; + UNICODE_STRING FileName = RTL_CONSTANT_STRING(L"\\SystemRoot\\system32\\ntoskrnl.exe"); + UNICODE_STRING Ntoskrnl = RTL_CONSTANT_STRING(L"ntoskrnl.exe"); + OBJECT_ATTRIBUTES ObjectAttributes; + HANDLE FileHandle; + IO_STATUS_BLOCK IoStatus; + PFILE_ALL_INFORMATION FileAllInfo; + SIZE_T Length; + ULONG NameLength; + PWCHAR Name = NULL; + UNICODE_STRING NamePart; + + InitializeObjectAttributes(&ObjectAttributes, + &FileName, + OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, + NULL, + NULL); + Status = ZwOpenFile(&FileHandle, + SYNCHRONIZE | FILE_READ_ATTRIBUTES, + &ObjectAttributes, + &IoStatus, + FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, + FILE_NON_DIRECTORY_FILE); + if (Status == STATUS_PENDING) + { + Status = ZwWaitForSingleObject(FileHandle, FALSE, NULL); + ok_eq_hex(Status, STATUS_SUCCESS); + Status = IoStatus.Status; + } + ok_eq_hex(Status, STATUS_SUCCESS); + if (skip(NT_SUCCESS(Status), "No file handle, %lx\n", Status)) + return; + + /* NtQueryInformationFile doesn't do length checks for kernel callers in a free build */ + if (KmtIsCheckedBuild) + { + /* Zero length */ + Length = 0; + Status = QueryFileInfo(FileHandle, (PVOID*)&FileAllInfo, &Length, FileAllInformation); + ok_eq_hex(Status, STATUS_INFO_LENGTH_MISMATCH); + ok_eq_size(Length, (ULONG_PTR)0x5555555555555555); + if (FileAllInfo) + KmtFreeGuarded(FileAllInfo); + + /* One less than the minimum */ + Length = FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) - 1; + Status = QueryFileInfo(FileHandle, (PVOID*)&FileAllInfo, &Length, FileAllInformation); + ok_eq_hex(Status, STATUS_INFO_LENGTH_MISMATCH); + ok_eq_size(Length, (ULONG_PTR)0x5555555555555555); + if (FileAllInfo) + KmtFreeGuarded(FileAllInfo); + } + + /* The minimum allowed */ + Length = FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName); + Status = QueryFileInfo(FileHandle, (PVOID*)&FileAllInfo, &Length, FileAllInformation); + ok_eq_hex(Status, STATUS_BUFFER_OVERFLOW); + ok_eq_size(Length, FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName)); + if (FileAllInfo) + KmtFreeGuarded(FileAllInfo); + + /* Plenty of space -- determine NameLength and copy the name */ + Length = FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + MAX_PATH * sizeof(WCHAR); + Status = QueryFileInfo(FileHandle, (PVOID*)&FileAllInfo, &Length, FileAllInformation); + ok_eq_hex(Status, STATUS_SUCCESS); + if (!skip(NT_SUCCESS(Status) && FileAllInfo != NULL, "No info\n")) + { + NameLength = FileAllInfo->NameInformation.FileNameLength; + ok_eq_size(Length, FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + NameLength); + Name = ExAllocatePoolWithTag(PagedPool, NameLength + sizeof(UNICODE_NULL), 'sFmK'); + if (!skip(Name != NULL, "Could not allocate %lu bytes\n", NameLength + (ULONG)sizeof(UNICODE_NULL))) + { + RtlCopyMemory(Name, + FileAllInfo->NameInformation.FileName, + NameLength); + Name[NameLength / sizeof(WCHAR)] = UNICODE_NULL; + ok(Name[0] == L'\\', "Name is %ls, expected first char to be \\\n", Name); + ok(NameLength >= Ntoskrnl.Length + sizeof(WCHAR), "NameLength %lu too short\n", NameLength); + if (NameLength >= Ntoskrnl.Length) + { + NamePart.Buffer = Name + (NameLength - Ntoskrnl.Length) / sizeof(WCHAR); + NamePart.Length = Ntoskrnl.Length; + NamePart.MaximumLength = NamePart.Length; + ok(RtlEqualUnicodeString(&NamePart, &Ntoskrnl, TRUE), + "Name ends in '%wZ', expected %wZ\n", &NamePart, &Ntoskrnl); + } + } + ok(FileAllInfo->NameInformation.FileName[NameLength / sizeof(WCHAR)] == 0xdddd, + "Char past FileName is %x\n", + FileAllInfo->NameInformation.FileName[NameLength / sizeof(WCHAR)]); + } + if (FileAllInfo) + KmtFreeGuarded(FileAllInfo); + + /* One char less than needed */ + Length = FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + NameLength - sizeof(WCHAR); + Status = QueryFileInfo(FileHandle, (PVOID*)&FileAllInfo, &Length, FileAllInformation); + ok_eq_hex(Status, STATUS_BUFFER_OVERFLOW); + ok_eq_size(Length, FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + NameLength - sizeof(WCHAR)); + if (FileAllInfo) + KmtFreeGuarded(FileAllInfo); + + /* One byte less than needed */ + Length = FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + NameLength - 1; + Status = QueryFileInfo(FileHandle, (PVOID*)&FileAllInfo, &Length, FileAllInformation); + ok_eq_hex(Status, STATUS_BUFFER_OVERFLOW); + ok_eq_size(Length, FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + NameLength - 1); + if (FileAllInfo) + KmtFreeGuarded(FileAllInfo); + + /* Exactly the required size */ + Length = FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + NameLength; + Status = QueryFileInfo(FileHandle, (PVOID*)&FileAllInfo, &Length, FileAllInformation); + ok_eq_hex(Status, STATUS_SUCCESS); + ok_eq_size(Length, FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + NameLength); + if (FileAllInfo) + KmtFreeGuarded(FileAllInfo); + + /* One byte more than needed */ + Length = FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + NameLength + 1; + Status = QueryFileInfo(FileHandle, (PVOID*)&FileAllInfo, &Length, FileAllInformation); + ok_eq_hex(Status, STATUS_SUCCESS); + ok_eq_size(Length, FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + NameLength); + if (FileAllInfo) + KmtFreeGuarded(FileAllInfo); + + /* One char more than needed */ + Length = FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + NameLength + sizeof(WCHAR); + Status = QueryFileInfo(FileHandle, (PVOID*)&FileAllInfo, &Length, FileAllInformation); + ok_eq_hex(Status, STATUS_SUCCESS); + ok_eq_size(Length, FIELD_OFFSET(FILE_ALL_INFORMATION, NameInformation.FileName) + NameLength); + if (FileAllInfo) + KmtFreeGuarded(FileAllInfo); + + ExFreePoolWithTag(Name, 'sFmK'); + + Status = ObCloseHandle(FileHandle, KernelMode); + ok_eq_hex(Status, STATUS_SUCCESS); +} static VOID @@ -443,6 +638,7 @@ START_TEST(IoFilesystem) { + TestAllInformation(); TestRelativeNames(); TestSharedCacheMap(); }

