June 2006 - Wine-Commits - list.winehq.org

Robert Shearman : rpcrt4: Pass in a maximum variance value to ReadVariance to allow us
by Alexandre Julliard June 12, 2006

June 12, 2006

Module: wine Branch: refs/heads/master Commit: 8dea3c2aa866bb3f5e24d12b43712c524e8b8fa8 URL: http://source.winehq.org/git/?p=wine.git;a=commit;h=8dea3c2aa866bb3f5e24d12… Author: Robert Shearman <rob(a)codeweavers.com> Date: Sat Jun 10 12:32:47 2006 +0100 rpcrt4: Pass in a maximum variance value to ReadVariance to allow us to validate the conformance values being read from the wire. --- dlls/rpcrt4/ndr_marshall.c | 40 +++++++++++++++++++--------------------- 1 files changed, 19 insertions(+), 21 deletions(-) diff --git a/dlls/rpcrt4/ndr_marshall.c b/dlls/rpcrt4/ndr_marshall.c index 58bcd25..50d3871 100644 --- a/dlls/rpcrt4/ndr_marshall.c +++ b/dlls/rpcrt4/ndr_marshall.c @@ -332,7 +332,7 @@ static PFORMAT_STRING ReadConformance(MI return pFormat+4; } -static inline PFORMAT_STRING ReadVariance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_STRING pFormat) +static inline PFORMAT_STRING ReadVariance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_STRING pFormat, ULONG MaxValue) { if (pFormat && !IsConformanceOrVariancePresent(pFormat)) { @@ -349,6 +349,15 @@ static inline PFORMAT_STRING ReadVarianc pStubMsg->Buffer += 4; TRACE("variance is %ld\n", pStubMsg->ActualCount); + if ((pStubMsg->ActualCount > MaxValue) || + (pStubMsg->ActualCount + pStubMsg->Offset > MaxValue)) + { + ERR("invalid array bound(s): ActualCount = %ld, Offset = %ld, MaxValue = %ld\n", + pStubMsg->ActualCount, pStubMsg->Offset, MaxValue); + RpcRaiseException(RPC_S_INVALID_BOUND); + return NULL; + } + done: if (pStubMsg->fHasNewCorrDesc) return pFormat+6; @@ -675,7 +684,7 @@ unsigned char *WINAPI NdrConformantStrin assert(pFormat && ppMemory && pStubMsg); ReadConformance(pStubMsg, NULL); - ReadVariance(pStubMsg, NULL); + ReadVariance(pStubMsg, NULL, pStubMsg->MaxCount); if (*pFormat == RPC_FC_C_CSTRING) esize = 1; else if (*pFormat == RPC_FC_C_WSTRING) esize = 2; @@ -2365,11 +2374,12 @@ unsigned char* WINAPI NdrConformantVaryi } pFormat = ReadConformance(pStubMsg, pFormat+4); - pFormat = ReadVariance(pStubMsg, pFormat); + pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount); ALIGN_POINTER(pStubMsg->Buffer, alignment); bufsize = safe_multiply(esize, pStubMsg->ActualCount); + TRACE("esize = %ld, pStubMsg->MaxCount = %ld, result = %ld\n", esize, pStubMsg->MaxCount, esize * pStubMsg->MaxCount); memsize = safe_multiply(esize, pStubMsg->MaxCount); if (!*ppMemory || fMustAlloc) @@ -2525,7 +2535,7 @@ unsigned char * WINAPI NdrComplexArrayUn pFormat += 4; pFormat = ReadConformance(pStubMsg, pFormat); - pFormat = ReadVariance(pStubMsg, pFormat); + pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount); Buffer = pStubMsg->Buffer; esize = ComplexStructMemorySize(pStubMsg, pFormat); @@ -2618,7 +2628,7 @@ unsigned long WINAPI NdrComplexArrayMemo pFormat += 4; pFormat = ReadConformance(pStubMsg, pFormat); - pFormat = ReadVariance(pStubMsg, pFormat); + pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount); ALIGN_POINTER(pStubMsg->Buffer, alignment); @@ -3199,7 +3209,7 @@ unsigned char * WINAPI NdrConformantVar memcpy(*ppMemory, pStubMsg->Buffer, pCVStructFormat->memory_size); pStubMsg->Buffer += pCVStructFormat->memory_size; - pCVArrayFormat = ReadVariance(pStubMsg, pCVArrayFormat); + pCVArrayFormat = ReadVariance(pStubMsg, pCVArrayFormat, pStubMsg->MaxCount); bufsize = safe_multiply(esize, pStubMsg->ActualCount); @@ -3366,7 +3376,7 @@ unsigned long WINAPI NdrConformantVaryin TRACE("memory_size = %d\n", pCVStructFormat->memory_size); pStubMsg->Buffer += pCVStructFormat->memory_size; - pCVArrayFormat = ReadVariance(pStubMsg, pCVArrayFormat); + pCVArrayFormat = ReadVariance(pStubMsg, pCVArrayFormat, pStubMsg->MaxCount); pStubMsg->Buffer += pCVStructFormat->memory_size + safe_multiply(esize, pStubMsg->ActualCount); pStubMsg->MemorySize += pCVStructFormat->memory_size + safe_multiply(esize, pStubMsg->MaxCount); @@ -3757,13 +3767,7 @@ unsigned char * WINAPI NdrVaryingArrayU esize = *(const WORD*)pFormat; pFormat += sizeof(WORD); - pFormat = ReadVariance(pStubMsg, pFormat); - if ((pStubMsg->ActualCount > elements) || - (pStubMsg->ActualCount + pStubMsg->Offset > elements)) - { - RpcRaiseException(RPC_S_INVALID_BOUND); - return NULL; - } + pFormat = ReadVariance(pStubMsg, pFormat, elements); ALIGN_POINTER(pStubMsg->Buffer, alignment); @@ -3877,13 +3881,7 @@ unsigned long WINAPI NdrVaryingArrayMemo esize = *(const WORD*)pFormat; pFormat += sizeof(WORD); - pFormat = ReadVariance(pStubMsg, pFormat); - if ((pStubMsg->ActualCount > elements) || - (pStubMsg->ActualCount + pStubMsg->Offset > elements)) - { - RpcRaiseException(RPC_S_INVALID_BOUND); - return 0; - } + pFormat = ReadVariance(pStubMsg, pFormat, elements); ALIGN_POINTER(pStubMsg->Buffer, alignment);

