[ros-diffs] [weiden] 13143: secure access to buffers in NtQueryInformationProcess() and NtSetInformationProcess()

secure access to buffers in NtQueryInformationProcess() and
NtSetInformationProcess()
Modified: trunk/reactos/ntoskrnl/ps/process.c
  _____  

Modified: trunk/reactos/ntoskrnl/ps/process.c
--- trunk/reactos/ntoskrnl/ps/process.c	2005-01-19 22:45:14 UTC (rev
13142)
+++ trunk/reactos/ntoskrnl/ps/process.c	2005-01-19 22:47:26 UTC (rev
13143)
@@ -1147,7 +1147,7 @@

 				      PreviousMode,
 				      (PVOID*)&Process,
 				      NULL);
-   if (Status != STATUS_SUCCESS)
+   if (!NT_SUCCESS(Status))
      {
 	return(Status);
      }
@@ -1161,22 +1161,31 @@
 	}
 	else
 	{
-	  PPROCESS_BASIC_INFORMATION ProcessBasicInformationP =
+          PPROCESS_BASIC_INFORMATION ProcessBasicInformationP =
 	    (PPROCESS_BASIC_INFORMATION)ProcessInformation;
-	  ProcessBasicInformationP->ExitStatus = Process->ExitStatus;
-	  ProcessBasicInformationP->PebBaseAddress = Process->Peb;
-	  ProcessBasicInformationP->AffinityMask =
Process->Pcb.Affinity;
-	  ProcessBasicInformationP->UniqueProcessId =
-	    Process->UniqueProcessId;
-	  ProcessBasicInformationP->InheritedFromUniqueProcessId =
-	    (ULONG)Process->InheritedFromUniqueProcessId;
-	  ProcessBasicInformationP->BasePriority =
-	    Process->Pcb.BasePriority;
-	  
-	  if (ReturnLength)
-	  {
-	    *ReturnLength = sizeof(PROCESS_BASIC_INFORMATION);
-	  }
+
+          _SEH_TRY
+          {
+	    ProcessBasicInformationP->ExitStatus = Process->ExitStatus;
+	    ProcessBasicInformationP->PebBaseAddress = Process->Peb;
+	    ProcessBasicInformationP->AffinityMask =
Process->Pcb.Affinity;
+	    ProcessBasicInformationP->UniqueProcessId =
+	      Process->UniqueProcessId;
+	    ProcessBasicInformationP->InheritedFromUniqueProcessId =
+	      (ULONG)Process->InheritedFromUniqueProcessId;
+	    ProcessBasicInformationP->BasePriority =
+	      Process->Pcb.BasePriority;
+
+	    if (ReturnLength)
+	    {
+	      *ReturnLength = sizeof(PROCESS_BASIC_INFORMATION);
+	    }
+          }
+          _SEH_HANDLE
+          {
+            Status = _SEH_GetExceptionCode();
+          }
+          _SEH_END;
 	}
 	break;
 
@@ -1192,18 +1201,24 @@
 	}
 	else
 	{
-	   PKERNEL_USER_TIMES ProcessTimeP =
-	                     (PKERNEL_USER_TIMES)ProcessInformation;
+           PKERNEL_USER_TIMES ProcessTimeP =
(PKERNEL_USER_TIMES)ProcessInformation;
+           _SEH_TRY
+           {
+	      ProcessTimeP->CreateTime = Process->CreateTime;
+              ProcessTimeP->UserTime.QuadPart = Process->Pcb.UserTime *
100000LL;
+              ProcessTimeP->KernelTime.QuadPart =
Process->Pcb.KernelTime * 100000LL;
+	      ProcessTimeP->ExitTime = Process->ExitTime;
 
-	   ProcessTimeP->CreateTime = Process->CreateTime;
-           ProcessTimeP->UserTime.QuadPart = Process->Pcb.UserTime *
100000LL;
-           ProcessTimeP->KernelTime.QuadPart = Process->Pcb.KernelTime
* 100000LL;
-	   ProcessTimeP->ExitTime = Process->ExitTime;
-
-	  if (ReturnLength)
-	  {
-	    *ReturnLength = sizeof(KERNEL_USER_TIMES);
-	  }
+	     if (ReturnLength)
+	     {
+	       *ReturnLength = sizeof(KERNEL_USER_TIMES);
+	     }
+           }
+           _SEH_HANDLE
+           {
+             Status = _SEH_GetExceptionCode();
+           }
+           _SEH_END;
 	}
 	break;
 
@@ -1221,12 +1236,21 @@
 	}
 	else
 	{
-	  PULONG HandleCount = (PULONG)ProcessInformation;
-	  *HandleCount =
ObpGetHandleCountByHandleTable(&Process->HandleTable);
-	  if (ReturnLength)
+	  ULONG HandleCount =
ObpGetHandleCountByHandleTable(&Process->HandleTable);
+	  
+	  _SEH_TRY
 	  {
-	    *ReturnLength = sizeof(ULONG);
+            *(PULONG)ProcessInformation = HandleCount;
+	    if (ReturnLength)
+	    {
+	      *ReturnLength = sizeof(ULONG);
+	    }
 	  }
+	  _SEH_HANDLE
+	  {
+            Status = _SEH_GetExceptionCode();
+	  }
+	  _SEH_END;
 	}
 	break;
 