1 0

[tfaber] 69896: [CDFS] - Don't access file name buffer if its Length is zero in CdfsMakeAbsoluteFilename CORE-10459
by tfaber＠svn.reactos.org 16 Nov '15

16 Nov '15

Author: tfaber Date: Mon Nov 16 11:01:36 2015 New Revision: 69896 URL: http://svn.reactos.org/svn/reactos?rev=69896&view=rev Log: [CDFS] - Don't access file name buffer if its Length is zero in CdfsMakeAbsoluteFilename CORE-10459 Modified: trunk/reactos/drivers/filesystems/cdfs/create.c Modified: trunk/reactos/drivers/filesystems/cdfs/create.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/filesystems/cdfs/c… ============================================================================== --- trunk/reactos/drivers/filesystems/cdfs/create.c [iso-8859-1] (original) +++ trunk/reactos/drivers/filesystems/cdfs/create.c [iso-8859-1] Mon Nov 16 11:01:36 2015 @@ -50,7 +50,8 @@ /* verify related object is a directory and target name don't start with \. */ if ((Fcb->Entry.FileFlags & FILE_FLAG_DIRECTORY) == 0 || - RelativeFileName->Buffer[0] == L'\\') + (RelativeFileName->Length >= sizeof(WCHAR) && + RelativeFileName->Buffer[0] == L'\\')) { return STATUS_INVALID_PARAMETER; }

