wine-commits September 2020

wine-commits@winehq.org

1 participants
703 discussions

Robert Wilhelm : vbscript: Fix vanishing statements.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: fe59d1a5d35f4d0d9e2a262c25cbfefb91cdad3c URL: https://source.winehq.org/git/wine.git/?a=commit;h=fe59d1a5d35f4d0d9e2a262c… Author: Robert Wilhelm <robert.wilhelm(a)gmx.net> Date: Tue Sep 22 22:14:29 2020 +0200 vbscript: Fix vanishing statements. When adding multiple statements (e.g. colon separated SimpleStatements) in function source_add_statement(), tail of linked list was not adjusted. Signed-off-by: Robert Wilhelm <robert.wilhelm(a)gmx.net> Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/vbscript/parser.y | 5 +++++ dlls/vbscript/tests/lang.vbs | 3 +++ 2 files changed, 8 insertions(+) diff --git a/dlls/vbscript/parser.y b/dlls/vbscript/parser.y index 80f8699bd8..924d0b973b 100644 --- a/dlls/vbscript/parser.y +++ b/dlls/vbscript/parser.y @@ -516,12 +516,17 @@ static void source_add_statement(parser_ctx_t *ctx, statement_t *stat) if(!stat) return; + /* concatenate both linked lists */ if(ctx->stats) { ctx->stats_tail->next = stat; ctx->stats_tail = stat; }else { ctx->stats = ctx->stats_tail = stat; } + /* find new tail */ + while(ctx->stats_tail->next) { + ctx->stats_tail=ctx->stats_tail->next; + } } static void source_add_class(parser_ctx_t *ctx, class_decl_t *class_decl) diff --git a/dlls/vbscript/tests/lang.vbs b/dlls/vbscript/tests/lang.vbs index 621b390523..9f254f502b 100644 --- a/dlls/vbscript/tests/lang.vbs +++ b/dlls/vbscript/tests/lang.vbs @@ -67,6 +67,9 @@ Call ok(W = 5, "W = " & W & " expected " & 5) x = "xx" Call ok(x = "xx", "x = " & x & " expected ""xx""") +Dim public1 : public1 = 42 +Call ok(public1 = 42, "public1=" & public1 & " expected & " & 42) + Call ok(true <> false, "true <> false is false") Call ok(not (true <> true), "true <> true is true") Call ok(not ("x" <> "x"), """x"" <> ""x"" is true")

