January 2009 - Wine-Commits

Andrey Turkin : ole32: Do not crash in WriteClassStg if passed NULL pointer .
by Alexandre Julliard Jan. 15, 2009

Jan. 15, 2009

Module: wine Branch: master Commit: d20ab01ed27e48e44fee8f2cb78a7804e78a26d4 URL: http://source.winehq.org/git/wine.git/?a=commit;h=d20ab01ed27e48e44fee8f2cb… Author: Andrey Turkin <andrey.turkin(a)gmail.com> Date: Wed Jan 14 22:31:06 2009 +0300 ole32: Do not crash in WriteClassStg if passed NULL pointer. --- dlls/ole32/storage32.c | 3 ++ dlls/ole32/tests/storage32.c | 51 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 0 deletions(-) diff --git a/dlls/ole32/storage32.c b/dlls/ole32/storage32.c index fe84804..48a655f 100644 --- a/dlls/ole32/storage32.c +++ b/dlls/ole32/storage32.c @@ -6281,6 +6281,9 @@ HRESULT WINAPI WriteClassStg(IStorage* pStg, REFCLSID rclsid) if(!pStg) return E_INVALIDARG; + if(!rclsid) + return STG_E_INVALIDPOINTER; + hRes = IStorage_SetClass(pStg, rclsid); return hRes; diff --git a/dlls/ole32/tests/storage32.c b/dlls/ole32/tests/storage32.c index f65af73..da2d0aa 100644 --- a/dlls/ole32/tests/storage32.c +++ b/dlls/ole32/tests/storage32.c @@ -803,6 +803,56 @@ static void test_storage_refcount(void) DeleteFileW(filename); } +static void test_writeclassstg(void) +{ + static const WCHAR szPrefix[] = { 's','t','g',0 }; + static const WCHAR szDot[] = { '.',0 }; + WCHAR filename[MAX_PATH]; + IStorage *stg = NULL; + HRESULT r; + CLSID temp_cls; + + if(!GetTempFileNameW(szDot, szPrefix, 0, filename)) + return; + + DeleteFileW(filename); + + /* create the file */ + r = StgCreateDocfile( filename, STGM_CREATE | STGM_SHARE_EXCLUSIVE | + STGM_READWRITE, 0, &stg); + ok(r==S_OK, "StgCreateDocfile failed\n"); + + r = ReadClassStg( NULL, NULL ); + ok(r == E_INVALIDARG, "ReadClassStg should return E_INVALIDARG instead of 0x%08X\n", r); + + r = ReadClassStg( stg, NULL ); + ok(r == E_INVALIDARG, "ReadClassStg should return E_INVALIDARG instead of 0x%08X\n", r); + + temp_cls.Data1 = 0xdeadbeef; + r = ReadClassStg( stg, &temp_cls ); + ok(r == S_OK, "ReadClassStg failed with 0x%08X\n", r); + + ok(IsEqualCLSID(&temp_cls, &CLSID_NULL), "ReadClassStg returned wrong clsid\n"); + + r = WriteClassStg( NULL, NULL ); + ok(r == E_INVALIDARG, "WriteClassStg should return E_INVALIDARG instead of 0x%08X\n", r); + + r = WriteClassStg( stg, NULL ); + ok(r == STG_E_INVALIDPOINTER, "WriteClassStg should return STG_E_INVALIDPOINTER instead of 0x%08X\n", r); + + r = WriteClassStg( stg, &test_stg_cls ); + ok( r == S_OK, "WriteClassStg failed with 0x%08X\n", r); + + r = ReadClassStg( stg, &temp_cls ); + ok( r == S_OK, "ReadClassStg failed with 0x%08X\n", r); + ok(IsEqualCLSID(&temp_cls, &test_stg_cls), "ReadClassStg returned wrong clsid\n"); + + r = IStorage_Release( stg ); + ok (r == 0, "storage not released\n"); + + DeleteFileW(filename); +} + static void test_streamenum(void) { static const WCHAR szPrefix[] = { 's','t','g',0 }; @@ -1229,4 +1279,5 @@ START_TEST(storage32) test_transact(); test_ReadClassStm(); test_access(); + test_writeclassstg(); }

1 0

Juan Lang : shell32: Document SHFlushSFCache, and remove an unneeded fixme.
by Alexandre Julliard Jan. 15, 2009

