Author: jmorlan Date: Sun May 23 04:58:23 2010 New Revision: 47316
URL: http://svn.reactos.org/svn/reactos?rev=47316&view=rev Log: [WIN32CSR] Protect ProcessData->Console with the HandleTableLock.
Modified: trunk/reactos/subsystems/win32/csrss/win32csr/conio.c trunk/reactos/subsystems/win32/csrss/win32csr/handle.c
Modified: trunk/reactos/subsystems/win32/csrss/win32csr/conio.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/win3... ============================================================================== --- trunk/reactos/subsystems/win32/csrss/win32csr/conio.c [iso-8859-1] (original) +++ trunk/reactos/subsystems/win32/csrss/win32csr/conio.c [iso-8859-1] Sun May 23 04:58:23 2010 @@ -41,15 +41,20 @@ NTSTATUS FASTCALL ConioConsoleFromProcessData(PCSRSS_PROCESS_DATA ProcessData, PCSRSS_CONSOLE *Console) { - PCSRSS_CONSOLE ProcessConsole = ProcessData->Console; + PCSRSS_CONSOLE ProcessConsole; + + RtlEnterCriticalSection(&ProcessData->HandleTableLock); + ProcessConsole = ProcessData->Console;
if (!ProcessConsole) { *Console = NULL; + RtlLeaveCriticalSection(&ProcessData->HandleTableLock); return STATUS_INVALID_HANDLE; }
InterlockedIncrement(&ProcessConsole->Header.ReferenceCount); + RtlLeaveCriticalSection(&ProcessData->HandleTableLock); EnterCriticalSection(&(ProcessConsole->Header.Lock)); *Console = ProcessConsole;
@@ -247,9 +252,11 @@ Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE); Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
+ RtlEnterCriticalSection(&ProcessData->HandleTableLock); if (ProcessData->Console) { DPRINT1("Process already has a console\n"); + RtlLeaveCriticalSection(&ProcessData->HandleTableLock); return STATUS_INVALID_PARAMETER; }
@@ -257,6 +264,7 @@ if (!Request->Data.AllocConsoleRequest.ConsoleNeeded) { DPRINT("No console needed\n"); + RtlLeaveCriticalSection(&ProcessData->HandleTableLock); return STATUS_SUCCESS; }
@@ -270,6 +278,7 @@ if (NULL == Console) { DPRINT1("Not enough memory for console\n"); + RtlLeaveCriticalSection(&ProcessData->HandleTableLock); return STATUS_NO_MEMORY; } /* initialize list head */ @@ -282,6 +291,7 @@ { DPRINT1("Console init failed\n"); HeapFree(Win32CsrApiHeap, 0, Console); + RtlLeaveCriticalSection(&ProcessData->HandleTableLock); return Status; } } @@ -313,6 +323,7 @@ DPRINT1("Failed to insert object\n"); ConioDeleteConsole((Object_t *) Console); ProcessData->Console = 0; + RtlLeaveCriticalSection(&ProcessData->HandleTableLock); return Status; }
@@ -328,6 +339,7 @@ Win32CsrReleaseObject(ProcessData, Request->Data.AllocConsoleRequest.InputHandle); ProcessData->Console = 0; + RtlLeaveCriticalSection(&ProcessData->HandleTableLock); return Status; } } @@ -351,6 +363,7 @@ Request->Data.AllocConsoleRequest.InputHandle); } ProcessData->Console = 0; + RtlLeaveCriticalSection(&ProcessData->HandleTableLock); return Status; }
@@ -364,6 +377,7 @@ InsertHeadList(&ProcessData->Console->ProcessList, &ProcessData->ProcessEntry); }
+ RtlLeaveCriticalSection(&ProcessData->HandleTableLock); return STATUS_SUCCESS; }
@@ -1960,6 +1974,7 @@
DPRINT("CsrCreateScreenBuffer\n");
+ RtlEnterCriticalSection(&ProcessData->HandleTableLock); Status = ConioConsoleFromProcessData(ProcessData, &Console); if (! NT_SUCCESS(Status)) { @@ -2012,6 +2027,7 @@ }
ConioUnlockConsole(Console); + RtlLeaveCriticalSection(&ProcessData->HandleTableLock); return Status; }
Modified: trunk/reactos/subsystems/win32/csrss/win32csr/handle.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/win3... ============================================================================== --- trunk/reactos/subsystems/win32/csrss/win32csr/handle.c [iso-8859-1] (original) +++ trunk/reactos/subsystems/win32/csrss/win32csr/handle.c [iso-8859-1] Sun May 23 04:58:23 2010 @@ -146,27 +146,24 @@ Win32CsrReleaseConsole( PCSRSS_PROCESS_DATA ProcessData) { - ULONG HandleTableSize; - PCSRSS_HANDLE HandleTable; PCSRSS_CONSOLE Console; ULONG i;
/* Close all console handles and detach process from console */ RtlEnterCriticalSection(&ProcessData->HandleTableLock); - HandleTableSize = ProcessData->HandleTableSize; - HandleTable = ProcessData->HandleTable; + + for (i = 0; i < ProcessData->HandleTableSize; i++) + { + if (ProcessData->HandleTable[i].Object != NULL) + Win32CsrReleaseObjectByPointer(ProcessData->HandleTable[i].Object); + } + ProcessData->HandleTableSize = 0; + RtlFreeHeap(Win32CsrApiHeap, 0, ProcessData->HandleTable); + ProcessData->HandleTable = NULL; + Console = ProcessData->Console; - ProcessData->HandleTableSize = 0; - ProcessData->HandleTable = NULL; ProcessData->Console = NULL; RtlLeaveCriticalSection(&ProcessData->HandleTableLock); - - for (i = 0; i < HandleTableSize; i++) - { - if (HandleTable[i].Object != NULL) - Win32CsrReleaseObjectByPointer(HandleTable[i].Object); - } - RtlFreeHeap(Win32CsrApiHeap, 0, HandleTable);
if (Console != NULL) { @@ -272,6 +269,7 @@ Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE); Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
+ RtlEnterCriticalSection(&ProcessData->HandleTableLock); if (ProcessData->Console) { Request->Status = Win32CsrInsertObject(ProcessData, @@ -285,6 +283,7 @@ Request->Data.GetInputHandleRequest.InputHandle = INVALID_HANDLE_VALUE; Request->Status = STATUS_SUCCESS; } + RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
return Request->Status; } @@ -294,6 +293,7 @@ Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE); Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
+ RtlEnterCriticalSection(&ProcessData->HandleTableLock); if (ProcessData->Console) { Request->Status = Win32CsrInsertObject(ProcessData, @@ -307,6 +307,7 @@ Request->Data.GetOutputHandleRequest.OutputHandle = INVALID_HANDLE_VALUE; Request->Status = STATUS_SUCCESS; } + RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
return Request->Status; }