[PATCH v3 1/2] kernel32/tests: Fix stack overflow by DefineDosDeviceW().

[Xu Wei]

Signed-off-by: Xu Wei 
---
 dlls/kernel32/tests/volume.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/dlls/kernel32/tests/volume.c b/dlls/kernel32/tests/volume.c
index cb35de6add1..2fe8c1995cf 100644
--- a/dlls/kernel32/tests/volume.c
+++ b/dlls/kernel32/tests/volume.c
@@ -111,6 +111,7 @@ static void test_dos_devices(void)
 {
     char buf[MAX_PATH], buf2[400];
     char drivestr[3];
+    WCHAR drivestrW[3];
     HANDLE file;
     BOOL ret;

@@ -185,6 +186,21 @@ static void test_dos_devices(void)
     ret = QueryDosDeviceA( drivestr, buf, sizeof(buf) );
     ok(!ret, "expected failure\n");
     ok(GetLastError() == ERROR_FILE_NOT_FOUND, "got error %u\n", GetLastError());
+
+    SetLastError(0);
+    ret = DefineDosDeviceW( DDD_RAW_TARGET_PATH, drivestrW, NULL );
+    ok(!ret, "expected failure\n");
+    ok(GetLastError() == ERROR_INVALID_PARAMETER, "got error %u\n", GetLastError());
+
+    SetLastError(0);
+    ret = DefineDosDeviceW( DDD_RAW_TARGET_PATH, NULL, drivestrW );
+    ok(ret, "got error %u\n", GetLastError());
+
+    SetLastError(0);
+    DefineDosDeviceW( DDD_EXACT_MATCH_ON_REMOVE|DDD_RAW_TARGET_PATH|DDD_REMOVE_DEFINITION,
+            "{00000001-0000-0000-0000-4E6574446576}",
+            "\Device\{00000001-0000-0000-0000-4E6574446576}" );
+    ok(ret, "got error %u\n", GetLastError());
 }

static void test_FindFirstVolume(void)

[PATCH v3 2/2] kernelbase: Fix stack overflow by DefineDosDeviceW().

[Xu Wei]

Signed-off-by: Xu Wei 
---
 dlls/kernelbase/volume.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/dlls/kernelbase/volume.c b/dlls/kernelbase/volume.c
index d513dda1f9d..be68721020e 100644
--- a/dlls/kernelbase/volume.c
+++ b/dlls/kernelbase/volume.c
@@ -384,7 +384,7 @@ err_ret:
  */
 BOOL WINAPI DECLSPEC_HOTPATCH DefineDosDeviceW( DWORD flags, const WCHAR *device, const WCHAR *target )
 {
-    WCHAR link_name[15] = L"\DosDevices\";
+    WCHAR *link_name = NULL;
     UNICODE_STRING nt_name, nt_target;
     OBJECT_ATTRIBUTES attr;
     NTSTATUS status;
@@ -395,17 +395,28 @@ BOOL WINAPI DECLSPEC_HOTPATCH DefineDosDeviceW( DWORD flags, const WCHAR *device
     if (flags & ~(DDD_RAW_TARGET_PATH | DDD_REMOVE_DEFINITION))
         FIXME("Ignoring flags %#x.\n", flags & ~(DDD_RAW_TARGET_PATH | DDD_REMOVE_DEFINITION));

-    lstrcatW( link_name, device );
+    if (!(link_name = HeapAlloc( GetProcessHeap(), 0, sizeof(L"\DosDevices\") + (device ? lstrlenW(device) * sizeof(WCHAR) : 0))))
+    {
+        SetLastError(ERROR_OUTOFMEMORY);
+        return FALSE;
+    }
+
+    lstrcpyW( link_name, L"\DosDevices\" );
+    if (device) lstrcatW( link_name, device );
     RtlInitUnicodeString( &nt_name, link_name );
     InitializeObjectAttributes( &attr, &nt_name, OBJ_CASE_INSENSITIVE | OBJ_PERMANENT, 0, NULL );
     if (flags & DDD_REMOVE_DEFINITION)
     {
         if (!set_ntstatus( NtOpenSymbolicLinkObject( &handle, 0, &attr ) ))
+        {
+            HeapFree( GetProcessHeap(), 0, link_name );
             return FALSE;
+        }

status = NtMakeTemporaryObject( handle );
         NtClose( handle );

+        HeapFree( GetProcessHeap(), 0, link_name );
         return set_ntstatus( status );
     }

@@ -414,6 +425,7 @@ BOOL WINAPI DECLSPEC_HOTPATCH DefineDosDeviceW( DWORD flags, const WCHAR *device
         if (!RtlDosPathNameToNtPathName_U( target, &nt_target, NULL, NULL))
         {
             SetLastError( ERROR_PATH_NOT_FOUND );
+            HeapFree( GetProcessHeap(), 0, link_name );
             return FALSE;
         }
     }
@@ -422,6 +434,7 @@ BOOL WINAPI DECLSPEC_HOTPATCH DefineDosDeviceW( DWORD flags, const WCHAR *device

if (!(status = NtCreateSymbolicLinkObject( &handle, SYMBOLIC_LINK_ALL_ACCESS, &attr, &nt_target )))
         NtClose( handle );
+    HeapFree( GetProcessHeap(), 0, link_name );
     return set_ntstatus( status );
 }

[Marvin]

Hi,

While running your changed tests, I think I found new failures.
Being a bot and all I'm not very good at pattern recognition, so I might be
wrong, but could you please double-check?

Full results can be found at:
https://testbot.winehq.org/JobDetails.pl?Key=97636

Your paranoid android.

=== debiant2 (32 bit report) ===

kernel32:
Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510).

=== debiant2 (32 bit Arabic:Morocco report) ===

kernel32:
Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510).

=== debiant2 (32 bit German report) ===

kernel32:
Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510).

=== debiant2 (32 bit French report) ===

kernel32:
Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510).

=== debiant2 (32 bit Hebrew:Israel report) ===

kernel32:
Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510).

=== debiant2 (32 bit Hindi:India report) ===

kernel32:
Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510).

=== debiant2 (32 bit Japanese:Japan report) ===

kernel32:
Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510).

=== debiant2 (32 bit Chinese:China report) ===

kernel32:
Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510).

=== debiant2 (32 bit WoW report) ===

kernel32:
Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x7b07c510).

=== debiant2 (64 bit WoW report) ===

kernel32:
Unhandled exception: page fault on read access to 0x00000000 in 64-bit code (0x000000007b077320).

[Jactry Zeng]

Hi,

On 9/9/21 4:45 PM, Xu Wei wrote:
> - DefineDosDeviceW( DDD_EXACT_MATCH_ON_REMOVE|DDD_RAW_TARGET_PATH|DDD_REMOVE_DEFINITION,
> -
>        "{00000001-0000-0000-0000-4E6574446576}",
> -
>        "\\Device\\{00000001-0000-0000-0000-4E6574446576}" );

You are passing char* into an unicode function.

Also in order to avoid the test crash on Linux testbot, you might want to reverse the order of your tests and your fix.