[ros-diffs] [jmorlan] 34694: - Implement handle access checking on all console functions. - OpenConsoleW: Fourth parameter is actually share mode (passing a number from 0 to 2 will usually give ERROR_SHARING_VIOLATION on Windows) - CreateFileW: Move CONIN$/CONOUT$ handling after dwCreationDisposition checks (it must be valid, even though it doesn't matter which it is); pass FILE_SHARE_READ|FILE_SHARE_WRITE to OpenConsoleW (dwShareMode is ignored). - CloseConsoleHandle, CsrReleaseObject, CsrVerifyObject: Rem

Author: jmorlan
Date: Wed Jul 23 11:21:46 2008
New Revision: 34694

URL: http://svn.reactos.org/svn/reactos?rev=34694&view=rev
Log:
- Implement handle access checking on all console functions.
- OpenConsoleW: Fourth parameter is actually share mode (passing a number from 0 to 2 will
usually give ERROR_SHARING_VIOLATION on Windows)
- CreateFileW: Move CONIN$/CONOUT$ handling after dwCreationDisposition checks (it must be
valid, even though it doesn't matter which it is); pass
FILE_SHARE_READ|FILE_SHARE_WRITE to OpenConsoleW (dwShareMode is ignored).
- CloseConsoleHandle, CsrReleaseObject, CsrVerifyObject: Remove IsConsoleHandle checks -
Windows ignores lower 2 bits of handle for closing and verifying.
- SetConsoleMode: Remove IsConsoleHandle check - it's redundant, since the same check
is done in CsrGetObject.
- CsrIsConsoleHandle, CsrReleaseObjectByPointer: Clean up a bit.
- CsrFreeConsole: Remove the process from the console's list.

Modified:
    trunk/reactos/dll/win32/kernel32/file/create.c
    trunk/reactos/dll/win32/kernel32/misc/console.c
    trunk/reactos/subsystems/win32/csrss/api/handle.c
    trunk/reactos/subsystems/win32/csrss/include/conio.h
    trunk/reactos/subsystems/win32/csrss/include/win32csr.h
    trunk/reactos/subsystems/win32/csrss/win32csr/conio.c
    trunk/reactos/subsystems/win32/csrss/win32csr/dllmain.c

Modified: trunk/reactos/dll/win32/kernel32/file/create.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/kernel32/file/cr…
==============================================================================
--- trunk/reactos/dll/win32/kernel32/file/create.c [iso-8859-1] (original)
+++ trunk/reactos/dll/win32/kernel32/file/create.c [iso-8859-1] Wed Jul 23 11:21:46 2008
@@ -104,16 +104,6 @@
 
    TRACE("CreateFileW(lpFileName %S)\n",lpFileName);
 
-   /* check for console input/output */
-   if (0 == _wcsicmp(L"CONOUT$", lpFileName)
-       || 0 == _wcsicmp(L"CONIN$", lpFileName))
-   {
-      return OpenConsoleW(lpFileName,
-                          dwDesiredAccess, 
-                          lpSecurityAttributes ? lpSecurityAttributes->bInheritHandle
: FALSE,
-                          dwCreationDisposition);
-   }
-
    /* validate & translate the creation disposition */
    switch (dwCreationDisposition)
      {
@@ -141,6 +131,16 @@
         SetLastError(ERROR_INVALID_PARAMETER);
         return (INVALID_HANDLE_VALUE);
      }
+
+   /* check for console input/output */
+   if (0 == _wcsicmp(L"CONOUT$", lpFileName)
+       || 0 == _wcsicmp(L"CONIN$", lpFileName))
+   {
+      return OpenConsoleW(lpFileName,
+                          dwDesiredAccess, 
+                          lpSecurityAttributes ? lpSecurityAttributes->bInheritHandle
: FALSE,
+                          FILE_SHARE_READ | FILE_SHARE_WRITE);
+   }
 