Jan. 15, 2009

Module: wine Branch: master Commit: ba48d37837206d175b010c0413f0147e045d18d6 URL: http://source.winehq.org/git/wine.git/?a=commit;h=ba48d37837206d175b010c041… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Jan 14 08:31:04 2009 -0800 shell32: Document SHFlushSFCache, and remove an unneeded fixme. --- dlls/shell32/shellord.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/dlls/shell32/shellord.c b/dlls/shell32/shellord.c index d8a6a0f..5622484 100644 --- a/dlls/shell32/shellord.c +++ b/dlls/shell32/shellord.c @@ -1995,8 +1995,13 @@ BOOL WINAPI LinkWindow_UnregisterClass(void) /************************************************************************* * SHFlushSFCache (SHELL32.526) + * + * Notifies the shell that a user-specified special folder location has changed. + * + * NOTES + * In Wine, the shell folder registry values are not cached, so this function + * has no effect. */ void WINAPI SHFlushSFCache(void) { - FIXME("()\n"); }

1 0

Andrey Turkin : gdiplus: GdipLoadImageFromStream should use well-known pixel format constants when possible .
by Alexandre Julliard Jan. 15, 2009

Jan. 15, 2009

Module: wine Branch: master Commit: 1138c28eeb0f6753e05590dd2670d6a17c815627 URL: http://source.winehq.org/git/wine.git/?a=commit;h=1138c28eeb0f6753e05590dd2… Author: Andrey Turkin <andrey.turkin(a)gmail.com> Date: Thu Jan 15 12:39:47 2009 +0300 gdiplus: GdipLoadImageFromStream should use well-known pixel format constants when possible. --- dlls/gdiplus/image.c | 30 +++++++++++++++++++++++++++++- 1 files changed, 29 insertions(+), 1 deletions(-) diff --git a/dlls/gdiplus/image.c b/dlls/gdiplus/image.c index 1fb8824..02f8f5a 100644 --- a/dlls/gdiplus/image.c +++ b/dlls/gdiplus/image.c @@ -1068,7 +1068,35 @@ GpStatus WINGDIPAPI GdipLoadImageFromStream(IStream* stream, GpImage **image) else GetDIBits(hdc, hbm, 0, 0, NULL, pbmi, DIB_RGB_COLORS); - (*((GpBitmap**) image))->format = (bmch->bcBitCount << 8) | PixelFormatGDI; + switch(bmch->bcBitCount) + { + case 1: + (*((GpBitmap**) image))->format = PixelFormat1bppIndexed; + break; + case 4: + (*((GpBitmap**) image))->format = PixelFormat4bppIndexed; + break; + case 8: + (*((GpBitmap**) image))->format = PixelFormat8bppIndexed; + break; + case 16: + (*((GpBitmap**) image))->format = PixelFormat16bppRGB565; + break; + case 24: + (*((GpBitmap**) image))->format = PixelFormat24bppRGB; + break; + case 32: + (*((GpBitmap**) image))->format = PixelFormat32bppRGB; + break; + case 48: + (*((GpBitmap**) image))->format = PixelFormat48bppRGB; + break; + default: + FIXME("Bit depth %d is not fully supported yet\n", bmch->bcBitCount); + (*((GpBitmap**) image))->format = (bmch->bcBitCount << 8) | PixelFormatGDI; + break; + } + GdipFree(pbmi); } else if(type == PICTYPE_METAFILE || type == PICTYPE_ENHMETAFILE){

1 0

Hans Leidekker : wininet: Send a content length header for all verbs other than GET.
by Alexandre Julliard Jan. 15, 2009