1 0

Zebediah Figura : kernelbase: Implement CreateRestrictedToken().
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 6946d78ed9e88536951357ae5574e251f0007006 URL: https://source.winehq.org/git/wine.git/?a=commit;h=6946d78ed9e88536951357ae… Author: Zebediah Figura <z.figura12(a)gmail.com> Date: Tue Sep 22 17:31:16 2020 -0500 kernelbase: Implement CreateRestrictedToken(). Based on a patch by Michael Müller. Signed-off-by: Zebediah Figura <z.figura12(a)gmail.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/advapi32/tests/security.c | 26 ++++++++++----------- dlls/kernelbase/security.c | 51 +++++++++++++++++++++++++++++------------- 2 files changed, 48 insertions(+), 29 deletions(-) diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c index 957ebc3036..6919ea64ce 100644 --- a/dlls/advapi32/tests/security.c +++ b/dlls/advapi32/tests/security.c @@ -5237,7 +5237,7 @@ static void test_CreateRestrictedToken(void) is_member = TRUE; ret = pCheckTokenMembership(r_token, removed_sid, &is_member); ok(ret, "got error %d\n", GetLastError()); - todo_wine ok(!is_member, "not a member\n"); + ok(!is_member, "not a member\n"); ret = GetTokenInformation(r_token, TokenGroups, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n", @@ -5251,8 +5251,8 @@ static void test_CreateRestrictedToken(void) if (EqualSid(groups2->Groups[i].Sid, removed_sid)) { DWORD attr = groups2->Groups[i].Attributes; - todo_wine ok(attr & SE_GROUP_USE_FOR_DENY_ONLY, "got wrong attributes %#x\n", attr); - todo_wine ok(!(attr & SE_GROUP_ENABLED), "got wrong attributes %#x\n", attr); + ok(attr & SE_GROUP_USE_FOR_DENY_ONLY, "got wrong attributes %#x\n", attr); + ok(!(attr & SE_GROUP_ENABLED), "got wrong attributes %#x\n", attr); break; } } @@ -5307,7 +5307,7 @@ static void test_CreateRestrictedToken(void) priv_set.Privilege[0].Attributes = 0; ret = PrivilegeCheck(r_token, &priv_set, &is_member); ok(ret, "got error %u\n", GetLastError()); - todo_wine ok(!is_member, "privilege should not be enabled\n"); + ok(!is_member, "privilege should not be enabled\n"); ret = GetTokenInformation(r_token, TokenPrivileges, privs, sizeof(privs_buffer), &size); ok(ret, "got error %u\n", GetLastError()); @@ -5318,7 +5318,7 @@ static void test_CreateRestrictedToken(void) if (!memcmp(&privs->Privileges[i].Luid, &luid, sizeof(luid))) is_member = TRUE; } - todo_wine ok(!is_member, "disabled privilege should not be present\n"); + ok(!is_member, "disabled privilege should not be present\n"); CloseHandle(r_token); @@ -7679,8 +7679,8 @@ static void test_duplicate_handle_access(void) SetLastError(0xdeadbeef); event2 = OpenEventA(EVENT_MODIFY_STATE, FALSE, "test_dup"); - todo_wine ok(!event2, "expected failure\n"); - todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + ok(!event2, "expected failure\n"); + ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); ret = DuplicateHandle(GetCurrentProcess(), all_event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); ok(ret, "got error %u\n", GetLastError()); @@ -7688,8 +7688,8 @@ static void test_duplicate_handle_access(void) SetLastError(0xdeadbeef); ret = DuplicateHandle(GetCurrentProcess(), sync_event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); - todo_wine ok(!ret, "expected failure\n"); - todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + ok(!ret, "expected failure\n"); + ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); ret = RevertToSelf(); ok(ret, "got error %u\n", GetLastError()); @@ -7751,13 +7751,13 @@ static void test_duplicate_handle_access_child(void) SetLastError(0xdeadbeef); ret = DuplicateHandle(process, event, process, &event2, EVENT_MODIFY_STATE, FALSE, 0); - todo_wine ok(!ret, "expected failure\n"); - todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + ok(!ret, "expected failure\n"); + ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); SetLastError(0xdeadbeef); ret = DuplicateHandle(process, event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); - todo_wine ok(!ret, "expected failure\n"); - todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + ok(!ret, "expected failure\n"); + ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); ret = RevertToSelf(); ok(ret, "failed to revert, error %u\n", GetLastError()); diff --git a/dlls/kernelbase/security.c b/dlls/kernelbase/security.c index 72bb5892d3..97943048b0 100644 --- a/dlls/kernelbase/security.c +++ b/dlls/kernelbase/security.c @@ -646,27 +646,46 @@ exit: * CreateRestrictedToken (kernelbase.@) */ BOOL WINAPI CreateRestrictedToken( HANDLE token, DWORD flags, - DWORD disable_count, PSID_AND_ATTRIBUTES disable_sids, - DWORD delete_count, PLUID_AND_ATTRIBUTES delete_privs, - DWORD restrict_count, PSID_AND_ATTRIBUTES restrict_sids, PHANDLE ret ) + DWORD disable_sid_count, SID_AND_ATTRIBUTES *disable_sids, + DWORD delete_priv_count, LUID_AND_ATTRIBUTES *delete_privs, + DWORD restrict_sid_count, SID_AND_ATTRIBUTES *restrict_sids, HANDLE *ret ) { - TOKEN_TYPE type; - SECURITY_IMPERSONATION_LEVEL level = SecurityAnonymous; - DWORD size; + TOKEN_PRIVILEGES *nt_privs = NULL; + TOKEN_GROUPS *nt_disable_sids = NULL, *nt_restrict_sids = NULL; + NTSTATUS status = STATUS_NO_MEMORY; - FIXME("(%p, 0x%x, %u, %p, %u, %p, %u, %p, %p): stub\n", - token, flags, disable_count, disable_sids, delete_count, delete_privs, - restrict_count, restrict_sids, ret ); + TRACE("token %p, flags %#x, disable_sids %u %p, delete_privs %u %p, restrict_sids %u %p, ret %p\n", + token, flags, disable_sid_count, disable_sids, delete_priv_count, delete_privs, + restrict_sid_count, restrict_sids, ret); - size = sizeof(type); - if (!GetTokenInformation( token, TokenType, &type, size, &size )) return FALSE; - if (type == TokenImpersonation) + if (disable_sid_count) { - size = sizeof(level); - if (!GetTokenInformation( token, TokenImpersonationLevel, &level, size, &size )) - return FALSE; + if (!(nt_disable_sids = heap_alloc( offsetof( TOKEN_GROUPS, Groups[disable_sid_count] ) ))) goto out; + nt_disable_sids->GroupCount = disable_sid_count; + memcpy( nt_disable_sids->Groups, disable_sids, disable_sid_count * sizeof(SID_AND_ATTRIBUTES) ); + } + + if (delete_priv_count) + { + if (!(nt_privs = heap_alloc( offsetof( TOKEN_GROUPS, Groups[delete_priv_count] ) ))) goto out; + nt_privs->PrivilegeCount = delete_priv_count; + memcpy( nt_privs->Privileges, delete_privs, delete_priv_count * sizeof(SID_AND_ATTRIBUTES) ); } - return DuplicateTokenEx( token, MAXIMUM_ALLOWED, NULL, level, type, ret ); + + if (restrict_sid_count) + { + if (!(nt_restrict_sids = heap_alloc( offsetof( TOKEN_GROUPS, Groups[restrict_sid_count] ) ))) goto out; + nt_restrict_sids->GroupCount = restrict_sid_count; + memcpy( nt_restrict_sids->Groups, restrict_sids, restrict_sid_count * sizeof(SID_AND_ATTRIBUTES) ); + } + + status = NtFilterToken(token, flags, nt_disable_sids, nt_privs, nt_restrict_sids, ret); + +out: + heap_free(nt_disable_sids); + heap_free(nt_privs); + heap_free(nt_restrict_sids); + return set_ntstatus( status ); } /******************************************************************************

