Author: jmorlan Date: Thu Jul 10 10:43:06 2008 New Revision: 34413
URL: http://svn.reactos.org/svn/reactos?rev=34413&view=rev Log: Some fixes for console alias functions: - Pass buffers via a CSR capture buffer, instead of trying to cram them in the size-limited LPC message. - GetConsoleAliasW: Return number of bytes written, not unrelated "Size" variable. - GetConsoleAliasExesW: Return value is in bytes, not characters. - GetConsoleAliasA, GetConsoleAliasExesA: Parameters and returns of corresponding W functions are in bytes, not characters. - IntFindAliasHeader, IntGetAliasEntry: Break when current name is greater, not less. - IntCreateAliasHeader: Fix bad use of pointer arithmetic; initialize Data to NULL. - IntCreateAliasEntry: Fix bad use of pointer arithmetic. - IntGetConsoleAliasesExesLength: Fix infinite loop; add sizeof(WCHAR) instead of 1. - IntGetAllConsoleAliasesLength: Fix infinite loop. - CsrGetConsoleAlias, CsrGetAllConsoleAliases, CsrGetConsoleAliasesExes: Don't use a winerror where an NTSTATUS is needed.
Modified: trunk/reactos/dll/win32/kernel32/misc/console.c trunk/reactos/subsystems/win32/csrss/api/alias.c
Modified: trunk/reactos/dll/win32/kernel32/misc/console.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/kernel32/misc/con... ============================================================================== --- trunk/reactos/dll/win32/kernel32/misc/console.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/kernel32/misc/console.c [iso-8859-1] Thu Jul 10 10:43:06 2008 @@ -327,13 +327,13 @@ LPWSTR lpExeName) { PCSR_API_MESSAGE Request; + PCSR_CAPTURE_BUFFER CaptureBuffer; ULONG CsrRequest; NTSTATUS Status; ULONG Size; ULONG ExeLength; ULONG SourceLength; ULONG RequestLength; - //PVOID CaptureBuffer; WCHAR * Ptr;
DPRINT("GetConsoleAliasW entered lpSource %S lpExeName %S\n", lpSource, lpExeName); @@ -343,12 +343,11 @@ ExeLength = wcslen(lpExeName) + 1; SourceLength = wcslen(lpSource) + 1;
- Size = (ExeLength + SourceLength + CSRSS_MAX_ALIAS_TARGET_LENGTH) * sizeof(WCHAR); + Size = (ExeLength + SourceLength) * sizeof(WCHAR);
RequestLength = Size + sizeof(CSR_API_MESSAGE); Request = RtlAllocateHeap(GetProcessHeap(), 0, RequestLength);
-#if 0 CaptureBuffer = CsrAllocateCaptureBuffer(1, TargetBufferLength); if (!CaptureBuffer) { @@ -363,36 +362,32 @@ (PVOID*)&Request->Data.GetConsoleAlias.TargetBuffer); Request->Data.GetConsoleAlias.TargetBufferLength = TargetBufferLength;
-#endif - Ptr = (LPWSTR)((ULONG_PTR)Request + sizeof(CSR_API_MESSAGE)); wcscpy(Ptr, lpSource); Ptr += SourceLength; wcscpy(Ptr, lpExeName); - Ptr += ExeLength;
Request->Data.GetConsoleAlias.ExeLength = ExeLength; - Request->Data.GetConsoleAlias.TargetBufferLength = CSRSS_MAX_ALIAS_TARGET_LENGTH * sizeof(WCHAR); Request->Data.GetConsoleAlias.SourceLength = SourceLength;
Status = CsrClientCallServer(Request, - NULL, //CaptureBuffer, + CaptureBuffer, CsrRequest, sizeof(CSR_API_MESSAGE) + Size);
if (!NT_SUCCESS(Status) || !NT_SUCCESS(Status = Request->Status)) { RtlFreeHeap(GetProcessHeap(), 0, Request); - //CsrFreeCaptureBuffer(CaptureBuffer); + CsrFreeCaptureBuffer(CaptureBuffer); SetLastErrorByStatus(Status); return 0; }
- wcscpy(lpTargetBuffer, Ptr); + wcscpy(lpTargetBuffer, Request->Data.GetConsoleAlias.TargetBuffer); RtlFreeHeap(GetProcessHeap(), 0, Request); - //CsrFreeCaptureBuffer(CaptureBuffer); - - return Size; + CsrFreeCaptureBuffer(CaptureBuffer); + + return Request->Data.GetConsoleAlias.BytesWritten; }
@@ -424,13 +419,13 @@
lpwTargetBuffer = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, TargetBufferLength * sizeof(WCHAR));