Jan. 15, 2009

Module: wine Branch: master Commit: 1c07d94ddcb2cd46a06a14dcf553bfaf0454fe1f URL: http://source.winehq.org/git/wine.git/?a=commit;h=1c07d94ddcb2cd46a06a14dcf… Author: Hans Leidekker <hans(a)codeweavers.com> Date: Wed Jan 14 16:20:11 2009 +0100 wininet: Send a content length header for all verbs other than GET. --- dlls/wininet/http.c | 2 +- dlls/wininet/tests/http.c | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/dlls/wininet/http.c b/dlls/wininet/http.c index cdcf8e1..a5352e4 100644 --- a/dlls/wininet/http.c +++ b/dlls/wininet/http.c @@ -3236,7 +3236,7 @@ BOOL WINAPI HTTP_HttpSendRequestW(LPWININETHTTPREQW lpwhr, LPCWSTR lpszHeaders, if (!lpwhr->lpszVerb) lpwhr->lpszVerb = WININET_strdupW(szGET); - if (dwContentLength || !strcmpW(lpwhr->lpszVerb, szPost)) + if (dwContentLength || strcmpW(lpwhr->lpszVerb, szGET)) { sprintfW(contentLengthStr, szContentLength, dwContentLength); HTTP_HttpAddRequestHeadersW(lpwhr, contentLengthStr, -1L, HTTP_ADDREQ_FLAG_ADD_IF_NEW); diff --git a/dlls/wininet/tests/http.c b/dlls/wininet/tests/http.c index 34f4708..19eb982 100644 --- a/dlls/wininet/tests/http.c +++ b/dlls/wininet/tests/http.c @@ -1408,7 +1408,9 @@ static DWORD CALLBACK server_thread(LPVOID param) else send(c, notokmsg, sizeof notokmsg-1, 0); } - if (strstr(buffer, "POST /test5")) + if (strstr(buffer, "POST /test5") || + strstr(buffer, "RPC_IN_DATA /test5") || + strstr(buffer, "RPC_OUT_DATA /test5")) { if (strstr(buffer, "Content-Length: 0")) { @@ -2013,6 +2015,8 @@ static void test_http_connection(void) test_proxy_direct(si.port); test_header_handling_order(si.port); test_basic_request(si.port, "POST", "/test5"); + test_basic_request(si.port, "RPC_IN_DATA", "/test5"); + test_basic_request(si.port, "RPC_OUT_DATA", "/test5"); test_basic_request(si.port, "GET", "/test6"); test_connection_header(si.port); test_http1_1(si.port);

1 0

Alexandre Julliard : ntdll: Check buffer for access in NtRead/ WriteVirtualMemory.
by Alexandre Julliard Jan. 15, 2009

Jan. 15, 2009

Module: wine Branch: master Commit: 858a7efdd40e21895bd6b0e6f2954563fc729039 URL: http://source.winehq.org/git/wine.git/?a=commit;h=858a7efdd40e21895bd6b0e6f… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Wed Jan 14 20:36:27 2009 +0100 ntdll: Check buffer for access in NtRead/WriteVirtualMemory. This also triggers page faults needed for DIB section access and write watches. --- dlls/ntdll/virtual.c | 40 ++++++++++++++++++++++++++++------------ 1 files changed, 28 insertions(+), 12 deletions(-) diff --git a/dlls/ntdll/virtual.c b/dlls/ntdll/virtual.c index 74e72fd..16e1e50 100644 --- a/dlls/ntdll/virtual.c +++ b/dlls/ntdll/virtual.c @@ -2615,14 +2615,22 @@ NTSTATUS WINAPI NtReadVirtualMemory( HANDLE process, const void *addr, void *buf { NTSTATUS status; - SERVER_START_REQ( read_process_memory ) + if (virtual_check_buffer_for_write( buffer, size )) { - req->handle = wine_server_obj_handle( process ); - req->addr = wine_server_client_ptr( addr ); - wine_server_set_reply( req, buffer, size ); - if ((status = wine_server_call( req ))) size = 0; + SERVER_START_REQ( read_process_memory ) + { + req->handle = wine_server_obj_handle( process ); + req->addr = wine_server_client_ptr( addr ); + wine_server_set_reply( req, buffer, size ); + if ((status = wine_server_call( req ))) size = 0; + } + SERVER_END_REQ; + } + else + { + status = STATUS_ACCESS_VIOLATION; + size = 0; } - SERVER_END_REQ; if (bytes_read) *bytes_read = size; return status; } @@ -2637,14 +2645,22 @@ NTSTATUS WINAPI NtWriteVirtualMemory( HANDLE process, void *addr, const void *bu { NTSTATUS status; - SERVER_START_REQ( write_process_memory ) + if (virtual_check_buffer_for_read( buffer, size )) { - req->handle = wine_server_obj_handle( process ); - req->addr = wine_server_client_ptr( addr ); - wine_server_add_data( req, buffer, size ); - if ((status = wine_server_call( req ))) size = 0; + SERVER_START_REQ( write_process_memory ) + { + req->handle = wine_server_obj_handle( process ); + req->addr = wine_server_client_ptr( addr ); + wine_server_add_data( req, buffer, size ); + if ((status = wine_server_call( req ))) size = 0; + } + SERVER_END_REQ; + } + else + { + status = STATUS_PARTIAL_COPY; + size = 0; } - SERVER_END_REQ; if (bytes_written) *bytes_written = size; return status; }