1 0

[tfaber] 69895: [NTDLL_APITEST] - Add a test for RtlImageRvaToVa CORE-10523
by tfaber＠svn.reactos.org 16 Nov '15

16 Nov '15

Author: tfaber Date: Mon Nov 16 09:48:39 2015 New Revision: 69895 URL: http://svn.reactos.org/svn/reactos?rev=69895&view=rev Log: [NTDLL_APITEST] - Add a test for RtlImageRvaToVa CORE-10523 Added: trunk/rostests/apitests/ntdll/RtlImageRvaToVa.c (with props) Modified: trunk/rostests/apitests/ntdll/CMakeLists.txt trunk/rostests/apitests/ntdll/testlist.c Modified: trunk/rostests/apitests/ntdll/CMakeLists.txt URL: http://svn.reactos.org/svn/reactos/trunk/rostests/apitests/ntdll/CMakeLists… ============================================================================== --- trunk/rostests/apitests/ntdll/CMakeLists.txt [iso-8859-1] (original) +++ trunk/rostests/apitests/ntdll/CMakeLists.txt [iso-8859-1] Mon Nov 16 09:48:39 2015 @@ -31,6 +31,7 @@ RtlGetFullPathName_UstrEx.c RtlGetLengthWithoutTrailingPathSeperators.c RtlGetLongestNtPathLength.c + RtlImageRvaToVa.c RtlInitializeBitMap.c RtlMemoryStream.c RtlReAllocateHeap.c Added: trunk/rostests/apitests/ntdll/RtlImageRvaToVa.c URL: http://svn.reactos.org/svn/reactos/trunk/rostests/apitests/ntdll/RtlImageRv… ============================================================================== --- trunk/rostests/apitests/ntdll/RtlImageRvaToVa.c (added) +++ trunk/rostests/apitests/ntdll/RtlImageRvaToVa.c [iso-8859-1] Mon Nov 16 09:48:39 2015 @@ -0,0 +1,235 @@ +/* + * PROJECT: ReactOS api tests + * LICENSE: LGPLv2.1+ - See COPYING.LIB in the top level directory + * PURPOSE: Test for RtlImageRvaToVa + * PROGRAMMERS: Thomas Faber <thomas.faber(a)reactos.org> + */ + +#include <apitest.h> +#include <ndk/mmfuncs.h> +#include <ndk/rtlfuncs.h> + +static +PVOID +AllocateGuarded( + _In_ SIZE_T SizeRequested) +{ + NTSTATUS Status; + SIZE_T Size = PAGE_ROUND_UP(SizeRequested + PAGE_SIZE); + PVOID VirtualMemory = NULL; + PCHAR StartOfBuffer; + + Status = NtAllocateVirtualMemory(NtCurrentProcess(), &VirtualMemory, 0, &Size, MEM_RESERVE, PAGE_NOACCESS); + + if (!NT_SUCCESS(Status)) + return NULL; + + Size -= PAGE_SIZE; + if (Size) + { + Status = NtAllocateVirtualMemory(NtCurrentProcess(), &VirtualMemory, 0, &Size, MEM_COMMIT, PAGE_READWRITE); + if (!NT_SUCCESS(Status)) + { + Size = 0; + Status = NtFreeVirtualMemory(NtCurrentProcess(), &VirtualMemory, &Size, MEM_RELEASE); + ok(Status == STATUS_SUCCESS, "Status = %lx\n", Status); + return NULL; + } + } + + StartOfBuffer = VirtualMemory; + StartOfBuffer += Size - SizeRequested; + + return StartOfBuffer; +} + +static +VOID +FreeGuarded( + _In_ PVOID Pointer) +{ + NTSTATUS Status; + PVOID VirtualMemory = (PVOID)PAGE_ROUND_DOWN((SIZE_T)Pointer); + SIZE_T Size = 0; + + Status = NtFreeVirtualMemory(NtCurrentProcess(), &VirtualMemory, &Size, MEM_RELEASE); + ok(Status == STATUS_SUCCESS, "Status = %lx\n", Status); +} + +START_TEST(RtlImageRvaToVa) +{ + PIMAGE_NT_HEADERS NtHeader; + PIMAGE_SECTION_HEADER Section; + ULONG NumberOfSections; + ULONG ImageSize; + PUCHAR BaseAddress; + PVOID Va; + PIMAGE_SECTION_HEADER OutSection; + IMAGE_SECTION_HEADER DummySection; + struct + { + ULONG Rva; + ULONG VaOffset; + ULONG SectionIndex; + } Tests[] = + { + { 0, 0, 0 }, + { 0xfff, 0, 0 }, + { 0x1000, 0x3000, 0 }, + { 0x1001, 0x3001, 0 }, + { 0x1fff, 