   /* validate & translate the flags */
 

Modified: trunk/reactos/dll/win32/kernel32/misc/console.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/kernel32/misc/co…
==============================================================================
--- trunk/reactos/dll/win32/kernel32/misc/console.c [iso-8859-1] (original)
+++ trunk/reactos/dll/win32/kernel32/misc/console.c [iso-8859-1] Wed Jul 23 11:21:46 2008
@@ -906,7 +906,7 @@
 OpenConsoleW (LPCWSTR  wsName,
 	      DWORD   dwDesiredAccess,
 	      BOOL    bInheritHandle,
-	      DWORD   dwCreationDistribution)
+	      DWORD   dwShareMode)
      /*
       * Undocumented
       */
@@ -933,7 +933,7 @@
     SetLastError(ERROR_INVALID_PARAMETER);
     return(INVALID_HANDLE_VALUE);
   }
-  if (OPEN_EXISTING != dwCreationDistribution)
+  if (dwShareMode & ~(FILE_SHARE_READ|FILE_SHARE_WRITE))
   {
     SetLastError(ERROR_INVALID_PARAMETER);
     return(INVALID_HANDLE_VALUE);
@@ -1260,12 +1260,6 @@
   CSR_API_MESSAGE Request; ULONG CsrRequest;
   
   NTSTATUS Status;
-
-  if (IsConsoleHandle (Handle) == FALSE)
-    {
-      SetLastError (ERROR_INVALID_PARAMETER);
-      return FALSE;
-    }
 
   CsrRequest = MAKE_CSR_API(CLOSE_HANDLE, CSR_NATIVE);
   Request.Data.CloseHandleRequest.Handle = Handle;
@@ -2907,14 +2901,6 @@
   
   NTSTATUS Status;
 
-  if (!IsConsoleHandle (hConsoleHandle))
-  {
-    DPRINT("SetConsoleMode was called with a non console handle\n");
-    SetLastError (ERROR_INVALID_PARAMETER);
-    return FALSE;
-  }
-
-
   CsrRequest = MAKE_CSR_API(SET_CONSOLE_MODE, CSR_CONSOLE);
   Request.Data.SetConsoleModeRequest.ConsoleHandle = hConsoleHandle;
   Request.Data.SetConsoleModeRequest.Mode = dwMode;

Modified: trunk/reactos/subsystems/win32/csrss/api/handle.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/api…
==============================================================================
--- trunk/reactos/subsystems/win32/csrss/api/handle.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrss/api/handle.c [iso-8859-1] Wed Jul 23 11:21:46
2008
@@ -19,10 +19,10 @@
 static unsigned ObjectDefinitionsCount = 0;
 static PCSRSS_OBJECT_DEFINITION ObjectDefinitions = NULL;
 
-BOOL
+static BOOL
 CsrIsConsoleHandle(HANDLE Handle)
 {
-  return ((((ULONG)Handle) & 0x10000003) == 0x3) ? TRUE : FALSE;
+  return ((ULONG)Handle & 0x10000003) == 0x3;
 }
 
 
@@ -89,26 +89,21 @@
 NTSTATUS STDCALL
 CsrReleaseObjectByPointer(Object_t *Object)
 {
-  BOOL Found;
   unsigned DefIndex;
 
   /* dec ref count */
   if (_InterlockedDecrement(&Object->ReferenceCount) == 0)
     {
-      Found = FALSE;
-      for (DefIndex = 0; ! Found && DefIndex < ObjectDefinitionsCount;
DefIndex++)
+      for (DefIndex = 0; DefIndex < ObjectDefinitionsCount; DefIndex++)
         {
           if (Object->Type == ObjectDefinitions[DefIndex].Type)
             {
               (ObjectDefinitions[DefIndex].CsrCleanupObjectProc)(Object);
-              Found = TRUE;
+              return STATUS_SUCCESS;
             }
         }
 
-      if (! Found)
-        {
-	  DPRINT1("CSR: Error: releaseing unknown object type 0x%x",
Object->Type);
-        }
+      DPRINT1("CSR: Error: releasing unknown object type 0x%x",
Object->Type);
     }
 
   return STATUS_SUCCESS;
@@ -127,7 +122,7 @@
       return STATUS_INVALID_PARAMETER;
     }
   RtlEnterCriticalSection(&ProcessData->HandleTableLock);
-  if (!CsrIsConsoleHandle(Handle) || h >= ProcessData->HandleTableSize
+  if (h >= ProcessData->HandleTableSize
       || (Object = ProcessData->HandleTable[h].Object) == NULL)
     {
       RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
@@ -234,7 +229,7 @@
     {
       return STATUS_INVALID_PARAMETER;
     }
-  if (!CsrIsConsoleHandle(Handle) || h >= ProcessData->HandleTableSize
+  if (h >= ProcessData->HandleTableSize
       || ProcessData->HandleTable[h].Object == NULL)
     {
       return STATUS_INVALID_HANDLE;