1 0

Alexandre Julliard : kernel32/tests: Add test cases for reading/ writing process memory from an invalid buffer address.
by Alexandre Julliard Jan. 15, 2009

Jan. 15, 2009

Module: wine Branch: master Commit: 31fd0663936d3b6228a45f326f9221fc1fe9054f URL: http://source.winehq.org/git/wine.git/?a=commit;h=31fd0663936d3b6228a45f326… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Wed Jan 14 20:36:42 2009 +0100 kernel32/tests: Add test cases for reading/writing process memory from an invalid buffer address. --- dlls/kernel32/tests/virtual.c | 37 +++++++++++++++++++++++++++++++++---- 1 files changed, 33 insertions(+), 4 deletions(-) diff --git a/dlls/kernel32/tests/virtual.c b/dlls/kernel32/tests/virtual.c index 6990543..ae812cd 100644 --- a/dlls/kernel32/tests/virtual.c +++ b/dlls/kernel32/tests/virtual.c @@ -84,8 +84,8 @@ static void test_VirtualAllocEx(void) return; } - src = HeapAlloc( GetProcessHeap(), 0, alloc_size ); - dst = HeapAlloc( GetProcessHeap(), 0, alloc_size ); + src = VirtualAlloc( NULL, alloc_size, MEM_COMMIT, PAGE_READWRITE ); + dst = VirtualAlloc( NULL, alloc_size, MEM_COMMIT, PAGE_READWRITE ); for (i = 0; i < alloc_size; i++) src[i] = i & 0xff; @@ -96,11 +96,40 @@ static void test_VirtualAllocEx(void) b = ReadProcessMemory(hProcess, addr1, dst, alloc_size, &bytes_read); ok(b && (bytes_read == alloc_size), "%lu bytes read\n", bytes_read); ok(!memcmp(src, dst, alloc_size), "Data from remote process differs\n"); + + /* test invalid source buffers */ + + b = VirtualProtect( src + 0x2000, 0x2000, PAGE_NOACCESS, &old_prot ); + ok( b, "VirtualProtect failed error %u\n", GetLastError() ); + b = WriteProcessMemory(hProcess, addr1, src, alloc_size, &bytes_written); + ok( !b, "WriteProcessMemory succeeded\n" ); + ok( GetLastError() == ERROR_NOACCESS || + GetLastError() == ERROR_PARTIAL_COPY, /* vista */ + "wrong error %u\n", GetLastError() ); + ok( bytes_written == 0, "%lu bytes written\n", bytes_written ); + b = ReadProcessMemory(hProcess, addr1, src, alloc_size, &bytes_read); + ok( !b, "ReadProcessMemory succeeded\n" ); + ok( GetLastError() == ERROR_NOACCESS, "wrong error %u\n", GetLastError() ); + ok( bytes_read == 0, "%lu bytes written\n", bytes_read ); + + b = VirtualProtect( src, 0x2000, PAGE_NOACCESS, &old_prot ); + ok( b, "VirtualProtect failed error %u\n", GetLastError() ); + b = WriteProcessMemory(hProcess, addr1, src, alloc_size, &bytes_written); + ok( !b, "WriteProcessMemory succeeded\n" ); + ok( GetLastError() == ERROR_NOACCESS || + GetLastError() == ERROR_PARTIAL_COPY, /* vista */ + "wrong error %u\n", GetLastError() ); + ok( bytes_written == 0, "%lu bytes written\n", bytes_written ); + b = ReadProcessMemory(hProcess, addr1, src, alloc_size, &bytes_read); + ok( !b, "ReadProcessMemory succeeded\n" ); + ok( GetLastError() == ERROR_NOACCESS, "wrong error %u\n", GetLastError() ); + ok( bytes_read == 0, "%lu bytes written\n", bytes_read ); + b = pVirtualFreeEx(hProcess, addr1, 0, MEM_RELEASE); ok(b != 0, "VirtualFreeEx, error %u\n", GetLastError()); - HeapFree( GetProcessHeap(), 0, src ); - HeapFree( GetProcessHeap(), 0, dst ); + VirtualFree( src, 0, MEM_FREE ); + VirtualFree( dst, 0, MEM_FREE ); /* * The following tests parallel those in test_VirtualAlloc()