0x3fff, 0 }, + { 0x2000, 0, 0 }, + { 0x2fff, 0, 0 }, + { 0x3000, 0x4000, 3 }, + { 0x3fff, 0x4fff, 3 }, + { 0x4000, 0x5000, 3 }, + { 0x4fff, 0x5fff, 3 }, + { 0x5000, 0, 0 }, + { 0x5fff, 0, 0 }, + { 0x6000, 0, 0 }, + { 0x6fff, 0, 0 }, + { 0x7000, 0x7000, 5 }, + { 0x7fff, 0x7fff, 5 }, + { 0x8000, 0x9000, 7 }, + { 0x8fff, 0x9fff, 7 }, + { 0x9000, 0x8000, 6 }, + { 0x9fff, 0x8fff, 6 }, + }; + ULONG i; + + NumberOfSections = 8; + ImageSize = FIELD_OFFSET(IMAGE_NT_HEADERS, OptionalHeader.DataDirectory) + + NumberOfSections * sizeof(IMAGE_SECTION_HEADER); + NtHeader = AllocateGuarded(ImageSize); + if (!NtHeader) + { + skip("Could not allocate %lu bytes\n", ImageSize); + return; + } + + RtlFillMemory(NtHeader, ImageSize, 0xDD); + NtHeader->FileHeader.NumberOfSections = NumberOfSections; + NtHeader->FileHeader.SizeOfOptionalHeader = FIELD_OFFSET(IMAGE_OPTIONAL_HEADER, DataDirectory); + Section = (PIMAGE_SECTION_HEADER)((PUCHAR)&NtHeader->OptionalHeader + + NtHeader->FileHeader.SizeOfOptionalHeader); + Section[0].VirtualAddress = 0x1000; + Section[0].Misc.VirtualSize = 0x1000; + Section[0].SizeOfRawData = 0x1000; + Section[0].PointerToRawData = 0x3000; + Section[1].VirtualAddress = 0x2000; + Section[1].Misc.VirtualSize = 0; + Section[1].SizeOfRawData = 0; + Section[1].PointerToRawData = 0x4000; + Section[2].VirtualAddress = 0x2000; + Section[2].Misc.VirtualSize = 0x1000; + Section[2].SizeOfRawData = 0; + Section[2].PointerToRawData = 0x4000; + Section[3].VirtualAddress = 0x3000; + Section[3].Misc.VirtualSize = 0x1000; + Section[3].SizeOfRawData = 0x2000; + Section[3].PointerToRawData = 0x4000; + Section[4].VirtualAddress = 0x4000; + Section[4].Misc.VirtualSize = 0x2000; + Section[4].SizeOfRawData = 0x1000; + Section[4].PointerToRawData = 0x6000; + Section[5].VirtualAddress = 0x7000; + Section[5].Misc.VirtualSize = 0x1000; + Section[5].SizeOfRawData = 0x1000; + Section[5].PointerToRawData = 0x7000; + Section[6].VirtualAddress = 0x9000; + Section[6].Misc.VirtualSize = 0x1000; + Section[6].SizeOfRawData = 0x1000; + Section[6].PointerToRawData = 0x8000; + Section[7].VirtualAddress = 0x8000; + Section[7].Misc.VirtualSize = 0x1000; + Section[7].SizeOfRawData = 0x1000; + Section[7].PointerToRawData = 0x9000; + DummySection.VirtualAddress = 0xf000; + DummySection.Misc.VirtualSize = 0xf000; + DummySection.SizeOfRawData = 0xf000; + DummySection.PointerToRawData = 0xf000; + + BaseAddress = (PUCHAR)0x2000000; + + StartSeh() + RtlImageRvaToVa(NULL, NULL, 0, NULL); + EndSeh(STATUS_ACCESS_VIOLATION); + + Va = RtlImageRvaToVa(NtHeader, NULL, 0, NULL); + ok(Va == NULL, "Va = %p\n", Va); + + Va = RtlImageRvaToVa(NtHeader, BaseAddress, 0, NULL); + ok(Va == NULL, "Va = %p\n", Va); + + OutSection = NULL; + Va = RtlImageRvaToVa(NtHeader, BaseAddress, 0, &OutSection); + ok(Va == NULL, "Va = %p\n", Va); + ok(OutSection == NULL, "OutSection = %p\n", OutSection); + + OutSection = (PVOID)1; + StartSeh() + RtlImageRvaToVa(NtHeader, BaseAddress, 0, &OutSection); + EndSeh(STATUS_ACCESS_VIOLATION); + + for (i = 0; i < RTL_NUMBER_OF(Tests); i++) + { + /* Section = not specified */ + StartSeh() + Va = RtlImageRvaToVa(NtHeader, BaseAddress, Tests[i].Rva, NULL); + EndSeh(STATUS_SUCCESS); + if (Tests[i].VaOffset == 0) + ok(Va == NULL, "[0x%lx] Va = %p\n", Tests[i].Rva, Va); + else + ok(Va == BaseAddress + Tests[i].VaOffset, "[0x%lx] Va = %p\n", Tests[i].Rva, Va); + + /* Section = NULL */ + OutSection = NULL; + StartSeh() + Va = RtlImageRvaToVa(NtHeader, BaseAddress, Tests[i].Rva, &OutSection); + EndSeh(STATUS_SUCCESS); + if (Tests[i].VaOffset == 0) + { + ok(Va == NULL, "[0x%lx] Va = %p\n", Tests[i].Rva, Va); + ok(OutSection == NULL, "[0x%lx] OutSection = %p (%Id)\n", Tests[i].Rva, OutSection, OutSection - Section); + } + else + { + ok(Va == BaseAddress + Tests[i].VaOffset, "[0x%lx] Va = %p\n", Tests[i].Rva, Va); + ok(OutSection == &Section[Tests[i].SectionIndex], "[0x%lx] OutSection = %p (%Id)\n", Tests[i].Rva, OutSection, OutSection - Section); + } + + /* Section = first section */ + OutSection = Section; + StartSeh() + Va = RtlImageRvaToVa(NtHeader, BaseAddress, Tests[i].Rva, &OutSection); + EndSeh(STATUS_SUCCESS); + if (Tests[i].VaOffset == 0) + { + ok(Va == NULL, "[0x%lx] Va = %p\n", Tests[i].Rva, Va); + ok(OutSection == Section, "[0x%lx] OutSection = %p (%Id)\n", Tests[i].Rva, OutSection, OutSection - Section); + } + else + { + ok(Va == BaseAddress + Tests[i].VaOffset, "[0x%lx] Va = %p\n", Tests[i].Rva, Va); + ok(OutSection == &Section[Tests[i].SectionIndex], "[0x%lx] OutSection = %p (%Id)\n", Tests[i].Rva, OutSection, OutSection - Section); + } + + /* Section = dummy section */ + OutSection = &DummySection; + StartSeh() + Va = RtlImageRvaToVa(NtHeader, BaseAddress, Tests[i].Rva, &OutSection); + EndSeh(STATUS_SUCCESS); + if (Tests[i].VaOffset == 0) + { + ok(Va == NULL, "[0x%lx] Va = %p\n", Tests[i].Rva, Va); + ok(OutSection == &DummySection, "[0x%lx] OutSection = %p (%Id)\n", Tests[i].Rva, OutSection, OutSection - Section); + } + else + { + ok(Va == BaseAddress + Tests[i].VaOffset, "[0x%lx] Va = %p\n", Tests[i].Rva, Va); + ok(OutSection == &Section[Tests[i].SectionIndex], "[0x%lx] OutSection = %p (%Id)\n", Tests[i].Rva, OutSection, OutSection - Section); + } + } + + FreeGuarded(NtHeader); +} Propchange: trunk/rostests/apitests/ntdll/RtlImageRvaToVa.c ------------------------------------------------------------------------------ svn:eol-style = native Modified: trunk/rostests/apitests/ntdll/testlist.c URL: http://svn.reactos.org/svn/reactos/trunk/rostests/apitests/ntdll/testlist.c… ============================================================================== --- trunk/rostests/apitests/ntdll/testlist.c [iso-8859-1] (original) +++ trunk/rostests/apitests/ntdll/testlist.c [iso-8859-1] Mon Nov 16 09:48:39 2015 @@ -35,6 +35,7 @@ extern void func_RtlGetFullPathName_UstrEx(void); extern void func_RtlGetLengthWithoutTrailingPathSeperators(void); extern void func_RtlGetLongestNtPathLength(void); +extern void func_RtlImageRvaToVa(void); extern void func_RtlInitializeBitMap(void); extern void func_RtlMemoryStream(void); extern void func_RtlReAllocateHeap(void); @@ -75,6 +76,7 @@ { "RtlGetFullPathName_UstrEx", func_RtlGetFullPathName_UstrEx }, { "RtlGetLengthWithoutTrailingPathSeperators", func_RtlGetLengthWithoutTrailingPathSeperators }, { "RtlGetLongestNtPathLength", func_RtlGetLongestNtPathLength }, + { "RtlImageRvaToVa", func_RtlImageRvaToVa }, { "RtlInitializeBitMap", func_RtlInitializeBitMap }, { "RtlMemoryStream", func_RtlMemoryStream }, { "RtlReAllocateHeap", func_RtlReAllocateHeap },