1 0

Michael Müller : ntdll: Implement NtFilterToken.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 8c5638aa5e7cfcd5b2844853e744702331a85a17 URL: https://source.winehq.org/git/wine.git/?a=commit;h=8c5638aa5e7cfcd5b2844853… Author: Michael Müller <michael(a)fds-team.de> Date: Tue Sep 22 17:31:15 2020 -0500 ntdll: Implement NtFilterToken. Signed-off-by: Zebediah Figura <z.figura12(a)gmail.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/ntdll/ntdll.spec | 2 +- dlls/ntdll/unix/security.c | 63 ++++++++++++++++++++++++++++++++ include/wine/server_protocol.h | 21 ++++++++++- include/winnt.h | 5 +++ include/winternl.h | 1 + server/named_pipe.c | 2 +- server/process.c | 2 +- server/protocol.def | 10 ++++++ server/request.h | 8 +++++ server/security.h | 4 ++- server/token.c | 82 ++++++++++++++++++++++++++++++++++++++++-- server/trace.c | 17 +++++++++ 12 files changed, 210 insertions(+), 7 deletions(-) Diff: https://source.winehq.org/git/wine.git/?a=commitdiff;h=8c5638aa5e7cfcd5b284…

1 0

Zebediah Figura : advapi32/tests: Add more tests for CreateRestrictedToken().
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 67f7d6872b4e970e212f1ac4a51f21a3b8d00548 URL: https://source.winehq.org/git/wine.git/?a=commit;h=67f7d6872b4e970e212f1ac4… Author: Zebediah Figura <z.figura12(a)gmail.com> Date: Tue Sep 22 17:31:14 2020 -0500 advapi32/tests: Add more tests for CreateRestrictedToken(). Signed-off-by: Zebediah Figura <z.figura12(a)gmail.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/advapi32/tests/security.c | 150 +++++++++++++++++++++++++++-------------- 1 file changed, 98 insertions(+), 52 deletions(-) diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c index ae5531db80..957ebc3036 100644 --- a/dlls/advapi32/tests/security.c +++ b/dlls/advapi32/tests/security.c @@ -104,8 +104,6 @@ static DWORD (WINAPI *pSetSecurityInfo)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMA PSID, PSID, PACL, PACL); static NTSTATUS (WINAPI *pNtAccessCheck)(PSECURITY_DESCRIPTOR, HANDLE, ACCESS_MASK, PGENERIC_MAPPING, PPRIVILEGE_SET, PULONG, PULONG, NTSTATUS*); -static BOOL (WINAPI *pCreateRestrictedToken)(HANDLE, DWORD, DWORD, PSID_AND_ATTRIBUTES, DWORD, - PLUID_AND_ATTRIBUTES, DWORD, PSID_AND_ATTRIBUTES, PHANDLE); static NTSTATUS (WINAPI *pNtSetSecurityObject)(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR); static NTSTATUS (WINAPI *pNtCreateFile)(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG); static BOOL (WINAPI *pRtlDosPathNameToNtPathName_U)(LPCWSTR,PUNICODE_STRING,PWSTR*,CURDIR*); @@ -175,7 +173,6 @@ static void init(void) pSetEntriesInAclW = (void *)GetProcAddress(hmod, "SetEntriesInAclW"); pSetSecurityDescriptorControl = (void *)GetProcAddress(hmod, "SetSecurityDescriptorControl"); pSetSecurityInfo = (void *)GetProcAddress(hmod, "SetSecurityInfo"); - pCreateRestrictedToken = (void *)GetProcAddress(hmod, "CreateRestrictedToken"); pGetWindowsAccountDomainSid = (void *)GetProcAddress(hmod, "GetWindowsAccountDomainSid"); pEqualDomainSid = (void *)GetProcAddress(hmod, "EqualDomainSid"); pGetSidIdentifierAuthority = (void *)GetProcAddress(hmod, "GetSidIdentifierAuthority"); @@ -5188,19 +5185,19 @@ static void test_CreateRestrictedToken(void) { HANDLE process_token, token, r_token; PTOKEN_GROUPS token_groups, groups2; + LUID_AND_ATTRIBUTES lattr; SID_AND_ATTRIBUTES sattr; SECURITY_IMPERSONATION_LEVEL level; + SID *removed_sid = NULL; + char privs_buffer[1000]; + TOKEN_PRIVILEGES *privs = (TOKEN_PRIVILEGES *)privs_buffer; + PRIVILEGE_SET priv_set; TOKEN_TYPE type; BOOL is_member; DWORD size; + LUID luid; BOOL ret; - DWORD i, j; - - if (!pCreateRestrictedToken) - { - win_skip("CreateRestrictedToken is not available\n"); - return; - } + DWORD i; ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token); ok(ret, "got error %d\n", GetLastError()); @@ -5209,7 +5206,6 @@ static void test_CreateRestrictedToken(void) NULL, SecurityImpersonation, TokenImpersonation, &token); ok(ret, "got error %d\n", GetLastError()); - /* groups */ ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n", ret, GetLastError()); @@ -5220,70 +5216,120 @@ static void test_CreateRestrictedToken(void) for (i = 0; i < token_groups->GroupCount; i++) { if (token_groups->Groups[i].Attributes & SE_GROUP_ENABLED) + { + removed_sid = token_groups->Groups[i].Sid; break; + } } - - if (i == token_groups->GroupCount) - { - HeapFree(GetProcessHeap(), 0, token_groups); - CloseHandle(token); - skip("User not a member of any group\n"); - return; - } + ok(!!removed_sid, "user is not a member of any group\n"); is_member = FALSE; - ret = pCheckTokenMembership(token, token_groups->Groups[i].Sid, &is_member); + ret = pCheckTokenMembership(token, removed_sid, &is_member); ok(ret, "got error %d\n", GetLastError()); ok(is_member, "not a member\n"); - /* disable a SID in new token */ - sattr.Sid = token_groups->Groups[i].Sid; + sattr.Sid = removed_sid; sattr.Attributes = 0; r_token = NULL; - ret = pCreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token); + ret = CreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token); ok(ret, "got error %d\n", GetLastError()); - if (ret) + is_member = TRUE; + ret = pCheckTokenMembership(r_token, removed_sid, &is_member); + ok(ret, "got error %d\n", GetLastError()); + todo_wine ok(!is_member, "not a member\n"); + + ret = GetTokenInformation(r_token, TokenGroups, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n", + ret, GetLastError()); + groups2 = HeapAlloc(GetProcessHeap(), 0, size); + ret = GetTokenInformation(r_token, TokenGroups, groups2, size, &size); + ok(ret, "got error %d\n", GetLastError()); + + for (i = 0; i < groups2->GroupCount; i++) { - /* check if a SID is enabled */ - is_member = TRUE; - ret = pCheckTokenMembership(r_token, token_groups->Groups[i].Sid, &is_member); - ok(ret, "got error %d\n", GetLastError()); - todo_wine ok(!is_member, "not a member\n"); + if (EqualSid(groups2->Groups[i].Sid, removed_sid)) + { + DWORD attr = groups2->Groups[i].Attributes; + todo_wine ok(attr & SE_GROUP_USE_FOR_DENY_ONLY, "got wrong attributes %#x\n", attr); + todo_wine ok(!(attr & SE_GROUP_ENABLED), "got wrong attributes %#x\n", attr); + break; + } + } + + HeapFree(GetProcessHeap(), 0, groups2); - ret = GetTokenInformation(r_token, TokenGroups, NULL, 0, &size); - ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n", - ret, GetLastError()); - groups2 = HeapAlloc(GetProcessHeap(), 0, size); - ret = GetTokenInformation(r_token, TokenGroups, groups2, size, &size); - ok(ret, "got error %d\n", GetLastError()); + size = sizeof(type); + ret = GetTokenInformation(r_token, TokenType, &type, size, &size); + ok(ret, "got error %d\n", GetLastError()); + ok(type == TokenImpersonation, "got type %u\n", type); - for (j = 0; j < groups2->GroupCount; j++) + size = sizeof(level); + ret = GetTokenInformation(r_token, TokenImpersonationLevel, &level, size, &size); + ok(ret, "got error %d\n", GetLastError()); + ok(level == SecurityImpersonation, "got level %u\n", type); + + CloseHandle(r_token); + + r_token = NULL; + ret = CreateRestrictedToken(process_token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token); + ok(ret, "got error %u\n", GetLastError()); + + size = sizeof(type); + ret = GetTokenInformation(r_token, TokenType, &type, size, &size); + ok(ret, "got error %u\n", GetLastError()); + ok(type == TokenPrimary, "got type %u\n", type); + + CloseHandle(r_token); + + ret = GetTokenInformation(token, TokenPrivileges, privs, sizeof(privs_buffer), &size); + ok(ret, "got error %u\n", GetLastError()); + + for (i = 0; i < privs->PrivilegeCount; i++) + { + if (privs->Privileges[i].Attributes & SE_PRIVILEGE_ENABLED) { - if (EqualSid(groups2->Groups[j].Sid, token_groups->Groups[i].Sid)) - break; + luid = privs->Privileges[i].Luid; + break; } + } + ok(i < privs->PrivilegeCount, "user has no privileges\n"); - todo_wine ok(groups2->Groups[j].Attributes & SE_GROUP_USE_FOR_DENY_ONLY, - "got wrong attributes\n"); - todo_wine ok((groups2->Groups[j].Attributes & SE_GROUP_ENABLED) == 0, - "got wrong attributes\n"); + lattr.Luid = luid; + lattr.Attributes = 0; + r_token = NULL; + ret = CreateRestrictedToken(token, 0, 0, NULL, 1, &lattr, 0, NULL, &r_token); + ok(ret, "got error %u\n", GetLastError()); - HeapFree(GetProcessHeap(), 0, groups2); + priv_set.PrivilegeCount = 1; + priv_set.Control = 0; + priv_set.Privilege[0].Luid = luid; + priv_set.Privilege[0].Attributes = 0; + ret = PrivilegeCheck(r_token, &priv_set, &is_member); + ok(ret, "got error %u\n", GetLastError()); + todo_wine ok(!is_member, "privilege should not be enabled\n"); - size = sizeof(type); - ret = GetTokenInformation(r_token, TokenType, &type, size, &size); - ok(ret, "got error %d\n", GetLastError()); - ok(type == TokenImpersonation, "got type %u\n", type); + ret = GetTokenInformation(r_token, TokenPrivileges, privs, sizeof(privs_buffer), &size); + ok(ret, "got error %u\n", GetLastError()); - size = sizeof(level); - ret = GetTokenInformation(r_token, TokenImpersonationLevel, &level, size, &size); - ok(ret, "got error %d\n", GetLastError()); - ok(level == SecurityImpersonation, "got level %u\n", type); + is_member = FALSE; + for (i = 0; i < privs->PrivilegeCount; i++) + { + if (!memcmp(&privs->Privileges[i].Luid, &luid, sizeof(luid))) + is_member = TRUE; } + todo_wine ok(!is_member, "disabled privilege should not be present\n"); - HeapFree(GetProcessHeap(), 0, token_groups); CloseHandle(r_token); + + removed_sid->SubAuthority[0] = 0xdeadbeef; + lattr.Luid.LowPart = 0xdeadbeef; + r_token = NULL; + ret = CreateRestrictedToken(token, 0, 1, &sattr, 1, &lattr, 0, NULL, &r_token); + ok(ret, "got error %u\n", GetLastError()); + CloseHandle(r_token); + + HeapFree(GetProcessHeap(), 0, token_groups); CloseHandle(token); CloseHandle(process_token); }