1 0

Alexandre Julliard : kernel32: Remove the DIB section hack in WriteFile now that NtWriteFile takes care of it .
by Alexandre Julliard Jan. 15, 2009

Jan. 15, 2009

Module: wine Branch: master Commit: e016d2ec5e38a4128840d5444225a2ecfaead5de URL: http://source.winehq.org/git/wine.git/?a=commit;h=e016d2ec5e38a4128840d5444… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Wed Jan 14 20:20:14 2009 +0100 kernel32: Remove the DIB section hack in WriteFile now that NtWriteFile takes care of it. --- dlls/kernel32/file.c | 10 ---------- 1 files changed, 0 insertions(+), 10 deletions(-) diff --git a/dlls/kernel32/file.c b/dlls/kernel32/file.c index 608a539..92dbedf 100644 --- a/dlls/kernel32/file.c +++ b/dlls/kernel32/file.c @@ -560,16 +560,6 @@ BOOL WINAPI WriteFile( HANDLE hFile, LPCVOID buffer, DWORD bytesToWrite, status = NtWriteFile(hFile, hEvent, NULL, cvalue, piosb, buffer, bytesToWrite, poffset, NULL); - /* FIXME: NtWriteFile does not always cause page faults, generate them now */ - if (status == STATUS_INVALID_USER_BUFFER && !IsBadReadPtr( buffer, bytesToWrite )) - { - status = NtWriteFile(hFile, hEvent, NULL, cvalue, piosb, - buffer, bytesToWrite, poffset, NULL); - if (status != STATUS_INVALID_USER_BUFFER) - FIXME("Could not access memory (%p,%d) at first, now OK. Protected by DIBSection code?\n", - buffer, bytesToWrite); - } - if (status == STATUS_PENDING && !overlapped) { WaitForSingleObject( hFile, INFINITE );

1 0

Alexandre Julliard : gdi32/tests: Add a test case for calling WriteFile with the DIB section bits as buffer.
by Alexandre Julliard Jan. 15, 2009

Jan. 15, 2009

Module: wine Branch: master Commit: d2b217e90a3222506605037263fd57222c639543 URL: http://source.winehq.org/git/wine.git/?a=commit;h=d2b217e90a322250660503726… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Wed Jan 14 20:19:42 2009 +0100 gdi32/tests: Add a test case for calling WriteFile with the DIB section bits as buffer. --- dlls/gdi32/tests/bitmap.c | 58 +++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 58 insertions(+), 0 deletions(-) diff --git a/dlls/gdi32/tests/bitmap.c b/dlls/gdi32/tests/bitmap.c index 3f8a674..b4dc09e 100644 --- a/dlls/gdi32/tests/bitmap.c +++ b/dlls/gdi32/tests/bitmap.c @@ -396,6 +396,62 @@ static void test_dib_info(HBITMAP hbm, const void *bits, const BITMAPINFOHEADER test_color_todo(c, exp, GetPixel, todo_getp); \ } +static void test_dib_bits_access( HBITMAP hdib, void *bits ) +{ + MEMORY_BASIC_INFORMATION info; + char bmibuf[sizeof(BITMAPINFO) + 256 * sizeof(RGBQUAD)]; + DWORD data[256]; + BITMAPINFO *pbmi = (BITMAPINFO *)bmibuf; + HDC hdc = GetDC(0); + char filename[MAX_PATH]; + HANDLE file; + DWORD written; + INT ret; + + ok(VirtualQuery(bits, &info, sizeof(info)) == sizeof(info), + "VirtualQuery failed\n"); + ok(info.BaseAddress == bits, "%p != %p\n", info.BaseAddress, bits); + ok(info.AllocationBase == bits, "%p != %p\n", info.AllocationBase, bits); + ok(info.AllocationProtect == PAGE_READWRITE, "%x != PAGE_READWRITE\n", info.AllocationProtect); + ok(info.State == MEM_COMMIT, "%x != MEM_COMMIT\n", info.State); + ok(info.Protect == PAGE_READWRITE, "%x != PAGE_READWRITE\n", info.Protect); + ok(info.Type == MEM_PRIVATE, "%x != MEM_PRIVATE\n", info.Type); + + memset( pbmi, 0, sizeof(bmibuf) ); + memset( data, 0xcc, sizeof(data) ); + pbmi->bmiHeader.biSize = sizeof(pbmi->bmiHeader); + pbmi->bmiHeader.biHeight = 16; + pbmi->bmiHeader.biWidth = 16; + pbmi->bmiHeader.biBitCount = 32; + pbmi->bmiHeader.biPlanes = 1; + pbmi->bmiHeader.biCompression = BI_RGB; + + ret = SetDIBits( hdc, hdib, 0, 16, data, pbmi, DIB_RGB_COLORS ); + ok( ret == 16, "SetDIBits failed\n" ); + + ok(VirtualQuery(bits, &info, sizeof(info)) == sizeof(info), + "VirtualQuery failed\n"); + ok(info.BaseAddress == bits, "%p != %p\n", info.BaseAddress, bits); + ok(info.AllocationBase == bits, "%p != %p\n", info.AllocationBase, bits); + ok(info.AllocationProtect == PAGE_READWRITE, "%x != PAGE_READWRITE\n", info.AllocationProtect); + ok(info.State == MEM_COMMIT, "%x != MEM_COMMIT\n", info.State); + ok(info.Type == MEM_PRIVATE, "%x != MEM_PRIVATE\n", info.Type); + /* it has been protected now */ + todo_wine ok(info.Protect == PAGE_READWRITE, "%x != PAGE_READWRITE\n", info.Protect); + + /* try writing protected bits to a file */ + + GetTempFileNameA( ".", "dib", 0, filename ); + file = CreateFileA( filename, GENERIC_WRITE, FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, + CREATE_ALWAYS, 0, 0 ); + ok( file != INVALID_HANDLE_VALUE, "failed to open %s error %u\n", filename, GetLastError() ); + ret = WriteFile( file, bits, 8192, &written, NULL ); + ok( ret, "WriteFile failed error %u\n", GetLastError() ); + if (ret) ok( written == 8192, "only wrote %u bytes\n", written ); + CloseHandle( file ); + DeleteFileA( filename ); +} + static void test_dibsections(void) { HDC hdc, hdcmem, hdcmem2; @@ -455,6 +511,8 @@ static void test_dibsections(void) ok(info.Protect == PAGE_READWRITE, "%x != PAGE_READWRITE\n", info.Protect); ok(info.Type == MEM_PRIVATE, "%x != MEM_PRIVATE\n", info.Type); + test_dib_bits_access( hdib, bits ); + test_dib_info(hdib, bits, &pbmi->bmiHeader); DeleteObject(hdib);

