ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ntdll: Check input buffer before server_read_file call and don't touch event on error. 

Signed-off-by: Jacek Caban <jacek@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Jacek Caban 2017-01-26 00:51:24 +01:00 committed by Alexandre Julliard
parent f608a4130c
commit a240bfcf9b
2 changed files with 34 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
dlls/ntdll/file.c
View File

@ -853,19 +853,15 @@ NTSTATUS WINAPI NtReadFile(HANDLE hFile, HANDLE hEvent,
status = server_get_unix_fd( hFile, FILE_READ_DATA, &unix_handle, status = server_get_unix_fd( hFile, FILE_READ_DATA, &unix_handle,
&needs_close, &type, &options ); &needs_close, &type, &options );
if (status && status != STATUS_BAD_DEVICE_TYPE) return status;
if (!virtual_check_buffer_for_write( buffer, length )) return STATUS_ACCESS_VIOLATION;
if (status == STATUS_BAD_DEVICE_TYPE) if (status == STATUS_BAD_DEVICE_TYPE)
return server_read_file( hFile, hEvent, apc, apc_user, io_status, buffer, length, offset, key ); return server_read_file( hFile, hEvent, apc, apc_user, io_status, buffer, length, offset, key );
if (status) return status;
async_read = !(options & (FILE_SYNCHRONOUS_IO_ALERT | FILE_SYNCHRONOUS_IO_NONALERT)); async_read = !(options & (FILE_SYNCHRONOUS_IO_ALERT | FILE_SYNCHRONOUS_IO_NONALERT));
if (!virtual_check_buffer_for_write( buffer, length ))
{
status = STATUS_ACCESS_VIOLATION;
goto done;
}
if (type == FD_TYPE_FILE) if (type == FD_TYPE_FILE)
{ {
if (async_read && (!offset || offset->QuadPart < 0)) if (async_read && (!offset || offset->QuadPart < 0))

31
dlls/ntdll/tests/file.c
View File

@ -3451,13 +3451,15 @@ static void test_read_write(void)
{ {
static const char contents[14] = "1234567890abcd"; static const char contents[14] = "1234567890abcd";
char buf[256]; char buf[256];
HANDLE hfile; HANDLE hfile, event;
OVERLAPPED ovl; OVERLAPPED ovl;
IO_STATUS_BLOCK iob; IO_STATUS_BLOCK iob;
DWORD ret, bytes, status, off; DWORD ret, bytes, status, off;
LARGE_INTEGER offset; LARGE_INTEGER offset;
LONG i; LONG i;
event = CreateEventA( NULL, TRUE, FALSE, NULL );
U(iob).Status = -1; U(iob).Status = -1;
iob.Information = -1; iob.Information = -1;
offset.QuadPart = 0; offset.QuadPart = 0;
@ -3466,6 +3468,14 @@ static void test_read_write(void)
ok(U(iob).Status == -1, "expected -1, got %#x\n", U(iob).Status); ok(U(iob).Status == -1, "expected -1, got %#x\n", U(iob).Status);
ok(iob.Information == -1, "expected -1, got %lu\n", iob.Information); ok(iob.Information == -1, "expected -1, got %lu\n", iob.Information);
U(iob).Status = -1;
iob.Information = -1;
offset.QuadPart = 0;
status = pNtReadFile(INVALID_HANDLE_VALUE, 0, NULL, NULL, &iob, NULL, sizeof(buf), &offset, NULL);
ok(status == STATUS_OBJECT_TYPE_MISMATCH || status == STATUS_INVALID_HANDLE, "expected STATUS_OBJECT_TYPE_MISMATCH, got %#x\n", status);
ok(U(iob).Status == -1, "expected -1, got %#x\n", U(iob).Status);
ok(iob.Information == -1, "expected -1, got %lu\n", iob.Information);
U(iob).Status = -1; U(iob).Status = -1;
iob.Information = -1; iob.Information = -1;
offset.QuadPart = 0; offset.QuadPart = 0;
@ -3491,6 +3501,24 @@ static void test_read_write(void)
ok(U(iob).Status == -1, "expected -1, got %#x\n", U(iob).Status); ok(U(iob).Status == -1, "expected -1, got %#x\n", U(iob).Status);
ok(iob.Information == -1, "expected -1, got %lu\n", iob.Information); ok(iob.Information == -1, "expected -1, got %lu\n", iob.Information);
U(iob).Status = -1;
iob.Information = -1;
SetEvent(event);
status = pNtReadFile(hfile, event, NULL, NULL, &iob, NULL, sizeof(contents), NULL, NULL);
ok(status == STATUS_ACCESS_VIOLATION, "expected STATUS_ACCESS_VIOLATION, got %#x\n", status);
ok(U(iob).Status == -1, "expected -1, got %#x\n", U(iob).Status);
ok(iob.Information == -1, "expected -1, got %lu\n", iob.Information);
ok(is_signaled(event), "event is not signaled\n");
U(iob).Status = -1;
iob.Information = -1;
SetEvent(event);
status = pNtReadFile(hfile, event, NULL, NULL, &iob, (void*)0xdeadbeef, sizeof(contents), NULL, NULL);
ok(status == STATUS_ACCESS_VIOLATION, "expected STATUS_ACCESS_VIOLATION, got %#x\n", status);
ok(U(iob).Status == -1, "expected -1, got %#x\n", U(iob).Status);
ok(iob.Information == -1, "expected -1, got %lu\n", iob.Information);
ok(is_signaled(event), "event is not signaled\n");
U(iob).Status = -1; U(iob).Status = -1;
iob.Information = -1; iob.Information = -1;
status = pNtWriteFile(hfile, 0, NULL, NULL, &iob, contents, 7, NULL, NULL); status = pNtWriteFile(hfile, 0, NULL, NULL, &iob, contents, 7, NULL, NULL);
@ -4156,6 +4184,7 @@ static void test_read_write(void)
off = SetFilePointer(hfile, 0, NULL, FILE_CURRENT); off = SetFilePointer(hfile, 0, NULL, FILE_CURRENT);
ok(off == 0, "expected 0, got %u\n", off); ok(off == 0, "expected 0, got %u\n", off);
CloseHandle(event);
CloseHandle(hfile); CloseHandle(hfile);
} }