1 0

Robert Shearman : rpcrt4: Check that strings are null-terminated on unmarshaling of conformant-varying structs .
by Alexandre Julliard June 12, 2006

June 12, 2006

Module: wine Branch: refs/heads/master Commit: 613ee6d01c2bcea446c1792ef57a18afbbe0a8a4 URL: http://source.winehq.org/git/?p=wine.git;a=commit;h=613ee6d01c2bcea446c1792… Author: Robert Shearman <rob(a)codeweavers.com> Date: Sat Jun 10 12:32:35 2006 +0100 rpcrt4: Check that strings are null-terminated on unmarshaling of conformant-varying structs. --- dlls/rpcrt4/ndr_marshall.c | 22 ++++++++++++++++++++++ 1 files changed, 22 insertions(+), 0 deletions(-) diff --git a/dlls/rpcrt4/ndr_marshall.c b/dlls/rpcrt4/ndr_marshall.c index 26d430b..58bcd25 100644 --- a/dlls/rpcrt4/ndr_marshall.c +++ b/dlls/rpcrt4/ndr_marshall.c @@ -3202,6 +3202,28 @@ unsigned char * WINAPI NdrConformantVar pCVArrayFormat = ReadVariance(pStubMsg, pCVArrayFormat); bufsize = safe_multiply(esize, pStubMsg->ActualCount); + + if ((cvarray_type == RPC_FC_C_CSTRING) || + (cvarray_type == RPC_FC_C_WSTRING)) + { + ULONG i; + /* strings must always have null terminating bytes */ + if (bufsize < esize) + { + ERR("invalid string length of %ld\n", pStubMsg->ActualCount); + RpcRaiseException(RPC_S_INVALID_BOUND); + return NULL; + } + for (i = bufsize - esize; i < bufsize; i++) + if (pStubMsg->Buffer[i] != 0) + { + ERR("string not null-terminated at byte position %ld, data is 0x%x\n", + i, pStubMsg->Buffer[i]); + RpcRaiseException(RPC_S_INVALID_BOUND); + return NULL; + } + } + /* copy the array data */ memcpy(*ppMemory + pCVStructFormat->memory_size, pStubMsg->Buffer, bufsize);