@@ -1247,7 +1271,6 @@
             {
               *ReturnLength = sizeof(PROCESS_SESSION_INFORMATION);
             }
-            Status = STATUS_SUCCESS;
           }
           _SEH_HANDLE
           {
@@ -1271,27 +1294,36 @@
 	else
 	{
 	  PVM_COUNTERS pOut = (PVM_COUNTERS)ProcessInformation;
-	  pOut->PeakVirtualSize            = Process->PeakVirtualSize;
-	  /*
-	   * Here we should probably use VirtualSize.LowPart, but due to
-	   * incompatibilities in current headers (no unnamed union),
-	   * I opted for cast.
-	   */
-	  pOut->VirtualSize                =
(ULONG)Process->VirtualSize.QuadPart;
-	  pOut->PageFaultCount             = Process->Vm.PageFaultCount;
-	  pOut->PeakWorkingSetSize         =
Process->Vm.PeakWorkingSetSize;
-	  pOut->WorkingSetSize             = Process->Vm.WorkingSetSize;
-	  pOut->QuotaPeakPagedPoolUsage    =
Process->QuotaPeakPoolUsage[0]; // TODO: Verify!
-	  pOut->QuotaPagedPoolUsage        = Process->QuotaPoolUsage[0];
// TODO: Verify!
-	  pOut->QuotaPeakNonPagedPoolUsage =
Process->QuotaPeakPoolUsage[1]; // TODO: Verify!
-	  pOut->QuotaNonPagedPoolUsage     = Process->QuotaPoolUsage[1];
// TODO: Verify!
-	  pOut->PagefileUsage              = Process->PagefileUsage;
-	  pOut->PeakPagefileUsage          = Process->PeakPagefileUsage;
+	  
+	  _SEH_TRY
+	  {
+	    pOut->PeakVirtualSize            = Process->PeakVirtualSize;
+	    /*
+	     * Here we should probably use VirtualSize.LowPart, but due
to
+	     * incompatibilities in current headers (no unnamed union),
+	     * I opted for cast.
+	     */
+	    pOut->VirtualSize                =
(ULONG)Process->VirtualSize.QuadPart;
+	    pOut->PageFaultCount             =
Process->Vm.PageFaultCount;
+	    pOut->PeakWorkingSetSize         =
Process->Vm.PeakWorkingSetSize;
+	    pOut->WorkingSetSize             =
Process->Vm.WorkingSetSize;
+	    pOut->QuotaPeakPagedPoolUsage    =
Process->QuotaPeakPoolUsage[0]; // TODO: Verify!
+	    pOut->QuotaPagedPoolUsage        =
Process->QuotaPoolUsage[0];     // TODO: Verify!
+	    pOut->QuotaPeakNonPagedPoolUsage =
Process->QuotaPeakPoolUsage[1]; // TODO: Verify!
+	    pOut->QuotaNonPagedPoolUsage     =
Process->QuotaPoolUsage[1];     // TODO: Verify!
+	    pOut->PagefileUsage              = Process->PagefileUsage;
+	    pOut->PeakPagefileUsage          =
Process->PeakPagefileUsage;
 
-	  if (ReturnLength)
-	  {
-	    *ReturnLength = sizeof(VM_COUNTERS);
-	  }
+	    if (ReturnLength)
+	    {
+	      *ReturnLength = sizeof(VM_COUNTERS);
+	    }
+          }
+          _SEH_HANDLE
+          {
+            Status = _SEH_GetExceptionCode();
+          }
+          _SEH_END;
 	}
 	break;
 
@@ -1310,8 +1342,6 @@
 	    {
 	      *ReturnLength = sizeof(ULONG);
 	    }
-
-            Status = STATUS_SUCCESS;
 	  }
 	  _SEH_HANDLE
 	  {
@@ -1329,12 +1359,21 @@
 	else
 	{
 	  PULONG BoostEnabled = (PULONG)ProcessInformation;
-	  *BoostEnabled = Process->Pcb.DisableBoost ? FALSE : TRUE;
+	  
+	  _SEH_TRY
+	  {
+	    *BoostEnabled = Process->Pcb.DisableBoost ? FALSE : TRUE;
 
-	  if (ReturnLength)
-	  {
-	    *ReturnLength = sizeof(ULONG);
-	  }
+	    if (ReturnLength)
+	    {
+	      *ReturnLength = sizeof(ULONG);
+	    }
+          }
+          _SEH_HANDLE
+          {
+            Status = _SEH_GetExceptionCode();
+          }
+          _SEH_END;
 	}
 	break;
 
