Re: [PATCH 2/2] ntdll: Improve invalid paramater handling in NtAccessCheck.

[Nikolay Sivov]

On 16.02.2016 0:10, Sebastian Lackner wrote:
> > diff --git a/dlls/ntdll/sec.c b/dlls/ntdll/sec.c
> > index 125c86e..c32ae0c 100644
> > --- a/dlls/ntdll/sec.c
> > +++ b/dlls/ntdll/sec.c
> > @@ -1586,7 +1586,16 @@ NtAccessCheck(
> >          SecurityDescriptor, ClientToken, DesiredAccess, GenericMapping,
> >          PrivilegeSet, ReturnLength, GrantedAccess, AccessStatus);
> > - if (!PrivilegeSet || !ReturnLength)
> > - if (!ReturnLength)
> > -
> >    return STATUS_ACCESS_VIOLATION;
> > -
> > - if (*ReturnLength == 0)
> > - {
> > -
> >    *ReturnLength = sizeof(PRIVILEGE_SET);
> > -
> >    return STATUS_BUFFER_TOO_SMALL;
> > - }
>
> This looks a bit hacky. The code below assumes that *ReturnLength > FIELD_OFFSET( PRIVILEGE_SET, Privilege ),
> so it would be interesting to know what happens for sizes 0 ... 8.
> > -
> > -
> >
> > if (!PrivilegeSet)
> >     return STATUS_ACCESS_VIOLATION;
> >
> > SERVER_START_REQ( access_check )

Also it would be interesting to have same tests that call NtAccessCheck
directly.