1 0

Robert Shearman : rpcrt4: Use safe_multiply when multiplying anything by pStubMsg-> ActualCount or pStubMsg->MaxCount.
by Alexandre Julliard June 12, 2006

June 12, 2006

Module: wine Branch: refs/heads/master Commit: a946eb420bc6c987c6072f3c24439737eb57224b URL: http://source.winehq.org/git/?p=wine.git;a=commit;h=a946eb420bc6c987c6072f3… Author: Robert Shearman <rob(a)codeweavers.com> Date: Sat Jun 10 12:32:24 2006 +0100 rpcrt4: Use safe_multiply when multiplying anything by pStubMsg->ActualCount or pStubMsg->MaxCount. --- dlls/rpcrt4/ndr_marshall.c | 88 +++++++++++++++++++++++++++----------------- 1 files changed, 54 insertions(+), 34 deletions(-) Diff: http://source.winehq.org/git/?p=wine.git;a=commitdiff;h=a946eb420bc6c987c60…

1 0

Robert Shearman : rpcrt4: Raise an exception during unmarshaling if a conformant string isn' t null-terminated.
by Alexandre Julliard June 12, 2006

June 12, 2006

Module: wine Branch: refs/heads/master Commit: cec6092aa293469f18431e2d5158b88df4b0c98a URL: http://source.winehq.org/git/?p=wine.git;a=commit;h=cec6092aa293469f18431e2… Author: Robert Shearman <rob(a)codeweavers.com> Date: Sat Jun 10 12:32:01 2006 +0100 rpcrt4: Raise an exception during unmarshaling if a conformant string isn't null-terminated. --- dlls/rpcrt4/ndr_marshall.c | 18 +++++++++++++++++- 1 files changed, 17 insertions(+), 1 deletions(-) diff --git a/dlls/rpcrt4/ndr_marshall.c b/dlls/rpcrt4/ndr_marshall.c index 8fbb61f..2990f16 100644 --- a/dlls/rpcrt4/ndr_marshall.c +++ b/dlls/rpcrt4/ndr_marshall.c @@ -667,7 +667,7 @@ unsigned long WINAPI NdrConformantString unsigned char *WINAPI NdrConformantStringUnmarshall( PMIDL_STUB_MESSAGE pStubMsg, unsigned char** ppMemory, PFORMAT_STRING pFormat, unsigned char fMustAlloc ) { - unsigned long size, esize; + ULONG size, esize, i; TRACE("(pStubMsg == ^%p, *pMemory == ^%p, pFormat == ^%p, fMustAlloc == %u)\n", pStubMsg, *ppMemory, pFormat, fMustAlloc); @@ -687,6 +687,22 @@ unsigned char *WINAPI NdrConformantStrin size = safe_multiply(esize, pStubMsg->ActualCount); + /* strings must always have null terminating bytes */ + if (size < esize) + { + ERR("invalid string length of %ld\n", pStubMsg->ActualCount); + RpcRaiseException(RPC_S_INVALID_BOUND); + return NULL; + } + for (i = size - esize; i < size; i++) + if (pStubMsg->Buffer[i] != 0) + { + ERR("string not null-terminated at byte position %ld, data is 0x%x\n", + i, pStubMsg->Buffer[i]); + RpcRaiseException(RPC_S_INVALID_BOUND); + return NULL; + } + if (fMustAlloc || !*ppMemory) *ppMemory = NdrAllocate(pStubMsg, size);

1 0

Robert Shearman : rpcrt4: Introduce a new function, safe_multiply, which will raise an
by Alexandre Julliard June 12, 2006

