[jmorlan] 34559: - CsrReleaseObject: Fix locking to prevent possibility of closing the same handle twice. - GuiConsolePaint: Clip the paint area to the screen buffer, to stop heap corruption if the window gets oversized. - ConioDeleteConsole: Do decrement the active screen buffer's refcount, but only after calling ConioCleanupConsole to destroy the window. - Remove Win32CsrInsertObject. This function did two unrelated things (initialize lock and create handle), but in the only place it was used

Author: jmorlan
Date: Wed Jul 16 18:16:40 2008
New Revision: 34559

URL: http://svn.reactos.org/svn/reactos?rev=34559&view=rev
Log:
- CsrReleaseObject: Fix locking to prevent possibility of closing the same handle twice.
- GuiConsolePaint: Clip the paint area to the screen buffer, to stop heap corruption if
the window gets oversized.
- ConioDeleteConsole: Do decrement the active screen buffer's refcount, but only after
calling ConioCleanupConsole to destroy the window.
- Remove Win32CsrInsertObject. This function did two unrelated things (initialize lock and
create handle), but in the only place it was used (CsrCreateScreenBuffer) the lock had
already been initialized in CsrInitConsoleScreenBuffer, so this use was erroneous.
- Rename Win32CsrInsertObject2 (creates handle only) to Win32CsrInsertObject.

Modified:
    trunk/reactos/subsystems/win32/csrss/api/handle.c
    trunk/reactos/subsystems/win32/csrss/win32csr/conio.c
    trunk/reactos/subsystems/win32/csrss/win32csr/dllmain.c
    trunk/reactos/subsystems/win32/csrss/win32csr/guiconsole.c

Modified: trunk/reactos/subsystems/win32/csrss/api/handle.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/api…
==============================================================================
--- trunk/reactos/subsystems/win32/csrss/api/handle.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrss/api/handle.c [iso-8859-1] Wed Jul 16 18:16:40
2008
@@ -115,23 +115,23 @@
                  HANDLE Handle)
 {
   ULONG h = (((ULONG)Handle) >> 2) - 1;
-  NTSTATUS Status;
+  Object_t *Object;
 
   if (ProcessData == NULL)
     {
       return STATUS_INVALID_PARAMETER;
     }
-  if (!CsrIsConsoleHandle(Handle) || h >= ProcessData->HandleTableSize ||
ProcessData->HandleTable[h] == NULL)
-    {
+  RtlEnterCriticalSection(&ProcessData->HandleTableLock);
+  if (!CsrIsConsoleHandle(Handle) || h >= ProcessData->HandleTableSize
+      || (Object = ProcessData->HandleTable[h]) == NULL)
+    {
+      RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
       return STATUS_INVALID_HANDLE;
     }
-
-  Status = CsrReleaseObjectByPointer(ProcessData->HandleTable[h]);
-
-  RtlEnterCriticalSection(&ProcessData->HandleTableLock);
-  ProcessData->HandleTable[h] = 0;
+  ProcessData->HandleTable[h] = NULL;
   RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
-  return Status;
+
+  return CsrReleaseObjectByPointer(Object);
 }
 
 NTSTATUS STDCALL CsrInsertObject( PCSRSS_PROCESS_DATA ProcessData, PHANDLE Handle,
Object_t *Object )

Modified: trunk/reactos/subsystems/win32/csrss/win32csr/conio.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/win…
==============================================================================
--- trunk/reactos/subsystems/win32/csrss/win32csr/conio.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrss/win32csr/conio.c [iso-8859-1] Wed Jul 16 18:16:40
2008
@@ -12,9 +12,6 @@
 
 #define NDEBUG
 #include <debug.h>
-
-extern NTSTATUS FASTCALL
-Win32CsrInsertObject2(PCSRSS_PROCESS_DATA, PHANDLE, Object_t *);
 
 /* GLOBALS *******************************************************************/
 
@@ -315,9 +312,9 @@
     if (NewConsole || !ProcessData->bInheritHandles)
     {
         /* Insert the Objects */
-        Status = Win32CsrInsertObject2(ProcessData,
-                                      
&Request->Data.AllocConsoleRequest.InputHandle,
-                                       &Console->Header);
+        Status = Win32CsrInsertObject(ProcessData,
+                                     
&Request->Data.AllocConsoleRequest.InputHandle,
+                                      &Console->Header);
         if (! NT_SUCCESS(Status))
         {
             DPRINT1("Failed to insert object\n");
@@ -326,9 +323,9 @@
             return Request->Status = Status;
         }
 
-        Status = Win32CsrInsertObject2(ProcessData,
-                                      
&Request->Data.AllocConsoleRequest.OutputHandle,
-                                       &Console->ActiveBuffer->Header);
+        Status = Win32CsrInsertObject(ProcessData,
+                                     
&Request->Data.AllocConsoleRequest.OutputHandle,
+                                      &Console->ActiveBuffer->Header);
         if (!NT_SUCCESS(Status))
         {
             DPRINT1("Failed to insert object\n");
@@ -984,16 +981,14 @@
       HeapFree(Win32CsrApiHeap, 0, Event);
     }
 
-#if 0 // FIXME
+  ConioCleanupConsole(Console);
   if (0 ==
InterlockedDecrement(&Console->ActiveBuffer->Header.ReferenceCount))
     {
       ConioDeleteScreenBuffer((Object_t *) Console->ActiveBuffer);
     }
-#endif
 
   Console->ActiveBuffer = NULL;
   Console->hActiveBuffer = INVALID_HANDLE_VALUE;
-  ConioCleanupConsole(Console);
 
   CloseHandle(Console->ActiveEvent);
   DeleteCriticalSection(&Console->Header.Lock);

Modified: trunk/reactos/subsystems/win32/csrss/win32csr/dllmain.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/win…
==============================================================================
--- trunk/reactos/subsystems/win32/csrss/win32csr/dllmain.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrss/win32csr/dllmain.c [iso-8859-1] Wed Jul 16
18:16:40 2008
@@ -95,16 +95,6 @@
 
 NTSTATUS FASTCALL
 Win32CsrInsertObject(PCSRSS_PROCESS_DATA ProcessData,
-                     PHANDLE Handle,
-                     Object_t *Object)
-{
-  InitializeCriticalSection(&(Object->Lock));
-
-  return (CsrExports.CsrInsertObjectProc)(ProcessData, Handle, Object);
-}
-
-NTSTATUS FASTCALL
-Win32CsrInsertObject2(PCSRSS_PROCESS_DATA ProcessData,
                       PHANDLE Handle,
                       Object_t *Object)
 {

Modified: trunk/reactos/subsystems/win32/csrss/win32csr/guiconsole.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/csrss/win…
==============================================================================
--- trunk/reactos/subsystems/win32/csrss/win32csr/guiconsole.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/csrss/win32csr/guiconsole.c [iso-8859-1] Wed Jul 16
18:16:40 2008
@@ -886,6 +886,9 @@
     SetBkColor(hDC, GuiConsoleRGBFromAttribute(GuiData, LastAttribute >> 4));
 
     EnterCriticalSection(&Buff->Header.Lock);
+
+    if (BottomLine >= Buff->MaxY) BottomLine = Buff->MaxY - 1;
+    if (RightChar >= Buff->MaxX) RightChar = Buff->MaxX - 1;
 
     OldFont = SelectObject(hDC,
                            GuiData->Font);