1 0

Zebediah Figura : advapi32/tests: Test which tokens DuplicateHandle() validates access against.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 965ebac6c19c72c511d61cc44958a3b944d5ddbf URL: https://source.winehq.org/git/wine.git/?a=commit;h=965ebac6c19c72c511d61cc4… Author: Zebediah Figura <z.figura12(a)gmail.com> Date: Tue Sep 22 17:31:13 2020 -0500 advapi32/tests: Test which tokens DuplicateHandle() validates access against. Signed-off-by: Zebediah Figura <z.figura12(a)gmail.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/advapi32/tests/security.c | 195 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 194 insertions(+), 1 deletion(-) diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c index 825f845190..ae5531db80 100644 --- a/dlls/advapi32/tests/security.c +++ b/dlls/advapi32/tests/security.c @@ -7529,6 +7529,196 @@ static void test_EqualDomainSid(void) FreeSid(domainsid); } +static DWORD WINAPI duplicate_handle_access_thread(void *arg) +{ + HANDLE event = arg, event2; + BOOL ret; + + event2 = OpenEventA(SYNCHRONIZE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + event2 = OpenEventA(EVENT_MODIFY_STATE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + ret = DuplicateHandle(GetCurrentProcess(), event, GetCurrentProcess(), + &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + CloseHandle(event2); + + return 0; +} + +static void test_duplicate_handle_access(void) +{ + char acl_buffer[200], everyone_sid_buffer[100], local_sid_buffer[100], cmdline[300]; + HANDLE token, restricted, impersonation, all_event, sync_event, event2, thread; + SECURITY_ATTRIBUTES sa = {.nLength = sizeof(sa)}; + SID *everyone_sid = (SID *)everyone_sid_buffer; + SID *local_sid = (SID *)local_sid_buffer; + ACL *acl = (ACL *)acl_buffer; + SID_AND_ATTRIBUTES sid_attr; + SECURITY_DESCRIPTOR sd; + PROCESS_INFORMATION pi; + STARTUPINFOA si = {0}; + DWORD size; + BOOL ret; + + /* DuplicateHandle() validates access against the calling thread's token and + * the target process's token. It does *not* validate access against the + * calling process's token, even if the calling thread is not impersonating. + */ + + ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY, &token); + ok(ret, "got error %u\n", GetLastError()); + + size = sizeof(everyone_sid_buffer); + ret = CreateWellKnownSid(WinWorldSid, NULL, everyone_sid, &size); + ok(ret, "got error %u\n", GetLastError()); + size = sizeof(local_sid_buffer); + ret = CreateWellKnownSid(WinLocalSid, NULL, local_sid, &size); + ok(ret, "got error %u\n", GetLastError()); + + InitializeAcl(acl, sizeof(acl_buffer), ACL_REVISION); + ret = AddAccessAllowedAce(acl, ACL_REVISION, SYNCHRONIZE, everyone_sid); + ok(ret, "got error %u\n", GetLastError()); + InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION); + ret = AddAccessAllowedAce(acl, ACL_REVISION, EVENT_MODIFY_STATE, local_sid); + ok(ret, "got error %u\n", GetLastError()); + InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION); + ret = SetSecurityDescriptorDacl(&sd, TRUE, acl, FALSE); + ok(ret, "got error %u\n", GetLastError()); + sa.lpSecurityDescriptor = &sd; + + sid_attr.Sid = local_sid; + sid_attr.Attributes = 0; + ret = CreateRestrictedToken(token, 0, 1, &sid_attr, 0, NULL, 0, NULL, &restricted); + ok(ret, "got error %u\n", GetLastError()); + ret = DuplicateTokenEx(restricted, TOKEN_IMPERSONATE, NULL, + SecurityImpersonation, TokenImpersonation, &impersonation); + ok(ret, "got error %u\n", GetLastError()); + + all_event = CreateEventA(&sa, TRUE, TRUE, "test_dup"); + ok(!!all_event, "got error %u\n", GetLastError()); + sync_event = OpenEventA(SYNCHRONIZE, FALSE, "test_dup"); + ok(!!sync_event, "got error %u\n", GetLastError()); + + event2 = OpenEventA(SYNCHRONIZE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + event2 = OpenEventA(EVENT_MODIFY_STATE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + ret = DuplicateHandle(GetCurrentProcess(), all_event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + CloseHandle(event2); + + ret = DuplicateHandle(GetCurrentProcess(), sync_event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + CloseHandle(event2); + + ret = SetThreadToken(NULL, impersonation); + ok(ret, "got error %u\n", GetLastError()); + + thread = CreateThread(NULL, 0, duplicate_handle_access_thread, sync_event, 0, NULL); + ret = WaitForSingleObject(thread, 1000); + ok(!ret, "wait failed\n"); + + event2 = OpenEventA(SYNCHRONIZE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + SetLastError(0xdeadbeef); + event2 = OpenEventA(EVENT_MODIFY_STATE, FALSE, "test_dup"); + todo_wine ok(!event2, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = DuplicateHandle(GetCurrentProcess(), all_event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + CloseHandle(event2); + + SetLastError(0xdeadbeef); + ret = DuplicateHandle(GetCurrentProcess(), sync_event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + todo_wine ok(!ret, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = RevertToSelf(); + ok(ret, "got error %u\n", GetLastError()); + + sprintf(cmdline, "%s security duplicate %Iu %u %Iu", myARGV[0], + (ULONG_PTR)sync_event, GetCurrentProcessId(), (ULONG_PTR)impersonation ); + ret = CreateProcessAsUserA(restricted, NULL, cmdline, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi); + ok(ret, "got error %u\n", GetLastError()); + + ret = DuplicateHandle(GetCurrentProcess(), all_event, pi.hProcess, &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + + SetLastError(0xdeadbeef); + ret = DuplicateHandle(GetCurrentProcess(), sync_event, pi.hProcess, &event2, EVENT_MODIFY_STATE, FALSE, 0); + todo_wine ok(!ret, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = WaitForSingleObject(pi.hProcess, 1000); + ok(!ret, "wait failed\n"); + + CloseHandle(impersonation); + CloseHandle(restricted); + CloseHandle(token); + CloseHandle(sync_event); + CloseHandle(all_event); +} + +static void test_duplicate_handle_access_child(void) +{ + HANDLE event, event2, process, token; + BOOL ret; + + event = (HANDLE)(ULONG_PTR)_atoi64(myARGV[3]); + process = OpenProcess(PROCESS_DUP_HANDLE, FALSE, atoi(myARGV[4])); + ok(!!process, "failed to open process, error %u\n", GetLastError()); + + event2 = OpenEventA(SYNCHRONIZE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + SetLastError(0xdeadbeef); + event2 = OpenEventA(EVENT_MODIFY_STATE, FALSE, "test_dup"); + todo_wine ok(!event2, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = DuplicateHandle(process, event, process, &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + + SetLastError(0xdeadbeef); + ret = DuplicateHandle(process, event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + todo_wine ok(!ret, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = DuplicateHandle(process, (HANDLE)(ULONG_PTR)_atoi64(myARGV[5]), + GetCurrentProcess(), &token, 0, FALSE, DUPLICATE_SAME_ACCESS); + ok(ret, "failed to retrieve token, error %u\n", GetLastError()); + ret = SetThreadToken(NULL, token); + ok(ret, "failed to set thread token, error %u\n", GetLastError()); + + SetLastError(0xdeadbeef); + ret = DuplicateHandle(process, event, process, &event2, EVENT_MODIFY_STATE, FALSE, 0); + todo_wine ok(!ret, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + SetLastError(0xdeadbeef); + ret = DuplicateHandle(process, event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + todo_wine ok(!ret, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = RevertToSelf(); + ok(ret, "failed to revert, error %u\n", GetLastError()); + CloseHandle(token); + CloseHandle(process); +} + START_TEST(security) { init(); @@ -7538,8 +7728,10 @@ START_TEST(security) { if (!strcmp(myARGV[2], "test_token_sd")) test_child_token_sd(); - else + else if (!strcmp(myARGV[2], "test")) test_process_security_child(); + else if (!strcmp(myARGV[2], "duplicate")) + test_duplicate_handle_access_child(); return; } test_kernel_objects_security(); @@ -7585,6 +7777,7 @@ START_TEST(security) test_token_label(); test_GetExplicitEntriesFromAclW(); test_BuildSecurityDescriptorW(); + test_duplicate_handle_access(); /* Must be the last test, modifies process token */ test_token_security_descriptor();