1 0

Alexandre Julliard : kernel32/tests: Add test cases for reading/ writing from an invalid buffer address.
by Alexandre Julliard Jan. 15, 2009

Jan. 15, 2009

Module: wine Branch: master Commit: 8de57bd541c3aec98ef68ae3e5d8b4d4d431d0b1 URL: http://source.winehq.org/git/wine.git/?a=commit;h=8de57bd541c3aec98ef68ae3e… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Wed Jan 14 20:18:29 2009 +0100 kernel32/tests: Add test cases for reading/writing from an invalid buffer address. --- dlls/kernel32/tests/file.c | 92 +++++++++++++++++++++++++++++++++++++++++++- 1 files changed, 91 insertions(+), 1 deletions(-) diff --git a/dlls/kernel32/tests/file.c b/dlls/kernel32/tests/file.c index abbb413..ed893fc 100644 --- a/dlls/kernel32/tests/file.c +++ b/dlls/kernel32/tests/file.c @@ -1673,10 +1673,11 @@ static void test_async_file_errors(void) static void test_read_write(void) { - DWORD bytes, ret; + DWORD bytes, ret, old_prot; HANDLE hFile; char temp_path[MAX_PATH]; char filename[MAX_PATH]; + char *mem; static const char prefix[] = "pfx"; ret = GetTempPathA(MAX_PATH, temp_path); @@ -1726,6 +1727,95 @@ static void test_read_write(void) "ret = %d, error %d\n", ret, GetLastError()); ok(!bytes, "bytes = %d\n", bytes); + /* test passing protected memory as buffer */ + + mem = VirtualAlloc( NULL, 0x4000, MEM_COMMIT, PAGE_READWRITE ); + ok( mem != NULL, "failed to allocate virtual mem error %u\n", GetLastError() ); + + ret = WriteFile( hFile, mem, 0x4000, &bytes, NULL ); + ok( ret, "WriteFile failed error %u\n", GetLastError() ); + ok( bytes == 0x4000, "only wrote %x bytes\n", bytes ); + + ret = VirtualProtect( mem + 0x2000, 0x2000, PAGE_NOACCESS, &old_prot ); + ok( ret, "VirtualProtect failed error %u\n", GetLastError() ); + + ret = WriteFile( hFile, mem, 0x4000, &bytes, NULL ); + ok( !ret, "WriteFile succeeded\n" ); + ok( GetLastError() == ERROR_INVALID_USER_BUFFER || + GetLastError() == ERROR_INVALID_PARAMETER, /* win9x */ + "wrong error %u\n", GetLastError() ); + ok( bytes == 0, "wrote %x bytes\n", bytes ); + + ret = WriteFile( (HANDLE)0xdead, mem, 0x4000, &bytes, NULL ); + ok( !ret, "WriteFile succeeded\n" ); + ok( GetLastError() == ERROR_INVALID_HANDLE || /* handle is checked before buffer on NT */ + GetLastError() == ERROR_INVALID_PARAMETER, /* win9x */ + "wrong error %u\n", GetLastError() ); + ok( bytes == 0, "wrote %x bytes\n", bytes ); + + ret = VirtualProtect( mem, 0x2000, PAGE_NOACCESS, &old_prot ); + ok( ret, "VirtualProtect failed error %u\n", GetLastError() ); + + ret = WriteFile( hFile, mem, 0x4000, &bytes, NULL ); + ok( !ret, "WriteFile succeeded\n" ); + ok( GetLastError() == ERROR_INVALID_USER_BUFFER || + GetLastError() == ERROR_INVALID_PARAMETER, /* win9x */ + "wrong error %u\n", GetLastError() ); + ok( bytes == 0, "wrote %x bytes\n", bytes ); + + SetFilePointer( hFile, 0, NULL, FILE_BEGIN ); + + ret = ReadFile( hFile, mem, 0x4000, &bytes, NULL ); + ok( !ret, "ReadFile succeeded\n" ); + ok( GetLastError() == ERROR_NOACCESS || + GetLastError() == ERROR_INVALID_PARAMETER, /* win9x */ + "wrong error %u\n", GetLastError() ); + ok( bytes == 0, "read %x bytes\n", bytes ); + + ret = VirtualProtect( mem, 0x2000, PAGE_READONLY, &old_prot ); + ok( ret, "VirtualProtect failed error %u\n", GetLastError() ); + + ret = ReadFile( hFile, mem, 0x4000, &bytes, NULL ); + ok( !ret, "ReadFile succeeded\n" ); + ok( GetLastError() == ERROR_NOACCESS || + GetLastError() == ERROR_INVALID_PARAMETER, /* win9x */ + "wrong error %u\n", GetLastError() ); + ok( bytes == 0, "read %x bytes\n", bytes ); + + ret = VirtualProtect( mem, 0x2000, PAGE_READWRITE, &old_prot ); + ok( ret, "VirtualProtect failed error %u\n", GetLastError() ); + + ret = ReadFile( hFile, mem, 0x4000, &bytes, NULL ); + ok( !ret, "ReadFile succeeded\n" ); + ok( GetLastError() == ERROR_NOACCESS || + GetLastError() == ERROR_INVALID_PARAMETER, /* win9x */ + "wrong error %u\n", GetLastError() ); + ok( bytes == 0, "read %x bytes\n", bytes ); + + SetFilePointer( hFile, 0x1234, NULL, FILE_BEGIN ); + SetEndOfFile( hFile ); + SetFilePointer( hFile, 0, NULL, FILE_BEGIN ); + + ret = ReadFile( hFile, mem, 0x4000, &bytes, NULL ); + ok( !ret, "ReadFile succeeded\n" ); + ok( GetLastError() == ERROR_NOACCESS || + GetLastError() == ERROR_INVALID_PARAMETER, /* win9x */ + "wrong error %u\n", GetLastError() ); + ok( bytes == 0, "read %x bytes\n", bytes ); + + ret = ReadFile( hFile, mem, 0x2000, &bytes, NULL ); + ok( ret, "ReadFile failed error %u\n", GetLastError() ); + ok( bytes == 0x1234, "read %x bytes\n", bytes ); + + ret = ReadFile( hFile, NULL, 1, &bytes, NULL ); + ok( !ret, "ReadFile succeeded\n" ); + ok( GetLastError() == ERROR_NOACCESS || + GetLastError() == ERROR_INVALID_PARAMETER, /* win9x */ + "wrong error %u\n", GetLastError() ); + ok( bytes == 0, "read %x bytes\n", bytes ); + + VirtualFree( mem, 0, MEM_FREE ); + ret = CloseHandle(hFile); ok( ret, "CloseHandle: error %d\n", GetLastError()); ret = DeleteFileA(filename);