1 0

[ekohl] 69894: [SYSSETUP] Add a hack to set the Primary Domain Name (Workgroup Name). #CORE-10459 #comment Does this fix the bug?
by ekohl＠svn.reactos.org 15 Nov '15

15 Nov '15

Author: ekohl Date: Sun Nov 15 20:54:12 2015 New Revision: 69894 URL: http://svn.reactos.org/svn/reactos?rev=69894&view=rev Log: [SYSSETUP] Add a hack to set the Primary Domain Name (Workgroup Name). #CORE-10459 #comment Does this fix the bug? Modified: trunk/reactos/dll/win32/syssetup/security.c Modified: trunk/reactos/dll/win32/syssetup/security.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/syssetup/securit… ============================================================================== --- trunk/reactos/dll/win32/syssetup/security.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/syssetup/security.c [iso-8859-1] Sun Nov 15 20:54:12 2015 @@ -127,6 +127,81 @@ SamCloseHandle(ServerHandle); } + + return Status; +} + + +/* Hack */ +static +NTSTATUS +SetPrimaryDomain(LPCWSTR DomainName, + PSID DomainSid) +{ + PPOLICY_PRIMARY_DOMAIN_INFO OrigInfo = NULL; + POLICY_PRIMARY_DOMAIN_INFO Info; + LSA_OBJECT_ATTRIBUTES ObjectAttributes; + LSA_HANDLE PolicyHandle; + NTSTATUS Status; + + DPRINT1("SYSSETUP: SetPrimaryDomain()\n"); + + memset(&ObjectAttributes, 0, sizeof(LSA_OBJECT_ATTRIBUTES)); + ObjectAttributes.Length = sizeof(LSA_OBJECT_ATTRIBUTES); + + Status = LsaOpenPolicy(NULL, + &ObjectAttributes, + POLICY_VIEW_LOCAL_INFORMATION | POLICY_TRUST_ADMIN, + &PolicyHandle); + if (Status != STATUS_SUCCESS) + { + DPRINT("LsaOpenPolicy failed (Status: 0x%08lx)\n", Status); + return Status; + } + + Status = LsaQueryInformationPolicy(PolicyHandle, + PolicyPrimaryDomainInformation, + (PVOID *)&OrigInfo); + if (Status == STATUS_SUCCESS && OrigInfo != NULL) + { + if (DomainName == NULL) + { + Info.Name.Buffer = OrigInfo->Name.Buffer; + Info.Name.Length = OrigInfo->Name.Length; + Info.Name.MaximumLength = OrigInfo->Name.MaximumLength; + } + else + { + Info.Name.Buffer = (LPWSTR)DomainName; + Info.Name.Length = wcslen(DomainName) * sizeof(WCHAR); + Info.Name.MaximumLength = Info.Name.Length + sizeof(WCHAR); + } + + if (DomainSid == NULL) + Info.Sid = OrigInfo->Sid; + else + Info.Sid = DomainSid; + } + else + { + Info.Name.Buffer = (LPWSTR)DomainName; + Info.Name.Length = wcslen(DomainName) * sizeof(WCHAR); + Info.Name.MaximumLength = Info.Name.Length + sizeof(WCHAR); + Info.Sid = DomainSid; + } + + Status = LsaSetInformationPolicy(PolicyHandle, + PolicyPrimaryDomainInformation, + (PVOID)&Info); + if (Status != STATUS_SUCCESS) + { + DPRINT("LsaSetInformationPolicy failed (Status: 0x%08lx)\n", Status); + } + + if (OrigInfo != NULL) + LsaFreeMemory(OrigInfo); + + LsaClose(PolicyHandle); return Status; } @@ -317,11 +392,15 @@ SetupCloseInfFile(hSecurityInf); } + VOID InstallSecurity(VOID) { InstallBuiltinAccounts(); InstallPrivileges(); + + /* Hack */ + SetPrimaryDomain(L"WORKGROUP", NULL); }