1 0

Hans Leidekker : crypt32: Add support for CRYPT_MACHINE_KEYSET in PFXImportCertStore.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 547508e374b7e347488f8ce7a8fa40b333a79684 URL: https://source.winehq.org/git/wine.git/?a=commit;h=547508e374b7e347488f8ce7… Author: Hans Leidekker <hans(a)codeweavers.com> Date: Wed Sep 23 12:07:57 2020 +0200 crypt32: Add support for CRYPT_MACHINE_KEYSET in PFXImportCertStore. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=49857 Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/crypt32/pfx.c | 15 +++++++++------ dlls/crypt32/tests/store.c | 10 ++++++++++ 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/dlls/crypt32/pfx.c b/dlls/crypt32/pfx.c index 3f38ae5056..80e6a3d017 100644 --- a/dlls/crypt32/pfx.c +++ b/dlls/crypt32/pfx.c @@ -138,7 +138,7 @@ static HCRYPTPROV import_key( gnutls_x509_privkey_t key, DWORD flags ) HCRYPTPROV prov = 0; HCRYPTKEY cryptkey; BYTE *buf, *src, *dst; - DWORD size; + DWORD size, acquire_flags; if ((ret = pgnutls_x509_privkey_get_pk_algorithm2( key, &bitlen )) < 0) { @@ -208,17 +208,20 @@ static HCRYPTPROV import_key( gnutls_x509_privkey_t key, DWORD flags ) else src = d.data; for (i = bitlen / 8 - 1; i >= 0; i--) *dst++ = src[i]; - if (!CryptAcquireContextW( &prov, NULL, MS_ENHANCED_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET )) + acquire_flags = (flags & CRYPT_MACHINE_KEYSET) | CRYPT_NEWKEYSET; + if (!CryptAcquireContextW( &prov, NULL, MS_ENHANCED_PROV_W, PROV_RSA_FULL, acquire_flags )) { if (GetLastError() != NTE_EXISTS) goto done; - if (!CryptAcquireContextW( &prov, NULL, MS_ENHANCED_PROV_W, PROV_RSA_FULL, 0 )) + + acquire_flags &= ~CRYPT_NEWKEYSET; + if (!CryptAcquireContextW( &prov, NULL, MS_ENHANCED_PROV_W, PROV_RSA_FULL, acquire_flags )) { WARN( "CryptAcquireContextW failed %08x\n", GetLastError() ); goto done; } } - if (!CryptImportKey( prov, buf, size, 0, flags, &cryptkey )) + if (!CryptImportKey( prov, buf, size, 0, flags & CRYPT_EXPORTABLE, &cryptkey )) { WARN( "CryptImportKey failed %08x\n", GetLastError() ); CryptReleaseContext( prov, 0 ); @@ -346,7 +349,7 @@ HCERTSTORE WINAPI PFXImportCertStore( CRYPT_DATA_BLOB *pfx, const WCHAR *passwor SetLastError( ERROR_INVALID_PARAMETER ); return NULL; } - if (flags & ~(CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY)) + if (flags & ~(CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|CRYPT_MACHINE_KEYSET|PKCS12_NO_PERSIST_KEY)) { FIXME( "flags %08x not supported\n", flags ); return NULL; @@ -373,7 +376,7 @@ HCERTSTORE WINAPI PFXImportCertStore( CRYPT_DATA_BLOB *pfx, const WCHAR *passwor goto error; } - if (!(prov = import_key( key, flags & CRYPT_EXPORTABLE ))) goto error; + if (!(prov = import_key( key, flags ))) goto error; if (!(store = CertOpenStore( CERT_STORE_PROV_MEMORY, 0, 0, 0, NULL ))) { WARN( "CertOpenStore failed %08x\n", GetLastError() ); diff --git a/dlls/crypt32/tests/store.c b/dlls/crypt32/tests/store.c index b2d5c7cb7e..46c9102686 100644 --- a/dlls/crypt32/tests/store.c +++ b/dlls/crypt32/tests/store.c @@ -3348,6 +3348,16 @@ static void test_PFXImportCertStore(void) ok(ret, "got %u\n", GetLastError()); CertFreeCertificateContext( cert ); CertCloseStore( store, 0 ); + + /* CRYPT_MACHINE_KEYSET */ + store = PFXImportCertStore( &pfx, NULL, CRYPT_MACHINE_KEYSET ); + ok( store != NULL, "got %u\n", GetLastError() ); + + cert = CertFindCertificateInStore( store, X509_ASN_ENCODING, 0, CERT_FIND_ANY, NULL, NULL ); + ok( cert != NULL, "got %08x\n", GetLastError() ); + + CertFreeCertificateContext( cert ); + CertCloseStore( store, 0 ); } static void test_CryptQueryObject(void)