1 0

Alexandre Julliard : ntdll: Check buffer for access in NtReadFile before performing I/O.
by Alexandre Julliard Jan. 15, 2009

Jan. 15, 2009

Module: wine Branch: master Commit: 63bff0937f949379193b6d3b87b03edeaaf77d52 URL: http://source.winehq.org/git/wine.git/?a=commit;h=63bff0937f949379193b6d3b8… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Wed Jan 14 20:17:52 2009 +0100 ntdll: Check buffer for access in NtReadFile before performing I/O. This also triggers page faults needed for write watches. --- dlls/ntdll/file.c | 15 +++++++++------ dlls/ntdll/ntdll_misc.h | 1 + dlls/ntdll/virtual.c | 33 +++++++++++++++++++++++++++++++++ 3 files changed, 43 insertions(+), 6 deletions(-) diff --git a/dlls/ntdll/file.c b/dlls/ntdll/file.c index 60aec8a..cbb0eac 100644 --- a/dlls/ntdll/file.c +++ b/dlls/ntdll/file.c @@ -568,6 +568,12 @@ NTSTATUS WINAPI NtReadFile(HANDLE hFile, HANDLE hEvent, &needs_close, &type, &options ); if (status) return status; + if (!virtual_check_buffer_for_write( buffer, length )) + { + status = STATUS_ACCESS_VIOLATION; + goto done; + } + if (type == FD_TYPE_FILE && offset && offset->QuadPart != (LONGLONG)-2 /* FILE_USE_FILE_POINTER_POSITION */ ) { /* async I/O doesn't make sense on regular files */ @@ -615,14 +621,11 @@ NTSTATUS WINAPI NtReadFile(HANDLE hFile, HANDLE hEvent, } else if (type == FD_TYPE_FILE) continue; /* no async I/O on regular files */ } - else + else if (errno != EAGAIN) { if (errno == EINTR) continue; - if (errno != EAGAIN) - { - status = FILE_GetNtStatus(); - goto done; - } + if (!total) status = FILE_GetNtStatus(); + goto done; } if (!(options & (FILE_SYNCHRONOUS_IO_ALERT | FILE_SYNCHRONOUS_IO_NONALERT))) diff --git a/dlls/ntdll/ntdll_misc.h b/dlls/ntdll/ntdll_misc.h index 2fcdb1a..306b36d 100644 --- a/dlls/ntdll/ntdll_misc.h +++ b/dlls/ntdll/ntdll_misc.h @@ -142,6 +142,7 @@ extern void virtual_clear_thread_stack(void); extern BOOL virtual_handle_stack_fault( void *addr ); extern NTSTATUS virtual_handle_fault( LPCVOID addr, DWORD err ); extern BOOL virtual_check_buffer_for_read( const void *ptr, SIZE_T size ); +extern BOOL virtual_check_buffer_for_write( void *ptr, SIZE_T size ); extern void VIRTUAL_SetForceExec( BOOL enable ); extern void VIRTUAL_UseLargeAddressSpace(void); extern struct _KUSER_SHARED_DATA *user_shared_data; diff --git a/dlls/ntdll/virtual.c b/dlls/ntdll/virtual.c index 33c946f..74e72fd 100644 --- a/dlls/ntdll/virtual.c +++ b/dlls/ntdll/virtual.c @@ -1551,6 +1551,39 @@ BOOL virtual_check_buffer_for_read( const void *ptr, SIZE_T size ) /*********************************************************************** + * virtual_check_buffer_for_write + * + * Check if a memory buffer can be written to, triggering page faults if needed for write watches. + */ +BOOL virtual_check_buffer_for_write( void *ptr, SIZE_T size ) +{ + if (!size) return TRUE; + if (!ptr) return FALSE; + + __TRY + { + volatile char *p = ptr; + SIZE_T count = size; + + while (count > page_size) + { + *p |= 0; + p += page_size; + count -= page_size; + } + p[0] |= 0; + p[count - 1] |= 0; + } + __EXCEPT_PAGE_FAULT + { + return FALSE; + } + __ENDTRY + return TRUE; +} + + +/*********************************************************************** * VIRTUAL_SetForceExec * * Whether to force exec prot on all views.

1 0