Modified: trunk/reactos/subsystems/win32/csrss/include/conio.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/inc…
==============================================================================
--- trunk/reactos/subsystems/win32/csrss/include/conio.h [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrss/include/conio.h [iso-8859-1] Wed Jul 23 11:21:46
2008
@@ -152,12 +152,12 @@
 #define ConioRectWidth(Rect) \
     (((Rect)->left) > ((Rect)->right) ? 0 : ((Rect)->right) -
((Rect)->left) + 1)
 
-#define ConioLockConsole(ProcessData, Handle, Ptr) \
-    Win32CsrLockObject((ProcessData), (Handle), (Object_t **)(Ptr), CONIO_CONSOLE_MAGIC)
+#define ConioLockConsole(ProcessData, Handle, Ptr, Access) \
+    Win32CsrLockObject((ProcessData), (Handle), (Object_t **)(Ptr), Access,
CONIO_CONSOLE_MAGIC)
 #define ConioUnlockConsole(Console) \
     Win32CsrUnlockObject((Object_t *) Console)
-#define ConioLockScreenBuffer(ProcessData, Handle, Ptr) \
-    Win32CsrLockObject((ProcessData), (Handle), (Object_t **)(Ptr),
CONIO_SCREEN_BUFFER_MAGIC)
+#define ConioLockScreenBuffer(ProcessData, Handle, Ptr, Access) \
+    Win32CsrLockObject((ProcessData), (Handle), (Object_t **)(Ptr), Access,
CONIO_SCREEN_BUFFER_MAGIC)
 #define ConioUnlockScreenBuffer(Buff) \
     Win32CsrUnlockObject((Object_t *) Buff)
 #define ConioChangeIcon(Console, hWindowIcon) (Console)->Vtbl->ChangeIcon(Console,
hWindowIcon)

Modified: trunk/reactos/subsystems/win32/csrss/include/win32csr.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/inc…
==============================================================================
--- trunk/reactos/subsystems/win32/csrss/include/win32csr.h [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrss/include/win32csr.h [iso-8859-1] Wed Jul 23
11:21:46 2008
@@ -24,12 +24,14 @@
 NTSTATUS FASTCALL Win32CsrLockObject(PCSRSS_PROCESS_DATA ProcessData,
                                      HANDLE Handle,
                                      Object_t **Object,
+                                     DWORD Access,
                                      long Type);
 VOID FASTCALL Win32CsrUnlockObject(Object_t *Object);
 
 NTSTATUS FASTCALL Win32CsrGetObject(PCSRSS_PROCESS_DATA ProcessData,
                                     HANDLE Handle,
-                                    Object_t **Object);
+                                    Object_t **Object,
+                                    DWORD Access);
 NTSTATUS FASTCALL Win32CsrReleaseObjectByPointer(Object_t *Object);
 NTSTATUS FASTCALL Win32CsrReleaseObject(PCSRSS_PROCESS_DATA ProcessData,
                                         HANDLE Object);

Modified: trunk/reactos/subsystems/win32/csrss/win32csr/conio.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/win…
==============================================================================
--- trunk/reactos/subsystems/win32/csrss/win32csr/conio.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrss/win32csr/conio.c [iso-8859-1] Wed Jul 23 11:21:46
2008
@@ -397,6 +397,7 @@
 
   Console = ProcessData->Console;
   ProcessData->Console = NULL;
+  RemoveEntryList(&ProcessData->ProcessEntry);
   if (0 == InterlockedDecrement(&Console->Header.ReferenceCount))
     {
       ConioDeleteConsole((Object_t *) Console);
@@ -578,7 +579,7 @@
   Buffer = Request->Data.ReadConsoleRequest.Buffer;
   UnicodeBuffer = (PWCHAR)Buffer;
   Status = ConioLockConsole(ProcessData,
Request->Data.ReadConsoleRequest.ConsoleHandle,
-                               &Console);
+                               &Console, GENERIC_READ);
   if (! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -889,7 +890,7 @@
 
   if (Buffer)
     {
-      Status = ConioLockScreenBuffer(ProcessData,
Request->Data.WriteConsoleRequest.ConsoleHandle, &Buff);
+      Status = ConioLockScreenBuffer(ProcessData,
Request->Data.WriteConsoleRequest.ConsoleHandle, &Buff, GENERIC_WRITE);
       if (NT_SUCCESS(Status))
         {
           Request->Status = ConioWriteConsole(Console, Buff, Buffer,
@@ -1317,7 +1318,7 @@
   Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
 
-  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.ScreenBufferInfoRequest.ConsoleHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.ScreenBufferInfoRequest.ConsoleHandle, &Buff, GENERIC_READ);
   if (! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -1360,7 +1361,7 @@
   Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
 