1 0

[hbelusca] 69893: [CSRSRV][CONSRV]: Remove the DPRINTs introduced for solving CORE-10510 and CORE-9742.
by hbelusca＠svn.reactos.org 15 Nov '15

15 Nov '15

Author: hbelusca Date: Sun Nov 15 15:18:59 2015 New Revision: 69893 URL: http://svn.reactos.org/svn/reactos?rev=69893&view=rev Log: [CSRSRV][CONSRV]: Remove the DPRINTs introduced for solving CORE-10510 and CORE-9742. Modified: trunk/reactos/subsystems/win32/csrsrv/thredsup.c trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c Modified: trunk/reactos/subsystems/win32/csrsrv/thredsup.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrsrv/th… ============================================================================== --- trunk/reactos/subsystems/win32/csrsrv/thredsup.c [iso-8859-1] (original) +++ trunk/reactos/subsystems/win32/csrsrv/thredsup.c [iso-8859-1] Sun Nov 15 15:18:59 2015 @@ -438,13 +438,6 @@ { UnProtectHandle(CsrThread->ThreadHandle); Status = NtClose(CsrThread->ThreadHandle); - - if (!NT_SUCCESS(Status)) - DPRINT1("CSR: NtClose failed, we are going to ASSERT, Status = 0x%08lx; P:[0x%x, 0x%x] T:[0x%x, 0x%x] Process: 0x%p; Thread: 0x%p; ThreadHandle: 0x%p\n", - Status, CsrProcess->ClientId.UniqueProcess, CsrProcess->ClientId.UniqueThread, - CsrThread->ClientId.UniqueProcess, CsrThread->ClientId.UniqueThread, - CsrProcess, CsrThread, CsrThread->ThreadHandle); - ASSERT(NT_SUCCESS(Status)); } Modified: trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/winsrv/consrv… ============================================================================== --- trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c [iso-8859-1] (original) +++ trunk/reactos/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c [iso-8859-1] Sun Nov 15 15:18:59 2015 @@ -167,27 +167,9 @@ if (!NT_SUCCESS(Status)) goto Quit; /* Connect this CSR thread to the USER subsystem */ - { - PCSR_THREAD CurrThread = CsrGetClientThread(); - PCSR_PROCESS CsrProcess; - - DPRINT1("CsrConnectToUser being called; 0x%p [0x%x, 0x%x]...\n", - CurrThread, (CurrThread ? CurrThread->ClientId.UniqueProcess : (HANDLE)-1), (CurrThread ? CurrThread->ClientId.UniqueThread : (HANDLE)-1)); - pcsrt = CsrConnectToUser(); if (pcsrt == NULL) goto Quit; hThread = pcsrt->ThreadHandle; - - CurrThread = CsrGetClientThread(); - CsrProcess = CurrThread->Process; - - DPRINT1("CsrConnectToUser was successfully called; P:[0x%x, 0x%x] T:[0x%x, 0x%x] Process: 0x%p; Thread: 0x%p -- hThread = 0x%p, pcsrt = 0x%p; pcsrt->Process = 0x%p; pcsrt->ThreadHandle = 0x%p from [0x%x, 0x%x]\n", - CsrProcess->ClientId.UniqueProcess, CsrProcess->ClientId.UniqueThread, - CurrThread->ClientId.UniqueProcess, CurrThread->ClientId.UniqueThread, - CsrProcess, CurrThread, - hThread, pcsrt, pcsrt->Process, pcsrt->ThreadHandle, - pcsrt->ClientId.UniqueProcess, pcsrt->ClientId.UniqueThread); - } /* Assign the desktop to this thread */ if (!SetThreadDesktop(DesktopConsoleThreadInfo.DesktopHandle)) goto Quit; @@ -329,15 +311,8 @@ /* Cleanup CSR thread */ if (pcsrt) { - PCSR_THREAD CurrThread = CsrGetClientThread(); - - DPRINT1("CsrDereferenceThread being called; [0x%x, 0x%x] -- hThread = 0x%p, pcsrt->Process = 0x%p; pcsrt->ThreadHandle = 0x%p from [0x%x, 0x%x]\n", - CurrThread->ClientId.UniqueProcess, CurrThread->ClientId.UniqueThread, - hThread, pcsrt->Process, pcsrt->ThreadHandle, - pcsrt->ClientId.UniqueProcess, pcsrt->ClientId.UniqueThread); - if (hThread != pcsrt->ThreadHandle) - DPRINT1("WARNING!! hThread != pcsrt->ThreadHandle, you may expect crashes soon!!\n"); + DPRINT1("WARNING!! hThread (0x%p) != pcsrt->ThreadHandle (0x%p), you may expect crashes soon!!\n", hThread, pcsrt->ThreadHandle); CsrDereferenceThread(pcsrt); }

