Andrew Nguyen : kernel32: Improve parameter validation for WriteConsoleInputW.
Module: wine Branch: master Commit: 0272da5afacad1278731482599317c95b33b53a2 URL: http://source.winehq.org/git/wine.git/?a=commit;h=0272da5afacad1278731482599... Author: Andrew Nguyen <anguyen(a)codeweavers.com> Date: Mon Jan 3 21:25:16 2011 -0600 kernel32: Improve parameter validation for WriteConsoleInputW. --- dlls/kernel32/console.c | 18 +++++++- dlls/kernel32/tests/console.c | 91 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 106 insertions(+), 3 deletions(-) diff --git a/dlls/kernel32/console.c b/dlls/kernel32/console.c index a442657..ab0fbe2 100644 --- a/dlls/kernel32/console.c +++ b/dlls/kernel32/console.c @@ -504,20 +504,32 @@ BOOL WINAPI WriteConsoleInputA( HANDLE handle, const INPUT_RECORD *buffer, BOOL WINAPI WriteConsoleInputW( HANDLE handle, const INPUT_RECORD *buffer, DWORD count, LPDWORD written ) { + DWORD events_written = 0; BOOL ret; TRACE("(%p,%p,%d,%p)\n", handle, buffer, count, written); - if (written) *written = 0; + if (count > 0 && !buffer) + { + SetLastError(ERROR_INVALID_ACCESS); + return FALSE; + } + SERVER_START_REQ( write_console_input ) { req->handle = console_handle_unmap(handle); wine_server_add_data( req, buffer, count * sizeof(INPUT_RECORD) ); - if ((ret = !wine_server_call_err( req )) && written) - *written = reply->written; + if ((ret = !wine_server_call_err( req ))) + events_written = reply->written; } SERVER_END_REQ; + if (written) *written = events_written; + else + { + SetLastError(ERROR_INVALID_ACCESS); + ret = FALSE; + } return ret; } diff --git a/dlls/kernel32/tests/console.c b/dlls/kernel32/tests/console.c index a1388ed..c3323e1 100644 --- a/dlls/kernel32/tests/console.c +++ b/dlls/kernel32/tests/console.c @@ -1221,6 +1221,96 @@ static void test_GetNumberOfConsoleInputEvents(HANDLE input_handle) ok(count != 0xdeadbeef, "Expected output count to initialized\n"); } +static void test_WriteConsoleInputW(HANDLE input_handle) +{ + INPUT_RECORD event, temp; + MOUSE_EVENT_RECORD mouse_event = { {0, 0}, 0, 0, MOUSE_MOVED }; + DWORD count; + BOOL ret; + int i; + + const struct + { + HANDLE handle; + const INPUT_RECORD *buffer; + DWORD count; + LPDWORD written; + DWORD expected_count; + DWORD last_error; + int win7_crash; + } invalid_table[] = + { + {NULL, NULL, 0, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1}, + {NULL, NULL, 0, &count, 0, ERROR_INVALID_HANDLE}, + {NULL, NULL, 1, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS}, + {NULL, NULL, 1, &count, 0xdeadbeef, ERROR_INVALID_ACCESS}, + {NULL, &event, 0, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1}, + {NULL, &event, 0, &count, 0, ERROR_INVALID_HANDLE}, + {NULL, &event, 1, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1}, + {NULL, &event, 1, &count, 0, ERROR_INVALID_HANDLE}, + {INVALID_HANDLE_VALUE, NULL, 0, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1}, + {INVALID_HANDLE_VALUE, NULL, 0, &count, 0, ERROR_INVALID_HANDLE}, + {INVALID_HANDLE_VALUE, NULL, 1, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS}, + {INVALID_HANDLE_VALUE, NULL, 1, &count, 0xdeadbeef, ERROR_INVALID_ACCESS}, + {INVALID_HANDLE_VALUE, &event, 0, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1}, + {INVALID_HANDLE_VALUE, &event, 0, &count, 0, ERROR_INVALID_HANDLE}, + {INVALID_HANDLE_VALUE, &event, 1, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1}, + {INVALID_HANDLE_VALUE, &event, 1, &count, 0, ERROR_INVALID_HANDLE}, + {input_handle, NULL, 0, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1}, + {input_handle, NULL, 1, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS}, + {input_handle, NULL, 1, &count, 0xdeadbeef, ERROR_INVALID_ACCESS}, + {input_handle, &event, 0, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1}, + {input_handle, &event, 1, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1}, + }; + + event.EventType = MOUSE_EVENT; + event.Event.MouseEvent = mouse_event; + + for (i = 0; i < sizeof(invalid_table)/sizeof(invalid_table[0]); i++) + { + if (invalid_table[i].win7_crash) + continue; + + SetLastError(0xdeadbeef); + if (invalid_table[i].written) count = 0xdeadbeef; + ret = WriteConsoleInputW(invalid_table[i].handle, + invalid_table[i].buffer, + invalid_table[i].count, + invalid_table[i].written); + ok(!ret, "[%d] Expected WriteConsoleInputW to return FALSE, got %d\n", i, ret); + if (invalid_table[i].written) + { + ok(count == invalid_table[i].expected_count, + "[%d] Expected output count to be %u, got %u\n", + i, invalid_table[i].expected_count, count); + } + ok(GetLastError() == invalid_table[i].last_error, + "[%d] Expected last error to be %u, got %u\n", + i, invalid_table[i].last_error, GetLastError()); + } + + count = 0xdeadbeef; + ret = WriteConsoleInputW(input_handle, NULL, 0, &count); + ok(ret == TRUE, "Expected WriteConsoleInputW to return TRUE, got %d\n", ret); + ok(count == 0, "Expected count to be 0, got %u\n", count); + + count = 0xdeadbeef; + ret = WriteConsoleInputW(input_handle, &event, 0, &count); + ok(ret == TRUE, "Expected WriteConsoleInputW to return TRUE, got %d\n", ret); + ok(count == 0, "Expected count to be 0, got %u\n", count); + + count = 0xdeadbeef; + ret = WriteConsoleInputW(input_handle, &event, 1, &count); + ok(ret == TRUE, "Expected WriteConsoleInputW to return TRUE, got %d\n", ret); + ok(count == 1, "Expected count to be 1, got %u\n", count); + + /* Discard the queued input event by reading it. */ + count = 0xdeadbeef; + ret = ReadConsoleInputW(input_handle, &temp, 1, &count); + ok(ret == TRUE, "Expected ReadConsoleInputW to return TRUE, got %d\n", ret); + ok(count == 1, "Expected count to be 1, got %u\n", count); +} + START_TEST(console) { HANDLE hConIn, hConOut; @@ -1275,4 +1365,5 @@ START_TEST(console) test_VerifyConsoleIoHandle(hConOut); test_GetSetStdHandle(); test_GetNumberOfConsoleInputEvents(hConIn); + test_WriteConsoleInputW(hConIn); }
participants (1)
-
Alexandre Julliard