June 12, 2006

Module: wine Branch: refs/heads/master Commit: 6e95bfe85a0b7c1f0591ea436c391ef930a8d7dd URL: http://source.winehq.org/git/?p=wine.git;a=commit;h=6e95bfe85a0b7c1f0591ea4… Author: Robert Shearman <rob(a)codeweavers.com> Date: Sat Jun 10 12:31:45 2006 +0100 rpcrt4: Introduce a new function, safe_multiply, which will raise an exception if a multiply overflows a 4-byte integer. This will protect the unmarshaling code against attacks specifying a large variance. Use this new function in the conformant string functions to harden them against attack. --- dlls/rpcrt4/ndr_marshall.c | 48 +++++++++++++++++++++++++++++++++----------- 1 files changed, 36 insertions(+), 12 deletions(-) diff --git a/dlls/rpcrt4/ndr_marshall.c b/dlls/rpcrt4/ndr_marshall.c index 6143c0c..8fbb61f 100644 --- a/dlls/rpcrt4/ndr_marshall.c +++ b/dlls/rpcrt4/ndr_marshall.c @@ -518,6 +518,19 @@ finish_conf: return pFormat+4; } +/* multiply two numbers together, raising an RPC_S_INVALID_BOUND exception if + * the result overflows 32-bits */ +static ULONG inline safe_multiply(ULONG a, ULONG b) +{ + ULONGLONG ret = (ULONGLONG)a * b; + if (ret > 0xffffffff) + { + RpcRaiseException(RPC_S_INVALID_BOUND); + return 0; + } + return ret; +} + /* * NdrConformantString: @@ -542,7 +555,7 @@ finish_conf: unsigned char *WINAPI NdrConformantStringMarshall(MIDL_STUB_MESSAGE *pStubMsg, unsigned char *pszMessage, PFORMAT_STRING pFormat) { - unsigned long esize; + ULONG esize, size; TRACE("(pStubMsg == ^%p, pszMessage == ^%p, pFormat == ^%p)\n", pStubMsg, pszMessage, pFormat); @@ -570,8 +583,9 @@ unsigned char *WINAPI NdrConformantStrin WriteConformance(pStubMsg); WriteVariance(pStubMsg); - memcpy(pStubMsg->Buffer, pszMessage, pStubMsg->ActualCount*esize); /* the string itself */ - pStubMsg->Buffer += pStubMsg->ActualCount*esize; + size = safe_multiply(esize, pStubMsg->ActualCount); + memcpy(pStubMsg->Buffer, pszMessage, size); /* the string itself */ + pStubMsg->Buffer += size; STD_OVERFLOW_CHECK(pStubMsg); @@ -585,25 +599,35 @@ unsigned char *WINAPI NdrConformantStrin void WINAPI NdrConformantStringBufferSize(PMIDL_STUB_MESSAGE pStubMsg, unsigned char* pMemory, PFORMAT_STRING pFormat) { + ULONG esize; + TRACE("(pStubMsg == ^%p, pMemory == ^%p, pFormat == ^%p)\n", pStubMsg, pMemory, pFormat); SizeConformance(pStubMsg); SizeVariance(pStubMsg); if (*pFormat == RPC_FC_C_CSTRING) { - /* we need + 1 octet for '\0' */ TRACE("string=%s\n", debugstr_a((char*)pMemory)); - pStubMsg->BufferLength += strlen((char*)pMemory) + 1; + pStubMsg->ActualCount = strlen((char*)pMemory)+1; + esize = 1; } else if (*pFormat == RPC_FC_C_WSTRING) { - /* we need + 2 octets for L'\0' */ TRACE("string=%s\n", debugstr_w((LPWSTR)pMemory)); - pStubMsg->BufferLength += strlenW((LPWSTR)pMemory)*2 + 2; + pStubMsg->ActualCount = strlenW((LPWSTR)pMemory)+1; + esize = 2; } else { ERR("Unhandled string type: %#x\n", *pFormat); /* FIXME: raise an exception */ + return; } + + if (pFormat[1] == RPC_FC_STRING_SIZED) + pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 2, 0); + else + pStubMsg->MaxCount = pStubMsg->ActualCount; + + pStubMsg->BufferLength += safe_multiply(esize, pStubMsg->ActualCount); } /************************************************************************ @@ -643,7 +667,7 @@ unsigned long WINAPI NdrConformantString unsigned char *WINAPI NdrConformantStringUnmarshall( PMIDL_STUB_MESSAGE pStubMsg, unsigned char** ppMemory, PFORMAT_STRING pFormat, unsigned char fMustAlloc ) { - unsigned long len, esize; + unsigned long size, esize; TRACE("(pStubMsg == ^%p, *pMemory == ^%p, pFormat == ^%p, fMustAlloc == %u)\n", pStubMsg, *ppMemory, pFormat, fMustAlloc); @@ -661,14 +685,14 @@ unsigned char *WINAPI NdrConformantStrin esize = 0; } - len = pStubMsg->ActualCount; + size = safe_multiply(esize, pStubMsg->ActualCount); if (fMustAlloc || !*ppMemory) - *ppMemory = NdrAllocate(pStubMsg, len*esize); + *ppMemory = NdrAllocate(pStubMsg, size); - memcpy(*ppMemory, pStubMsg->Buffer, len*esize); + memcpy(*ppMemory, pStubMsg->Buffer, size); - pStubMsg->Buffer += len*esize; + pStubMsg->Buffer += size; if (*pFormat == RPC_FC_C_CSTRING) { TRACE("string=%s\n", debugstr_a((char*)*ppMemory));