1 0

[ekohl] 69892: [FASTFAT] Ooops! That should not have been committed!
by ekohl＠svn.reactos.org 14 Nov '15

14 Nov '15

Author: ekohl Date: Sat Nov 14 21:10:02 2015 New Revision: 69892 URL: http://svn.reactos.org/svn/reactos?rev=69892&view=rev Log: [FASTFAT] Ooops! That should not have been committed! Modified: trunk/reactos/drivers/filesystems/fastfat/finfo.c Modified: trunk/reactos/drivers/filesystems/fastfat/finfo.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/filesystems/fastfa… ============================================================================== --- trunk/reactos/drivers/filesystems/fastfat/finfo.c [iso-8859-1] (original) +++ trunk/reactos/drivers/filesystems/fastfat/finfo.c [iso-8859-1] Sat Nov 14 21:10:02 2015 @@ -340,7 +340,6 @@ if (*FCB->Attributes & FILE_ATTRIBUTE_READONLY) { -DPRINT1("\n"); return STATUS_CANNOT_DELETE; } @@ -349,26 +348,21 @@ (FCB->LongNameU.Length == 2 * sizeof(WCHAR) && FCB->LongNameU.Buffer[0] == L'.' && FCB->LongNameU.Buffer[1] == L'.')) { /* we cannot delete a '.', '..' or the root directory */ - -DPRINT1("\n"); + return STATUS_ACCESS_DENIED; + } + + if (!MmFlushImageSection (FileObject->SectionObjectPointer, MmFlushForDelete)) + { + /* can't delete a file if its mapped into a process */ + + DPRINT("MmFlushImageSection returned FALSE\n"); return STATUS_CANNOT_DELETE; -// return STATUS_ACCESS_DENIED; - } - - if (!MmFlushImageSection (FileObject->SectionObjectPointer, MmFlushForDelete)) - { - /* can't delete a file if its mapped into a process */ - - DPRINT("MmFlushImageSection returned FALSE\n"); -DPRINT1("\n"); - return STATUS_CANNOT_DELETE; } if (vfatFCBIsDirectory(FCB) && !VfatIsDirectoryEmpty(FCB)) { /* can't delete a non-empty directory */ -DPRINT1("\n"); return STATUS_DIRECTORY_NOT_EMPTY; }

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Ros-diffs