[PATCH v3 2/2] server: Don't crash when opening null path with a console server as RootDirectory.

[Jinoh Kang]

From: Jinoh Kang

Fixes: 5f0d268fffc741171fcf9006012c310128846de5
---
 dlls/kernel32/tests/console.c | 36 +++++++++++++++++++++++++++++++++++
 server/console.c              |  6 ++++++
 2 files changed, 42 insertions(+)

diff --git a/dlls/kernel32/tests/console.c b/dlls/kernel32/tests/console.c
index fa56f53d722..94d02a9ece3 100644
--- a/dlls/kernel32/tests/console.c
+++ b/dlls/kernel32/tests/console.c
@@ -4522,6 +4522,41 @@ static void test_console_as_root_directory(void)
     CloseHandle( handle );
 }

+static void test_condrv_server_as_root_directory(void)
+{
+    OBJECT_ATTRIBUTES attr;
+    IO_STATUS_BLOCK iosb;
+    UNICODE_STRING name;
+    HANDLE handle, h2;
+    NTSTATUS status;
+
+    FreeConsole();
+
+    RtlInitUnicodeString( &name, L"\Device\ConDrv\Server" );
+    InitializeObjectAttributes( &attr, &name, 0, NULL, NULL );
+    status = NtCreateFile( &handle, SYNCHRONIZE, &attr, &iosb, NULL, 0,
+                           FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                           FILE_OPEN, 0, NULL, 0 );
+    ok( !status || broken( status == STATUS_OBJECT_PATH_NOT_FOUND ) /* Win7 */,
+        "NtCreateFile returned %#lx\n", status );
+
+    if (status)
+    {
+        win_skip( "cannot open \Device\ConDrv\Server, skipping RootDirectory test" );
+    }
+    else
+    {
+        RtlInitUnicodeString( &name, L"" );
+        InitializeObjectAttributes( &attr, &name, 0, handle, NULL );
+        status = NtCreateFile( &h2, SYNCHRONIZE, &attr, &iosb, NULL, 0,
+                               FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                               FILE_OPEN, 0, NULL, 0 );
+        ok( status == STATUS_NOT_FOUND, "NtCreateFile returned %#lx\n", status );
+
+        CloseHandle( handle );
+    }
+}
+
 static void test_AttachConsole_child(DWORD console_pid)
 {
     HANDLE pipe_in, pipe_out;
@@ -5581,6 +5616,7 @@ START_TEST(console)
         test_AttachConsole(hConOut);
         test_AllocConsole();
         test_FreeConsole();
+        test_condrv_server_as_root_directory();
         test_CreateProcessCUI();
         test_CtrlHandlerSubsystem();
     }
diff --git a/server/console.c b/server/console.c
index bef48c205ed..c3e7bf57e92 100644
--- a/server/console.c
+++ b/server/console.c
@@ -887,6 +887,12 @@ static struct object *console_server_lookup_name( struct object *obj, struct uni
     static const WCHAR referenceW[] = {'R','e','f','e','r','e','n','c','e'};
     assert( obj->ops == &console_server_ops );

+    if (!name)
+    {
+        set_error( STATUS_NOT_FOUND );
+        return NULL;
+    }
+
     if (name->len == sizeof(referenceW) && !memcmp( name->str, referenceW, name->len ))
     {
         struct screen_buffer *screen_buffer;