The handler for IOCTL_MOUNTMGR_QUERY_DHCP_REQUEST_PARAMS allocates the return size on the stack and expects it to be valid after a call to dhcp_request. The current early exits from the dbus and Mac implementations do not always set it, sometimes resulting in using a garbage return size.
From: Tim Clem tclem@codeweavers.com
Also return STATUS_SUCCESS rather than 0 in early-out cases.
Signed-off-by: Tim Clem tclem@codeweavers.com --- dlls/mountmgr.sys/dbus.c | 3 ++- dlls/mountmgr.sys/diskarb.c | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/dlls/mountmgr.sys/dbus.c b/dlls/mountmgr.sys/dbus.c index 81c9f89d246..051f735b219 100644 --- a/dlls/mountmgr.sys/dbus.c +++ b/dlls/mountmgr.sys/dbus.c @@ -777,8 +777,9 @@ NTSTATUS dhcp_request( void *args ) ULONG ret = 0;
params->req->offset = params->req->size = 0; + *params->ret_size = 0;
- if (!(reply = dhcp4_config_option_request( params->unix_name, map_option(params->req->id), &value ))) return 0; + if (!(reply = dhcp4_config_option_request( params->unix_name, map_option(params->req->id), &value ))) return STATUS_SUCCESS;
switch (params->req->id) { diff --git a/dlls/mountmgr.sys/diskarb.c b/dlls/mountmgr.sys/diskarb.c index 462ff82c691..4bcd72c8916 100644 --- a/dlls/mountmgr.sys/diskarb.c +++ b/dlls/mountmgr.sys/diskarb.c @@ -293,18 +293,19 @@ NTSTATUS dhcp_request( void *args )
params->req->offset = 0; params->req->size = 0; + *params->ret_size = 0;
if (!service_id) return 0; if (!(dict = SCDynamicStoreCopyDHCPInfo( NULL, service_id ))) { CFRelease( service_id ); - return 0; + return STATUS_SUCCESS; } CFRelease( service_id ); if (!(value = DHCPInfoGetOptionData( dict, map_option(params->req->id) ))) { CFRelease( dict ); - return 0; + return STATUS_SUCCESS; } len = CFDataGetLength( value );