André Hentschel : ntdll: Catch bad pointers in RtlWow64EnableFsRedirectionEx.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: aac478f51b993a56ec0c4deb5b051d60d80bf6e5
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=aac478f51b993a56ec0c4deb5b...

Author: André Hentschel <nerv(a)dawncrow.de>
Date:   Tue Aug 21 21:58:17 2012 +0200

ntdll: Catch bad pointers in RtlWow64EnableFsRedirectionEx.

---

 dlls/ntdll/directory.c       |    2 ++
 dlls/ntdll/tests/directory.c |    5 +++++
 2 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/dlls/ntdll/directory.c b/dlls/ntdll/directory.c
index c8fff6b..28b0ab3 100644
--- a/dlls/ntdll/directory.c
+++ b/dlls/ntdll/directory.c
@@ -3022,6 +3022,8 @@ NTSTATUS WINAPI RtlWow64EnableFsRedirection( BOOLEAN enable )
 NTSTATUS WINAPI RtlWow64EnableFsRedirectionEx( ULONG disable, ULONG *old_value )
 {
     if (!is_wow64) return STATUS_NOT_IMPLEMENTED;
+    if (((ULONG_PTR)old_value >> 16) == 0) return STATUS_ACCESS_VIOLATION;
+
     *old_value = !ntdll_get_thread_data()->wow64_redir;
     ntdll_get_thread_data()->wow64_redir = !disable;
     return STATUS_SUCCESS;
diff --git a/dlls/ntdll/tests/directory.c b/dlls/ntdll/tests/directory.c
index c74bf34..d6b886a 100644
--- a/dlls/ntdll/tests/directory.c
+++ b/dlls/ntdll/tests/directory.c
@@ -287,6 +287,11 @@ static void test_redirection(void)
     ok( !status, "RtlWow64EnableFsRedirectionEx failed status %x\n", status );
     ok( !cur, "RtlWow64EnableFsRedirectionEx got %u\n", cur );
 
+    status = pRtlWow64EnableFsRedirectionEx( TRUE, NULL );
+    ok( status == STATUS_ACCESS_VIOLATION, "RtlWow64EnableFsRedirectionEx failed with status %x\n", status );
+    status = pRtlWow64EnableFsRedirectionEx( TRUE, (void*)1 );
+    ok( status == STATUS_ACCESS_VIOLATION, "RtlWow64EnableFsRedirectionEx failed with status %x\n", status );
+
     status = pRtlWow64EnableFsRedirection( FALSE );
     ok( !status, "RtlWow64EnableFsRedirectionEx failed status %x\n", status );
     status = pRtlWow64EnableFsRedirectionEx( FALSE, &cur );