@@ -1345,11 +1384,23 @@
 	}
         else
         {
-	  ObQueryDeviceMapInformation(Process,
(PPROCESS_DEVICEMAP_INFORMATION)ProcessInformation);
-	  if (ReturnLength)
+          PROCESS_DEVICEMAP_INFORMATION DeviceMap;
+          
+          ObQueryDeviceMapInformation(Process, &DeviceMap);
+          
+          _SEH_TRY
           {
-	    *ReturnLength = sizeof(PROCESS_DEVICEMAP_INFORMATION);
-	  }
+            *(PPROCESS_DEVICEMAP_INFORMATION)ProcessInformation =
DeviceMap;
+	    if (ReturnLength)
+            {
+	      *ReturnLength = sizeof(PROCESS_DEVICEMAP_INFORMATION);
+	    }
+          }
+          _SEH_HANDLE
+          {
+            Status = _SEH_GetExceptionCode();
+          }
+          _SEH_END;
 	}
 	break;
 
@@ -1361,12 +1412,21 @@
 	else
 	{
 	  PUSHORT Priority = (PUSHORT)ProcessInformation;
-	  *Priority = Process->PriorityClass;
+	  
+	  _SEH_TRY
+	  {
+	    *Priority = Process->PriorityClass;
 
-	  if (ReturnLength)
-	  {
-	    *ReturnLength = sizeof(USHORT);
-	  }
+	    if (ReturnLength)
+	    {
+	      *ReturnLength = sizeof(USHORT);
+	    }
+          }
+          _SEH_HANDLE
+          {
+            Status = _SEH_GetExceptionCode();
+          }
+          _SEH_END;
 	}
 	break;
 
@@ -1377,23 +1437,51 @@
          * Propably if we can't find a PEB or ProcessParameters
structure for the
          * process!
          */
-        PRTL_USER_PROCESS_PARAMETERS ProcParams;
-        ASSERT(Process->Peb);
-        ASSERT(Process->Peb->ProcessParameters);
-        ProcParams = Process->Peb->ProcessParameters;
-        if(ProcessInformationLength < sizeof(UNICODE_STRING) +
ProcParams->ImagePathName.Length + sizeof(WCHAR))
+        if(Process->Peb != NULL)
         {
-          Status = STATUS_INFO_LENGTH_MISMATCH;
+          PRTL_USER_PROCESS_PARAMETERS ProcParams;
+
+          /* we need to attach to the process to make sure we're in the
right context! */
+          KeAttachProcess(&Process->Pcb);
+          
+          ASSERT(Process->Peb->ProcessParameters); /* FIXME - must
ProcessParameters be really != NULL? */
+          
+          ProcParams = Process->Peb->ProcessParameters;
+          if(ProcessInformationLength < sizeof(UNICODE_STRING) +
ProcParams->ImagePathName.Length + sizeof(WCHAR))
+          {
+            Status = STATUS_INFO_LENGTH_MISMATCH;
+          }
+          else
+          {
+            PUNICODE_STRING DstPath =
(PUNICODE_STRING)ProcessInformation;
+
+            _SEH_TRY
+            {
+              DstPath->Length = ProcParams->ImagePathName.Length;
+              DstPath->MaximumLength = DstPath->Length + sizeof(WCHAR);
+              DstPath->Buffer = (PWSTR)(DstPath + 1);
+
+              RtlCopyMemory(DstPath->Buffer,
ProcParams->ImagePathName.Buffer, ProcParams->ImagePathName.Length);
+              DstPath->Buffer[DstPath->Length / sizeof(WCHAR)] = L'\0';
+              
+              if (ReturnLength)
+              {
+                *ReturnLength = sizeof(UNICODE_STRING) +
ProcParams->ImagePathName.Length + sizeof(WCHAR);
+              }
+            }
+            _SEH_HANDLE
+            {
+              Status = _SEH_GetExceptionCode();
+            }
+            _SEH_END;
+          }
+          
+          KeDetachProcess();
         }
         else
         {
-          PUNICODE_STRING DstPath =
(PUNICODE_STRING)ProcessInformation;
-          DstPath->Length = ProcParams->ImagePathName.Length;
-          DstPath->MaximumLength = DstPath->Length + sizeof(WCHAR);
-          DstPath->Buffer = (PWSTR)(DstPath + 1);
-          
-          RtlCopyMemory(DstPath->Buffer,
ProcParams->ImagePathName.Buffer, ProcParams->ImagePathName.Length);
-          DstPath->Buffer[DstPath->Length / sizeof(WCHAR)] = L'\0';
+          /* FIXME - what to do here? */
+          Status = STATUS_UNSUCCESSFUL;
         }
         break;
       }
@@ -1415,8 +1503,9 @@
       default:
 	Status = STATUS_INVALID_INFO_CLASS;
      }
+
    ObDereferenceObject(Process);
-   return(Status);
+   return Status;
 }