1 0

Pengpeng Dong : conhost: Validate width param in write_output.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: b9f1ec8c44ebe62b4005d4ea2cfd63f700ea8a17 URL: https://source.winehq.org/git/wine.git/?a=commit;h=b9f1ec8c44ebe62b4005d4ea… Author: Pengpeng Dong <dongpengpeng(a)uniontech.com> Date: Wed Sep 23 15:04:39 2020 +0200 conhost: Validate width param in write_output. Signed-off-by: Pengpeng Dong <dongpengpeng(a)uniontech.com> Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- programs/conhost/conhost.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/programs/conhost/conhost.c b/programs/conhost/conhost.c index 79cbb8e83a..ed52838528 100644 --- a/programs/conhost/conhost.c +++ b/programs/conhost/conhost.c @@ -1984,6 +1984,8 @@ static NTSTATUS write_output( struct screen_buffer *screen_buffer, const struct char_info_t *dest; char *src; + if (*out_size == sizeof(SMALL_RECT) && !params->width) return STATUS_INVALID_PARAMETER; + entry_size = params->mode == CHAR_INFO_MODE_TEXTATTR ? sizeof(char_info_t) : sizeof(WCHAR); entry_cnt = (in_size - sizeof(*params)) / entry_size;

1 0

Haidong Yu : conhost: Input should be restored and input_thread handle should be closed before return.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: d22e82196496cb6d7f26b984b95409678a76c602 URL: https://source.winehq.org/git/wine.git/?a=commit;h=d22e82196496cb6d7f26b984… Author: Haidong Yu <yuhaidong(a)uniontech.com> Date: Wed Sep 23 09:31:43 2020 +0800 conhost: Input should be restored and input_thread handle should be closed before return. Signed-off-by: Haidong Yu <yuhaidong(a)uniontech.com> Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- programs/conhost/conhost.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/programs/conhost/conhost.c b/programs/conhost/conhost.c index a775e74961..79cbb8e83a 100644 --- a/programs/conhost/conhost.c +++ b/programs/conhost/conhost.c @@ -1652,7 +1652,7 @@ static DWORD WINAPI tty_input( void *param ) { case 3: /* end of text */ LeaveCriticalSection( &console_section ); - return 0; + goto done; case '\n': key_press( console, '\n', VK_RETURN, LEFT_CTRL_PRESSED ); break; @@ -1681,6 +1681,7 @@ static DWORD WINAPI tty_input( void *param ) TRACE( "NtReadFile failed: %#x\n", status ); +done: EnterCriticalSection( &console_section ); if (console->read_ioctl) read_complete( console, status, NULL, 0, FALSE ); if (console->is_unix)

1 0

Georg Lehmann : winevulkan: Forward declare required structs for function pointer.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: d4b162509f7d1408f933eabde3956fc8df3f86cd URL: https://source.winehq.org/git/wine.git/?a=commit;h=d4b162509f7d1408f933eabd… Author: Georg Lehmann <dadschoorse(a)gmail.com> Date: Tue Sep 22 16:31:49 2020 +0200 winevulkan: Forward declare required structs for function pointer. Signed-off-by: Georg Lehmann <dadschoorse(a)gmail.com> Signed-off-by: Liam Middlebrook <lmiddlebrook(a)nvidia.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/winevulkan/make_vulkan | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/dlls/winevulkan/make_vulkan b/dlls/winevulkan/make_vulkan index 070d112e6e..2cddb161d6 100755 --- a/dlls/winevulkan/make_vulkan +++ b/dlls/winevulkan/make_vulkan @@ -805,11 +805,12 @@ class VkFunction(object): class VkFunctionPointer(object): - def __init__(self, _type, name, members): + def __init__(self, _type, name, members, forward_decls): self.name = name self.members = members self.type = _type self.required = False + self.forward_decls = forward_decls @staticmethod def from_xml(funcpointer): @@ -846,10 +847,19 @@ class VkFunctionPointer(object): _type = funcpointer.text name = funcpointer.find("name").text - return VkFunctionPointer(_type, name, members) + if "requires" in funcpointer.attrib: + forward_decls = funcpointer.attrib.get("requires").split(",") + else: + forward_decls = [] + return VkFunctionPointer(_type, name, members, forward_decls) def definition(self): - text = "{0} {1})(\n".format(self.type, self.name) + text = "" + # forward declare required structs + for decl in self.forward_decls: + text += "typedef struct {0} {0};\n".format(decl) + + text += "{0} {1})(\n".format(self.type, self.name) first = True if len(self.members) > 0:

1 0

Georg Lehmann : winevulkan: Add is_alias for VkFunctionPointer.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 51b3191cd38704f8d7e8ae5662105a73df715145 URL: https://source.winehq.org/git/wine.git/?a=commit;h=51b3191cd38704f8d7e8ae56… Author: Georg Lehmann <dadschoorse(a)gmail.com> Date: Tue Sep 22 16:31:48 2020 +0200 winevulkan: Add is_alias for VkFunctionPointer. Signed-off-by: Georg Lehmann <dadschoorse(a)gmail.com> Signed-off-by: Liam Middlebrook <lmiddlebrook(a)nvidia.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/winevulkan/make_vulkan | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dlls/winevulkan/make_vulkan b/dlls/winevulkan/make_vulkan index 1f9bdc156c..070d112e6e 100755 --- a/dlls/winevulkan/make_vulkan +++ b/dlls/winevulkan/make_vulkan @@ -865,6 +865,8 @@ class VkFunctionPointer(object): text += ");\n" return text + def is_alias(self): + return False class VkHandle(object): def __init__(self, name, _type, parent, alias=None):

1 0

← Newer
1
...
17
18
19
20
21
22
23
...
71
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

wine-commits September 2020