[hbelusca] 63035: [CONSRV] - Fix dereferencing potential NULL pointers in ConDrvReadConsole() and ConDrvChangeScreenBufferAttributes(); - Fix a wcsncat in ConSrvOpenUserSettings() Patches by Victor...

Author: hbelusca
Date: Mon Apr 28 19:50:27 2014
New Revision: 63035

URL: http://svn.reactos.org/svn/reactos?rev=63035&view=rev
Log:
[CONSRV]
- Fix dereferencing potential NULL pointers in ConDrvReadConsole() and
ConDrvChangeScreenBufferAttributes();
- Fix a wcsncat in ConSrvOpenUserSettings()
Patches by Victor Martinez Calvo
CORE-8122 CORE-8123 #resolve #comment Fixed in revision 63035, cheers ;)

Modified:
    trunk/reactos/win32ss/user/winsrv/consrv/condrv/coninput.c
    trunk/reactos/win32ss/user/winsrv/consrv/condrv/text.c
    trunk/reactos/win32ss/user/winsrv/consrv/settings.c

Modified: trunk/reactos/win32ss/user/winsrv/consrv/condrv/coninput.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/winsrv/consrv…
==============================================================================
--- trunk/reactos/win32ss/user/winsrv/consrv/condrv/coninput.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/winsrv/consrv/condrv/coninput.c	[iso-8859-1] Mon Apr 28
19:50:27 2014
@@ -246,7 +246,7 @@
     NTSTATUS Status = STATUS_PENDING;
     PLIST_ENTRY CurrentEntry;
     ConsoleInput *Input;
-    ULONG i = ReadControl->nInitialChars;
+    ULONG i;
 
     if (Console == NULL || InputBuffer == NULL || /* Buffer == NULL  || */
         ReadControl == NULL || ReadControl->nLength !=
sizeof(CONSOLE_READCONSOLE_CONTROL))
@@ -260,6 +260,8 @@
             (Buffer == NULL && NumCharsToRead == 0) );
 
     /* We haven't read anything (yet) */
+
+    i = ReadControl->nInitialChars;
 
     if (InputBuffer->Mode & ENABLE_LINE_INPUT)
     {

Modified: trunk/reactos/win32ss/user/winsrv/consrv/condrv/text.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/winsrv/consrv…
==============================================================================
--- trunk/reactos/win32ss/user/winsrv/consrv/condrv/text.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/winsrv/consrv/condrv/text.c	[iso-8859-1] Mon Apr 28
19:50:27 2014
@@ -595,8 +595,8 @@
     PCHAR_INFO Ptr;
 
     COORD  TopLeft = {0};
-    ULONG  NumCodesToWrite = Buffer->ScreenBufferSize.X *
Buffer->ScreenBufferSize.Y;
-    USHORT OldScreenAttrib = Buffer->ScreenDefaultAttrib;
+    ULONG  NumCodesToWrite;
+    USHORT OldScreenAttrib;
 
     if (Console == NULL || Buffer == NULL)
     {
@@ -605,10 +605,14 @@
 
     /* Validity check */
     ASSERT(Console == Buffer->Header.Console);
+
+    NumCodesToWrite = Buffer->ScreenBufferSize.X * Buffer->ScreenBufferSize.Y;
+    OldScreenAttrib = Buffer->ScreenDefaultAttrib;
 
     X = TopLeft.X;
     Y = (TopLeft.Y + Buffer->VirtualY) % Buffer->ScreenBufferSize.Y;
     Length = NumCodesToWrite;
+
     // Ptr = ConioCoordToPointer(Buffer, X, Y); // Doesn't work
     // Ptr = &Buffer->Buffer[X + Y * Buffer->ScreenBufferSize.X]; // May work
 

Modified: trunk/reactos/win32ss/user/winsrv/consrv/settings.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/winsrv/consrv…
==============================================================================
--- trunk/reactos/win32ss/user/winsrv/consrv/settings.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/winsrv/consrv/settings.c	[iso-8859-1] Mon Apr 28 19:50:27
2014
@@ -156,7 +156,7 @@
     TranslateConsoleName(szBuffer2, ConsoleTitle, MAX_PATH);
 
     /* Create the registry path */
-    wcsncat(szBuffer, szBuffer2, MAX_PATH);
+    wcsncat(szBuffer, szBuffer2, MAX_PATH - wcslen(szBuffer) - 1);
 
     /* Create or open the registry key */
     if (bCreate)