1 0

Alexandre Julliard : uuid: Mark all GUID variables as hidden.
by Alexandre Julliard June 12, 2006

June 12, 2006

Module: wine Branch: refs/heads/master Commit: 236fd51020548e5b3d804ab19484d7d2a1d005c3 URL: http://source.winehq.org/git/?p=wine.git;a=commit;h=236fd51020548e5b3d804ab… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Mon Jun 12 12:01:38 2006 +0200 uuid: Mark all GUID variables as hidden. --- dlls/uuid/uuid.c | 1 + include/guiddef.h | 4 +++- 2 files changed, 4 insertions(+), 1 deletions(-) diff --git a/dlls/uuid/uuid.c b/dlls/uuid/uuid.c index 21b0ee1..2b30313 100644 --- a/dlls/uuid/uuid.c +++ b/dlls/uuid/uuid.c @@ -21,6 +21,7 @@ #include <stdarg.h> +#include "windef.h" #define COM_NO_WINDOWS_H #include "initguid.h" diff --git a/include/guiddef.h b/include/guiddef.h index 749a37c..8ad314e 100644 --- a/include/guiddef.h +++ b/include/guiddef.h @@ -32,16 +32,18 @@ #undef DEFINE_GUID #ifdef INITGUID #ifdef __cplusplus #define DEFINE_GUID(name, l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8) \ + EXTERN_C const GUID name DECLSPEC_HIDDEN; \ EXTERN_C const GUID name = \ { l, w1, w2, { b1, b2, b3, b4, b5, b6, b7, b8 } } #else #define DEFINE_GUID(name, l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8) \ + const GUID name DECLSPEC_HIDDEN; \ const GUID name = \ { l, w1, w2, { b1, b2, b3, b4, b5, b6, b7, b8 } } #endif #else #define DEFINE_GUID(name, l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8) \ - EXTERN_C const GUID name + EXTERN_C const GUID name DECLSPEC_HIDDEN #endif #define DEFINE_OLEGUID(name, l, w1, w2) \

1 0

Alexandre Julliard : dnsapi: DnsExtractRecordsFromMessage_A is not exported .
by Alexandre Julliard June 12, 2006

