[tfaber] 70151: [NTOS:SE] - Fail in SeAccessCheck if the resulting access would be zero. CORE-10587 #resolve

Author: tfaber
Date: Fri Nov 27 12:06:59 2015
New Revision: 70151

URL: http://svn.reactos.org/svn/reactos?rev=70151&view=rev
Log:
[NTOS:SE]
- Fail in SeAccessCheck if the resulting access would be zero.
CORE-10587 #resolve

Modified:
    trunk/reactos/ntoskrnl/se/accesschk.c

Modified: trunk/reactos/ntoskrnl/se/accesschk.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/se/accesschk.c?re…
==============================================================================
--- trunk/reactos/ntoskrnl/se/accesschk.c	[iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/se/accesschk.c	[iso-8859-1] Fri Nov 27 12:06:59 2015
@@ -425,8 +425,17 @@
     if (DesiredAccess == 0)
     {
         *GrantedAccess = PreviouslyGrantedAccess;
-        *AccessStatus = STATUS_SUCCESS;
-        ret = TRUE;
+        if (PreviouslyGrantedAccess == 0)
+        {
+            DPRINT1("Request for zero access to an object. Denying.\n");
+            *AccessStatus = STATUS_ACCESS_DENIED;
+            ret = FALSE;
+        }
+        else
+        {
+            *AccessStatus = STATUS_SUCCESS;
+            ret = TRUE;
+        }
     }
     else
     {