- dwResult = GetConsoleAliasW(lpwSource, lpwTargetBuffer, TargetBufferLength, lpwExeName); + dwResult = GetConsoleAliasW(lpwSource, lpwTargetBuffer, TargetBufferLength * sizeof(WCHAR), lpwExeName);
HeapFree(GetProcessHeap(), 0, lpwSource); HeapFree(GetProcessHeap(), 0, lpwExeName);
if (dwResult) - dwResult = WideCharToMultiByte(CP_ACP, 0, lpwTargetBuffer, dwResult, lpTargetBuffer, TargetBufferLength, NULL, NULL); + dwResult = WideCharToMultiByte(CP_ACP, 0, lpwTargetBuffer, dwResult / sizeof(WCHAR), lpTargetBuffer, TargetBufferLength, NULL, NULL);
HeapFree(GetProcessHeap(), 0, lpwTargetBuffer);
@@ -446,27 +441,42 @@ DWORD ExeNameBufferLength) { CSR_API_MESSAGE Request; + PCSR_CAPTURE_BUFFER CaptureBuffer; ULONG CsrRequest; NTSTATUS Status;
DPRINT("GetConsoleAliasExesW entered\n");
+ CaptureBuffer = CsrAllocateCaptureBuffer(1, ExeNameBufferLength); + if (!CaptureBuffer) + { + SetLastError(ERROR_NOT_ENOUGH_MEMORY); + return 0; + } + CsrRequest = MAKE_CSR_API(GET_CONSOLE_ALIASES_EXES, CSR_NATIVE); - Request.Data.GetConsoleAliasesExes.ExeNames = lpExeNameBuffer; + CsrAllocateMessagePointer(CaptureBuffer, + ExeNameBufferLength, + (PVOID*)&Request.Data.GetConsoleAliasesExes.ExeNames); Request.Data.GetConsoleAliasesExes.Length = ExeNameBufferLength;
Status = CsrClientCallServer(& Request, - NULL, + CaptureBuffer, CsrRequest, sizeof(CSR_API_MESSAGE));
if (!NT_SUCCESS(Status) || !NT_SUCCESS(Status = Request.Status)) { SetLastErrorByStatus(Status); + CsrFreeCaptureBuffer(CaptureBuffer); return 0; }
- return Request.Data.GetConsoleAliasesExes.BytesWritten / sizeof(WCHAR); + memcpy(lpExeNameBuffer, + Request.Data.GetConsoleAliasesExes.ExeNames, + Request.Data.GetConsoleAliasesExes.BytesWritten); + CsrFreeCaptureBuffer(CaptureBuffer); + return Request.Data.GetConsoleAliasesExes.BytesWritten; }
@@ -484,10 +494,10 @@
lpwExeNameBuffer = HeapAlloc(GetProcessHeap(), 0, ExeNameBufferLength * sizeof(WCHAR));
- dwResult = GetConsoleAliasExesW(lpwExeNameBuffer, ExeNameBufferLength); + dwResult = GetConsoleAliasExesW(lpwExeNameBuffer, ExeNameBufferLength * sizeof(WCHAR));
if (dwResult) - dwResult = WideCharToMultiByte(CP_ACP, 0, lpwExeNameBuffer, dwResult, lpExeNameBuffer, ExeNameBufferLength, NULL, NULL); + dwResult = WideCharToMultiByte(CP_ACP, 0, lpwExeNameBuffer, dwResult / sizeof(WCHAR), lpExeNameBuffer, ExeNameBufferLength, NULL, NULL);
HeapFree(GetProcessHeap(), 0, lpwExeNameBuffer); return dwResult;
Modified: trunk/reactos/subsystems/win32/csrss/api/alias.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/api/... ============================================================================== --- trunk/reactos/subsystems/win32/csrss/api/alias.c [iso-8859-1] (original) +++ trunk/reactos/subsystems/win32/csrss/api/alias.c [iso-8859-1] Thu Jul 10 10:43:06 2008 @@ -34,6 +34,21 @@
static PALIAS_HEADER RootHeader = NULL;
+/* Ensure that a buffer is contained within the process's shared memory section. */ +static BOOL +ValidateBuffer(PCSRSS_PROCESS_DATA ProcessData, PVOID Buffer, ULONG Size) +{ + ULONG Offset = (BYTE *)Buffer - (BYTE *)ProcessData->CsrSectionViewBase; + if (Offset >= ProcessData->CsrSectionViewSize + || Size > (ProcessData->CsrSectionViewSize - Offset)) + { + DPRINT1("Invalid buffer %p %d; not within %p %d\n", + Buffer, Size, ProcessData->CsrSectionViewBase, ProcessData->CsrSectionViewSize); + return FALSE; + } + return TRUE; +} + static PALIAS_HEADER IntFindAliasHeader(PALIAS_HEADER RootHeader, LPCWSTR lpExeName) @@ -44,7 +59,7 @@ if (!diff) return RootHeader;
- if (diff < 0) + if (diff > 0) break;
RootHeader = RootHeader->Next; @@ -62,8 +77,9 @@ if (!Entry) return Entry;
