Jacek Caban : ntdll: Check output buffer before server_write_file call.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 0d23bfd3982fb0140f7319425e782f67a9e571a2
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=0d23bfd3982fb0140f7319425e...

Author: Jacek Caban <jacek(a)codeweavers.com>
Date:   Thu Jan 26 00:51:35 2017 +0100

ntdll: Check output buffer before server_write_file call.

Signed-off-by: Jacek Caban <jacek(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/ntdll/file.c       |  8 ++++----
 dlls/ntdll/tests/file.c | 17 +++++++++++++++++
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/dlls/ntdll/file.c b/dlls/ntdll/file.c
index 93374c8..907c2aa 100644
--- a/dlls/ntdll/file.c
+++ b/dlls/ntdll/file.c
@@ -1227,16 +1227,13 @@ NTSTATUS WINAPI NtWriteFile(HANDLE hFile, HANDLE hEvent,
 
     status = server_get_unix_fd( hFile, FILE_WRITE_DATA, &unix_handle,
                                  &needs_close, &type, &options );
-    if (status == STATUS_BAD_DEVICE_TYPE)
-        return server_write_file( hFile, hEvent, apc, apc_user, io_status, buffer, length, offset, key );
-
     if (status == STATUS_ACCESS_DENIED)
     {
         status = server_get_unix_fd( hFile, FILE_APPEND_DATA, &unix_handle,
                                      &needs_close, &type, &options );
         append_write = TRUE;
     }
-    if (status) return status;
+    if (status && status != STATUS_BAD_DEVICE_TYPE) return status;
 
     if (!virtual_check_buffer_for_read( buffer, length ))
     {
@@ -1244,6 +1241,9 @@ NTSTATUS WINAPI NtWriteFile(HANDLE hFile, HANDLE hEvent,
         goto done;
     }
 
+    if (status == STATUS_BAD_DEVICE_TYPE)
+        return server_write_file( hFile, hEvent, apc, apc_user, io_status, buffer, length, offset, key );
+
     async_write = !(options & (FILE_SYNCHRONOUS_IO_ALERT | FILE_SYNCHRONOUS_IO_NONALERT));
 
     if (type == FD_TYPE_FILE)
diff --git a/dlls/ntdll/tests/file.c b/dlls/ntdll/tests/file.c
index d56843d..57d7df9 100644
--- a/dlls/ntdll/tests/file.c
+++ b/dlls/ntdll/tests/file.c
@@ -3484,6 +3484,14 @@ static void test_read_write(void)
     ok(U(iob).Status == -1, "expected -1, got %#x\n", U(iob).Status);
     ok(iob.Information == -1, "expected -1, got %lu\n", iob.Information);
 
+    U(iob).Status = -1;
+    iob.Information = -1;
+    offset.QuadPart = 0;
+    status = pNtWriteFile(INVALID_HANDLE_VALUE, 0, NULL, NULL, &iob, buf, sizeof(buf), &offset, NULL);
+    ok(status == STATUS_OBJECT_TYPE_MISMATCH || status == STATUS_INVALID_HANDLE, "expected STATUS_OBJECT_TYPE_MISMATCH, got %#x\n", status);
+    ok(U(iob).Status == -1, "expected -1, got %#x\n", U(iob).Status);
+    ok(iob.Information == -1, "expected -1, got %lu\n", iob.Information);
+
     hfile = create_temp_file(0);
     if (!hfile) return;
 
@@ -3496,6 +3504,15 @@ static void test_read_write(void)
 
     U(iob).Status = -1;
     iob.Information = -1;
+    SetEvent(event);
+    status = pNtWriteFile(hfile, event, NULL, NULL, &iob, NULL, sizeof(contents), NULL, NULL);
+    ok(status == STATUS_INVALID_USER_BUFFER, "expected STATUS_INVALID_USER_BUFFER, got %#x\n", status);
+    ok(U(iob).Status == -1, "expected -1, got %#x\n", U(iob).Status);
+    ok(iob.Information == -1, "expected -1, got %lu\n", iob.Information);
+    ok(!is_signaled(event), "event is not signaled\n");
+
+    U(iob).Status = -1;
+    iob.Information = -1;
     status = pNtReadFile(hfile, 0, NULL, NULL, &iob, NULL, sizeof(contents), NULL, NULL);
     ok(status == STATUS_ACCESS_VIOLATION, "expected STATUS_ACCESS_VIOLATION, got %#x\n", status);
     ok(U(iob).Status == -1, "expected -1, got %#x\n", U(iob).Status);