-  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.SetCursorRequest.ConsoleHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.SetCursorRequest.ConsoleHandle, &Buff, GENERIC_WRITE);
   if (! NT_SUCCESS(Status))
     {
       ConioUnlockConsole(Console);
@@ -1480,7 +1481,8 @@
         {
           Status = ConioLockScreenBuffer(ProcessData,
                                         
Request->Data.WriteConsoleOutputCharRequest.ConsoleHandle,
-                                         &Buff);
+                                         &Buff,
+                                         GENERIC_WRITE);
           if (NT_SUCCESS(Status))
             {
               X = Request->Data.WriteConsoleOutputCharRequest.Coord.X;
@@ -1546,7 +1548,7 @@
       return Request->Status = Status;
     }
 
-  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.FillOutputRequest.ConsoleHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.FillOutputRequest.ConsoleHandle, &Buff, GENERIC_WRITE);
   if (! NT_SUCCESS(Status))
     {
       ConioUnlockConsole(Console);
@@ -1605,7 +1607,7 @@
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
   Request->Data.ReadInputRequest.Event = ProcessData->ConsoleEvent;
 
-  Status = ConioLockConsole(ProcessData, Request->Data.ReadInputRequest.ConsoleHandle,
&Console);
+  Status = ConioLockConsole(ProcessData, Request->Data.ReadInputRequest.ConsoleHandle,
&Console, GENERIC_READ);
   if (! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -1702,7 +1704,8 @@
 
   Status = ConioLockScreenBuffer(ProcessData,
                                 
Request->Data.WriteConsoleOutputAttribRequest.ConsoleHandle,
-                                 &Buff);
+                                 &Buff,
+                                 GENERIC_WRITE);
   if (! NT_SUCCESS(Status))
     {
       ConioUnlockConsole(Console);
@@ -1766,7 +1769,7 @@
 
   Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
-  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.FillOutputAttribRequest.ConsoleHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.FillOutputAttribRequest.ConsoleHandle, &Buff, GENERIC_WRITE);
   if (! NT_SUCCESS(Status))
     {
       ConioUnlockConsole(Console);
@@ -1817,7 +1820,7 @@
   Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
 
-  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.GetCursorInfoRequest.ConsoleHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.GetCursorInfoRequest.ConsoleHandle, &Buff, GENERIC_READ);
   if (! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -1848,7 +1851,7 @@
       return Request->Status = Status;
     }
 
-  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.SetCursorInfoRequest.ConsoleHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.SetCursorInfoRequest.ConsoleHandle, &Buff, GENERIC_WRITE);
   if (! NT_SUCCESS(Status))
     {
       ConioUnlockConsole(Console);
@@ -1900,7 +1903,7 @@
       return Request->Status = Status;
     }
 
-  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.SetCursorRequest.ConsoleHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.SetCursorRequest.ConsoleHandle, &Buff, GENERIC_WRITE);
   if (! NT_SUCCESS(Status))
     {
       ConioUnlockConsole(Console);
@@ -1936,7 +1939,7 @@
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
   Status = Win32CsrGetObject(ProcessData,
                              Request->Data.SetConsoleModeRequest.ConsoleHandle,
-                             (Object_t **) &Console);
+                             (Object_t **) &Console, GENERIC_WRITE);
   if (! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -1972,7 +1975,7 @@
   Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
   Status = Win32CsrGetObject(ProcessData,
Request->Data.GetConsoleModeRequest.ConsoleHandle,
-                             (Object_t **) &Console);
+                             (Object_t **) &Console, GENERIC_READ);
   if (! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -2085,7 +2088,7 @@
   Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
 
-  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.SetScreenBufferRequest.OutputHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.SetScreenBufferRequest.OutputHandle, &Buff, GENERIC_WRITE);
   if (! NT_SUCCESS(Status))
     {
       ConioUnlockConsole(Console);
@@ -2234,7 +2237,8 @@
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
   Status = ConioLockScreenBuffer(ProcessData,
                                 
Request->Data.WriteConsoleOutputRequest.ConsoleHandle,
-                                 &Buff);
+                                 &Buff,
+                                 GENERIC_WRITE);
   if (! NT_SUCCESS(Status))
     {
       ConioUnlockConsole(Console);
@@ -2321,7 +2325,8 @@
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
   Status = ConioLockConsole(ProcessData,
                             Request->Data.FlushInputBufferRequest.ConsoleInput,
-                            &Console);
+                            &Console,
+                            GENERIC_WRITE);
   if(! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -2375,7 +2380,7 @@
 
   Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
-  Status = ConioLockScreenBuffer(ProcessData, ConsoleHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData, ConsoleHandle, &Buff, GENERIC_WRITE);
   if (! NT_SUCCESS(Status))
     {
       ConioUnlockConsole(Console);
@@ -2478,7 +2483,7 @@
       return Request->Status = Status;
     }
 
-  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.ReadConsoleOutputCharRequest.ConsoleHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.ReadConsoleOutputCharRequest.ConsoleHandle, &Buff, GENERIC_READ);
   if (! NT_SUCCESS(Status))
     {
       ConioUnlockConsole(Console);
@@ -2548,7 +2553,7 @@
   Request->Header.u1.s1.DataLength = Request->Header.u1.s1.TotalLength -
sizeof(PORT_MESSAGE);
   ReadBuffer = Request->Data.ReadConsoleOutputAttribRequest.Attribute;
 
-  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.ReadConsoleOutputAttribRequest.ConsoleHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.ReadConsoleOutputAttribRequest.ConsoleHandle, &Buff, GENERIC_READ);
   if (! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -2609,7 +2614,7 @@
   Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
   Request->Header.u1.s1.DataLength = Request->Header.u1.s1.TotalLength -
sizeof(PORT_MESSAGE);
 
-  Status = ConioLockConsole(ProcessData,
Request->Data.GetNumInputEventsRequest.ConsoleHandle, &Console);
+  Status = ConioLockConsole(ProcessData,
Request->Data.GetNumInputEventsRequest.ConsoleHandle, &Console, GENERIC_READ);
   if (! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -2654,7 +2659,7 @@
   Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
 
-  Status = ConioLockConsole(ProcessData,
Request->Data.GetNumInputEventsRequest.ConsoleHandle, &Console);
+  Status = ConioLockConsole(ProcessData,
Request->Data.GetNumInputEventsRequest.ConsoleHandle, &Console, GENERIC_READ);
   if(! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -2732,7 +2737,7 @@
   Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
 
-  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.ReadConsoleOutputRequest.ConsoleHandle, &Buff);
+  Status = ConioLockScreenBuffer(ProcessData,
Request->Data.ReadConsoleOutputRequest.ConsoleHandle, &Buff, GENERIC_READ);
   if (! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -2821,7 +2826,7 @@
   Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
   Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
 
-  Status = ConioLockConsole(ProcessData,
Request->Data.WriteConsoleInputRequest.ConsoleHandle, &Console);
+  Status = ConioLockConsole(ProcessData,
Request->Data.WriteConsoleInputRequest.ConsoleHandle, &Console, GENERIC_WRITE);
   if (! NT_SUCCESS(Status))
     {
       return Request->Status = Status;
@@ -2915,7 +2920,8 @@
 
   Status = ConioLockConsole(ProcessData,
                             Request->Data.ConsoleHardwareStateRequest.ConsoleHandle,
-                            &Console);
+                            &Console,
+                            GENERIC_READ);
   if (! NT_SUCCESS(Status))
     {
       DPRINT1("Failed to get console handle in SetConsoleHardwareState\n");

Modified: trunk/reactos/subsystems/win32/csrss/win32csr/dllmain.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/win…
==============================================================================
--- trunk/reactos/subsystems/win32/csrss/win32csr/dllmain.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrss/win32csr/dllmain.c [iso-8859-1] Wed Jul 23
11:21:46 2008
@@ -106,20 +106,22 @@
 NTSTATUS FASTCALL
 Win32CsrGetObject(PCSRSS_PROCESS_DATA ProcessData,
                  HANDLE Handle,
-                 Object_t **Object)
-{
-  return (CsrExports.CsrGetObjectProc)(ProcessData, Handle, Object, 0);
+                 Object_t **Object,
+                 DWORD Access)
+{
+  return (CsrExports.CsrGetObjectProc)(ProcessData, Handle, Object, Access);
 }
 
 NTSTATUS FASTCALL
 Win32CsrLockObject(PCSRSS_PROCESS_DATA ProcessData,
                    HANDLE Handle,
                    Object_t **Object,
+                   DWORD Access,
                    LONG Type)
 {
   NTSTATUS Status;
 
-  Status = (CsrExports.CsrGetObjectProc)(ProcessData, Handle, Object, 0);
+  Status = (CsrExports.CsrGetObjectProc)(ProcessData, Handle, Object, Access);
   if (! NT_SUCCESS(Status))
     {
       return Status;