June 12, 2006

Module: wine Branch: refs/heads/master Commit: d74b280e95c4e43cf35539218576e8e6c3a821f1 URL: http://source.winehq.org/git/?p=wine.git;a=commit;h=d74b280e95c4e43cf355392… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Mon Jun 12 12:01:06 2006 +0200 dnsapi: DnsExtractRecordsFromMessage_A is not exported. --- dlls/dnsapi/main.c | 13 ------------- 1 files changed, 0 insertions(+), 13 deletions(-) diff --git a/dlls/dnsapi/main.c b/dlls/dnsapi/main.c index cb134d5..faa9cc0 100644 --- a/dlls/dnsapi/main.c +++ b/dlls/dnsapi/main.c @@ -99,19 +99,6 @@ void WINAPI DnsReleaseContextHandle( HAN } /****************************************************************************** - * DnsExtractRecordsFromMessage_A [DNSAPI.@] - * - */ -DNS_STATUS WINAPI DnsExtractRecordsFromMessage_A( PDNS_MESSAGE_BUFFER buffer, - WORD len, PDNS_RECORDA *record ) -{ - FIXME( "(%p,%d,%p) stub\n", buffer, len, record ); - - *record = NULL; - return ERROR_SUCCESS; -} - -/****************************************************************************** * DnsExtractRecordsFromMessage_UTF8 [DNSAPI.@] * */

1 0

Alexandre Julliard : advapi32: Added spec entry for GetEffectiveRightsFromAclW.
by Alexandre Julliard June 12, 2006

June 12, 2006

Module: wine Branch: refs/heads/master Commit: ce49817bc52a1a9414c9462bab1de08360429093 URL: http://source.winehq.org/git/?p=wine.git;a=commit;h=ce49817bc52a1a9414c9462… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Mon Jun 12 11:58:41 2006 +0200 advapi32: Added spec entry for GetEffectiveRightsFromAclW. --- dlls/advapi32/advapi32.spec | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/dlls/advapi32/advapi32.spec b/dlls/advapi32/advapi32.spec index f9285ca..7e6880e 100644 --- a/dlls/advapi32/advapi32.spec +++ b/dlls/advapi32/advapi32.spec @@ -235,7 +235,7 @@ # @ stub GetAuditedPermissionsFromAclW @ stdcall GetCurrentHwProfileA(ptr) @ stdcall GetCurrentHwProfileW(ptr) @ stdcall GetEffectiveRightsFromAclA(ptr ptr ptr) -# @ stub GetEffectiveRightsFromAclW +@ stdcall GetEffectiveRightsFromAclW(ptr ptr ptr) # @ stub GetEventLogInformation @ stdcall GetExplicitEntriesFromAclA(ptr ptr ptr) @ stdcall GetExplicitEntriesFromAclW(ptr ptr ptr)

1 0

lostwages/ news/2006061101.xml wwn/wn20060611_ ...
by WineHQ June 12, 2006

June 12, 2006

ChangeSet ID: 25579 CVSROOT: /opt/cvs-commit Module name: lostwages Changes by: wineowner(a)winehq.org 2006/06/12 00:36:38 Added files: news : 2006061101.xml wwn : wn20060611_316.xml Log message: WWN #316 Patch: http://cvs.winehq.org/patch.py?id=25579 Old revision New revision Changes Path Added 1.1 +0 -0 lostwages/news/2006061101.xml Added 1.1 +0 -0 lostwages/wwn/wn20060611_316.xml

1 0

Alexandre Julliard : wined3d: Make all the local shader functions static.
by Alexandre Julliard June 10, 2006

June 10, 2006

Module: wine Branch: refs/heads/master Commit: dbfb3739aa1b7f81625814e0434fc4b67a49b08d URL: http://source.winehq.org/git/?p=wine.git;a=commit;h=dbfb3739aa1b7f81625814e… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Sat Jun 10 13:22:27 2006 +0200 wined3d: Make all the local shader functions static. --- dlls/wined3d/glsl_shader.c | 14 +-- dlls/wined3d/pixelshader.c | 220 ++++++++++++++++++++++--------------------- dlls/wined3d/vertexshader.c | 130 ++++++++++++------------- 3 files changed, 180 insertions(+), 184 deletions(-) Diff: http://source.winehq.org/git/?p=wine.git;a=commitdiff;h=dbfb3739aa1b7f81625…

1 0