[PATCH v3 1/2] kernel32/tests: Fix stack overflow by DefineDosDeviceW().
Signed-off-by: Xu Wei <xuwei(a)uniontech.com> --- dlls/kernel32/tests/volume.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/dlls/kernel32/tests/volume.c b/dlls/kernel32/tests/volume.c index cb35de6add1..2fe8c1995cf 100644 --- a/dlls/kernel32/tests/volume.c +++ b/dlls/kernel32/tests/volume.c @@ -111,6 +111,7 @@ static void test_dos_devices(void) { char buf[MAX_PATH], buf2[400]; char drivestr[3]; + WCHAR drivestrW[3]; HANDLE file; BOOL ret; @@ -185,6 +186,21 @@ static void test_dos_devices(void) ret = QueryDosDeviceA( drivestr, buf, sizeof(buf) ); ok(!ret, "expected failure\n"); ok(GetLastError() == ERROR_FILE_NOT_FOUND, "got error %u\n", GetLastError()); + + SetLastError(0); + ret = DefineDosDeviceW( DDD_RAW_TARGET_PATH, drivestrW, NULL ); + ok(!ret, "expected failure\n"); + ok(GetLastError() == ERROR_INVALID_PARAMETER, "got error %u\n", GetLastError()); + + SetLastError(0); + ret = DefineDosDeviceW( DDD_RAW_TARGET_PATH, NULL, drivestrW ); + ok(ret, "got error %u\n", GetLastError()); + + SetLastError(0); + DefineDosDeviceW( DDD_EXACT_MATCH_ON_REMOVE|DDD_RAW_TARGET_PATH|DDD_REMOVE_DEFINITION, + "{00000001-0000-0000-0000-4E6574446576}", + "\\Device\\{00000001-0000-0000-0000-4E6574446576}" ); + ok(ret, "got error %u\n", GetLastError()); } static void test_FindFirstVolume(void) -- 2.20.1
Signed-off-by: Xu Wei <xuwei(a)uniontech.com> --- dlls/kernelbase/volume.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/dlls/kernelbase/volume.c b/dlls/kernelbase/volume.c index d513dda1f9d..be68721020e 100644 --- a/dlls/kernelbase/volume.c +++ b/dlls/kernelbase/volume.c @@ -384,7 +384,7 @@ err_ret: */ BOOL WINAPI DECLSPEC_HOTPATCH DefineDosDeviceW( DWORD flags, const WCHAR *device, const WCHAR *target ) { - WCHAR link_name[15] = L"\\DosDevices\\"; + WCHAR *link_name = NULL; UNICODE_STRING nt_name, nt_target; OBJECT_ATTRIBUTES attr; NTSTATUS status; @@ -395,17 +395,28 @@ BOOL WINAPI DECLSPEC_HOTPATCH DefineDosDeviceW( DWORD flags, const WCHAR *device if (flags & ~(DDD_RAW_TARGET_PATH | DDD_REMOVE_DEFINITION)) FIXME("Ignoring flags %#x.\n", flags & ~(DDD_RAW_TARGET_PATH | DDD_REMOVE_DEFINITION)); - lstrcatW( link_name, device ); + if (!(link_name = HeapAlloc( GetProcessHeap(), 0, sizeof(L"\\DosDevices\\") + (device ? lstrlenW(device) * sizeof(WCHAR) : 0)))) + { + SetLastError(ERROR_OUTOFMEMORY); + return FALSE; + } + + lstrcpyW( link_name, L"\\DosDevices\\" ); + if (device) lstrcatW( link_name, device ); RtlInitUnicodeString( &nt_name, link_name ); InitializeObjectAttributes( &attr, &nt_name, OBJ_CASE_INSENSITIVE | OBJ_PERMANENT, 0, NULL ); if (flags & DDD_REMOVE_DEFINITION) { if (!set_ntstatus( NtOpenSymbolicLinkObject( &handle, 0, &attr ) )) + { + HeapFree( GetProcessHeap(), 0, link_name ); return FALSE; + } status = NtMakeTemporaryObject( handle ); NtClose( handle ); + HeapFree( GetProcessHeap(), 0, link_name ); return set_ntstatus( status ); } @@ -414,6 +425,7 @@ BOOL WINAPI DECLSPEC_HOTPATCH DefineDosDeviceW( DWORD flags, const WCHAR *device if (!RtlDosPathNameToNtPathName_U( target, &nt_target, NULL, NULL)) { SetLastError( ERROR_PATH_NOT_FOUND ); + HeapFree( GetProcessHeap(), 0, link_name ); return FALSE; } } @@ -422,6 +434,7 @@ BOOL WINAPI DECLSPEC_HOTPATCH DefineDosDeviceW( DWORD flags, const WCHAR *device if (!(status = NtCreateSymbolicLinkObject( &handle, SYMBOLIC_LINK_ALL_ACCESS, &attr, &nt_target ))) NtClose( handle ); + HeapFree( GetProcessHeap(), 0, link_name ); return set_ntstatus( status ); } -- 2.20.1
Hi, While running your changed tests, I think I found new failures. Being a bot and all I'm not very good at pattern recognition, so I might be wrong, but could you please double-check? Full results can be found at: https://testbot.winehq.org/JobDetails.pl?Key=97636 Your paranoid android. === debiant2 (32 bit report) === kernel32: Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510). === debiant2 (32 bit Arabic:Morocco report) === kernel32: Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510). === debiant2 (32 bit German report) === kernel32: Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510). === debiant2 (32 bit French report) === kernel32: Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510). === debiant2 (32 bit Hebrew:Israel report) === kernel32: Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510). === debiant2 (32 bit Hindi:India report) === kernel32: Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510). === debiant2 (32 bit Japanese:Japan report) === kernel32: Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510). === debiant2 (32 bit Chinese:China report) === kernel32: Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510). === debiant2 (32 bit WoW report) === kernel32: Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510). === debiant2 (64 bit WoW report) === kernel32: Unhandled exception: page fault on read access to 0x00000000 in 64-bit code (0x000000007b077320).
Hi, On 9/9/21 4:45 PM, Xu Wei wrote:
+ DefineDosDeviceW( DDD_EXACT_MATCH_ON_REMOVE|DDD_RAW_TARGET_PATH|DDD_REMOVE_DEFINITION, + "{00000001-0000-0000-0000-4E6574446576}", + "\\Device\\{00000001-0000-0000-0000-4E6574446576}" );
You are passing char* into an unicode function. Also in order to avoid the test crash on Linux testbot, you might want to reverse the order of your tests and your fix.
participants (3)
-
Jactry Zeng -
Marvin -
Xu Wei