[PATCH 0/1] MR4905: ntdll: Return dummy pointer from RtlQueryProcessDebugInformation stub.

[Bernhard Übelacker (＠bernhardu)]

Wine-bug: https://bugs.winehq.org/show_bug.cgi?id=56235

[PATCH 1/1] ntdll: Return dummy pointer from RtlQueryProcessDebugInformation stub.

[Bernhard Übelacker]

From: Bernhard Übelacker

This is to avoid crash in Process Explorer 17.05.

Wine-bug: https://bugs.winehq.org/show_bug.cgi?id=56235
---
 dlls/ntdll/debugbuffer.c | 2 +-
 dlls/ntdll/tests/rtl.c   | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/dlls/ntdll/debugbuffer.c b/dlls/ntdll/debugbuffer.c
index f073207ac06..ca0ac7db715 100644
--- a/dlls/ntdll/debugbuffer.c
+++ b/dlls/ntdll/debugbuffer.c
@@ -141,7 +141,7 @@ NTSTATUS WINAPI RtlQueryProcessDebugInformation(IN ULONG iProcessId, IN ULONG iD
      }
      iBuf->HeapInformation = info;
    }
-   if (iDebugInfoMask & PDI_LOCKS) {
+   if (iDebugInfoMask & PDI_LOCKS || iDebugInfoMask & PDI_MODULES) {
      PDEBUG_LOCK_INFORMATION info = RtlAllocateHeap(GetProcessHeap(), 0, sizeof(DEBUG_LOCK_INFORMATION));
      memset(info, 0, sizeof(DEBUG_LOCK_INFORMATION));
      iBuf->LockInformation = info;
diff --git a/dlls/ntdll/tests/rtl.c b/dlls/ntdll/tests/rtl.c
index 03c31d7bf6b..08c439c0b52 100644
--- a/dlls/ntdll/tests/rtl.c
+++ b/dlls/ntdll/tests/rtl.c
@@ -166,6 +166,13 @@ static void test_RtlQueryProcessDebugInformation(void)
     status = RtlQueryProcessDebugInformation( GetCurrentProcessId(), PDI_HEAPS | PDI_HEAP_BLOCKS, buffer );
     ok( !status, "RtlQueryProcessDebugInformation returned %lx\n", status );

+    ok( buffer->LockInformation == NULL, "unexpected buffer->LockInformation %p\n", buffer->LockInformation);
+    status = RtlQueryProcessDebugInformation( GetCurrentProcessId(), PDI_MODULES, buffer );
+    ok( !status, "RtlQueryProcessDebugInformation returned %lx\n", status );
+    ok( buffer->LockInformation != NULL ||
+        broken(sizeof(void*) == 4), /* windows 8 and below in 32-bit return NULL */
+        "unexpected buffer->LockInformation %p\n", buffer->LockInformation);
+
     status = RtlDestroyQueryDebugBuffer( buffer );
     ok( !status, "RtlDestroyQueryDebugBuffer returned %lx\n", status );
 }

[eric pouech (＠epo)]

this doesn't look well I'm afraid

I just tested from 64 bit Win10, and got some values for fields LockInformation, HeapInformation or ModuleInformation which don't look like pointers at all, yet being non zero

me thinks the structure is not correctly defined for 64 bit processes...
you need to fix that first (I may even believe this would sufficient for the process not to crash)

(note that native stores the extra information just after the DEBUG_BUFFER structure and updates the pointer accordingly)