- Entry->lpExeName = (LPCWSTR)(Entry + sizeof(ALIAS_HEADER)); + Entry->lpExeName = (LPCWSTR)(Entry + 1); wcscpy((WCHAR*)Entry->lpExeName, lpExeName); + Entry->Data = NULL; Entry->Next = NULL; return Entry; } @@ -117,7 +133,7 @@ if (!diff) return RootHeader;
- if (diff < 0) + if (diff > 0) break;
RootHeader = RootHeader->Next; @@ -175,7 +191,7 @@ if (!Entry) return Entry;
- Entry->lpSource = (LPCWSTR)(Entry + sizeof(ALIAS_ENTRY)); + Entry->lpSource = (LPCWSTR)(Entry + 1); wcscpy((LPWSTR)Entry->lpSource, lpSource); Entry->lpTarget = Entry->lpSource + dwSource; wcscpy((LPWSTR)Entry->lpTarget, lpTarget); @@ -192,9 +208,10 @@ while(RootHeader) { length += (wcslen(RootHeader->lpExeName) + 1) * sizeof(WCHAR); + RootHeader = RootHeader->Next; } if (length) - length++; // last entry entry is terminated with 2 zero bytes + length += sizeof(WCHAR); // last entry entry is terminated with 2 zero bytes
return length; } @@ -236,6 +253,7 @@ Length += wcslen(CurEntry->lpSource); Length += wcslen(CurEntry->lpTarget); Length += 2; // zero byte and '=' + CurEntry = CurEntry->Next; }
if (Length) @@ -374,7 +392,7 @@
lpSource = (LPWSTR)((ULONG_PTR)Request + sizeof(CSR_API_MESSAGE)); lpExeName = lpSource + Request->Data.GetConsoleAlias.SourceLength; - lpTarget = (LPWSTR)lpExeName + Request->Data.GetConsoleAlias.ExeLength; + lpTarget = Request->Data.GetConsoleAlias.TargetBuffer;
DPRINT("CsrGetConsoleAlias entered lpExeName %p lpSource %p TargetBuffer %p TargetBufferLength %u\n", @@ -404,23 +422,17 @@ Length = (wcslen(Entry->lpTarget)+1) * sizeof(WCHAR); if (Length > Request->Data.GetConsoleAlias.TargetBufferLength) { - Request->Status = ERROR_INSUFFICIENT_BUFFER; + Request->Status = STATUS_BUFFER_TOO_SMALL; return Request->Status; }
-#if 0 - if (((PVOID)lpTarget < ProcessData->CsrSectionViewBase) - || (((ULONG_PTR)lpTarget + Request->Data.GetConsoleAlias.TargetBufferLength) > ((ULONG_PTR)ProcessData->CsrSectionViewBase + ProcessData->CsrSectionViewSize))) + if (!ValidateBuffer(ProcessData, lpTarget, Request->Data.GetConsoleAlias.TargetBufferLength)) { Request->Status = STATUS_ACCESS_VIOLATION; - DPRINT1("CsrGetConsoleAlias out of range lpTarget %p LowerViewBase %p UpperViewBase %p Size %p\n", lpTarget, - ProcessData->CsrSectionViewBase, (ULONG_PTR)ProcessData->CsrSectionViewBase + ProcessData->CsrSectionViewSize, ProcessData->CsrSectionViewSize); - return Request->Status; - } -#endif + return Request->Status; + }
wcscpy(lpTarget, Entry->lpTarget); - lpTarget[CSRSS_MAX_ALIAS_TARGET_LENGTH-1] = '\0'; Request->Data.GetConsoleAlias.BytesWritten = Length; Request->Status = STATUS_SUCCESS; return Request->Status; @@ -446,7 +458,15 @@
if (IntGetAllConsoleAliasesLength(Header) > Request->Data.GetAllConsoleAlias.AliasBufferLength) { - Request->Status = ERROR_INSUFFICIENT_BUFFER; + Request->Status = STATUS_BUFFER_OVERFLOW; + return Request->Status; + } + + if (!ValidateBuffer(ProcessData, + Request->Data.GetAllConsoleAlias.AliasBuffer, + Request->Data.GetAllConsoleAlias.AliasBufferLength)) + { + Request->Status = STATUS_ACCESS_VIOLATION; return Request->Status; }
@@ -495,7 +515,7 @@
if (ExesLength > Request->Data.GetConsoleAliasesExes.Length) { - Request->Status = ERROR_INSUFFICIENT_BUFFER; + Request->Status = STATUS_BUFFER_OVERFLOW; return Request->Status; }
@@ -505,6 +525,14 @@ return Request->Status; }
+ if (!ValidateBuffer(ProcessData, + Request->Data.GetConsoleAliasesExes.ExeNames, + Request->Data.GetConsoleAliasesExes.Length)) + { + Request->Status = STATUS_ACCESS_VIOLATION; + return Request->Status; + } + BytesWritten = IntGetConsoleAliasesExes(RootHeader, Request->Data.GetConsoleAliasesExes.ExeNames, Request->Data.GetConsoleAliasesExes.Length);