[PATCH v3 0/2] MR4392: server: Don't crash when opening null path with a console handle as RootDirectory.

[Jinoh Kang (＠iamahuman)]

Preparatory patch for revival of https://gitlab.winehq.org/wine/wine/-/merge_requests/498.

--
  v3: server: Don't crash when opening null path with a console server as RootDirectory.
      server: Don't crash when opening null path with a console handle as RootDirectory.

https://gitlab.winehq.org/wine/wine/-/merge_requests/4392

[PATCH v3 1/2] server: Don't crash when opening null path with a console handle as RootDirectory.

[Jinoh Kang]

From: Jinoh Kang

Fixes: 7364a4b07536c10331e6049bc098ca9dba9554e6
---
 dlls/kernel32/tests/console.c | 23 +++++++++++++++++++++++
 server/console.c              |  6 ++++++
 2 files changed, 29 insertions(+)

diff --git a/dlls/kernel32/tests/console.c b/dlls/kernel32/tests/console.c
index 54d1a80709b..fa56f53d722 100644
--- a/dlls/kernel32/tests/console.c
+++ b/dlls/kernel32/tests/console.c
@@ -4500,6 +4500,28 @@ static void test_file_info(HANDLE input, HANDLE output)
     ok(type == FILE_TYPE_CHAR, "GetFileType returned %lu\n", type);
 }

+static void test_console_as_root_directory(void)
+{
+    OBJECT_ATTRIBUTES attr;
+    IO_STATUS_BLOCK iosb;
+    UNICODE_STRING name;
+    HANDLE handle, h2;
+    NTSTATUS status;
+
+    handle = CreateFileA( "CON", GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, 0 );
+    ok( handle != INVALID_HANDLE_VALUE, "CreateFileA error %lu\n", GetLastError() );
+
+    RtlInitUnicodeString( &name, L"" );
+    InitializeObjectAttributes( &attr, &name, 0, handle, NULL );
+    status = NtCreateFile( &h2, SYNCHRONIZE, &attr, &iosb, NULL, 0,
+                           FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                           FILE_OPEN, 0, NULL, 0 );
+    ok( status == STATUS_NOT_FOUND || broken( status == STATUS_OBJECT_TYPE_MISMATCH ) /* Win7 */,
+        "NtCreateFile returned %#lx\n", status );
+
+    CloseHandle( handle );
+}
+
 static void test_AttachConsole_child(DWORD console_pid)
 {
     HANDLE pipe_in, pipe_out;
@@ -5552,6 +5574,7 @@ START_TEST(console)
     test_GetConsoleOriginalTitle();
     test_GetConsoleTitleA();
     test_GetConsoleTitleW();
+    test_console_as_root_directory();
     if (!test_current)
     {
         test_pseudo_console();
diff --git a/server/console.c b/server/console.c
index b64283baf4a..bef48c205ed 100644
--- a/server/console.c
+++ b/server/console.c
@@ -796,6 +796,12 @@ static struct object *console_lookup_name( struct object *obj, struct unicode_st
     static const WCHAR connectionW[]    = {'C','o','n','n','e','c','t','i','o','n'};
     assert( obj->ops == &console_ops );

+    if (!name)
+    {
+        set_error( STATUS_NOT_FOUND );
+        return NULL;
+    }
+
     if (name->len == sizeof(connectionW) && !memcmp( name->str, connectionW, name->len ))
     {
         name->len = 0;

[PATCH v3 2/2] server: Don't crash when opening null path with a console server as RootDirectory.

[Jinoh Kang]

From: Jinoh Kang

Fixes: 5f0d268fffc741171fcf9006012c310128846de5
---
 dlls/kernel32/tests/console.c | 36 +++++++++++++++++++++++++++++++++++
 server/console.c              |  6 ++++++
 2 files changed, 42 insertions(+)

diff --git a/dlls/kernel32/tests/console.c b/dlls/kernel32/tests/console.c
index fa56f53d722..94d02a9ece3 100644
--- a/dlls/kernel32/tests/console.c
+++ b/dlls/kernel32/tests/console.c
@@ -4522,6 +4522,41 @@ static void test_console_as_root_directory(void)
     CloseHandle( handle );
 }

+static void test_condrv_server_as_root_directory(void)
+{
+    OBJECT_ATTRIBUTES attr;
+    IO_STATUS_BLOCK iosb;
+    UNICODE_STRING name;
+    HANDLE handle, h2;
+    NTSTATUS status;
+
+    FreeConsole();
+
+    RtlInitUnicodeString( &name, L"\Device\ConDrv\Server" );
+    InitializeObjectAttributes( &attr, &name, 0, NULL, NULL );
+    status = NtCreateFile( &handle, SYNCHRONIZE, &attr, &iosb, NULL, 0,
+                           FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                           FILE_OPEN, 0, NULL, 0 );
+    ok( !status || broken( status == STATUS_OBJECT_PATH_NOT_FOUND ) /* Win7 */,
+        "NtCreateFile returned %#lx\n", status );
+
+    if (status)
+    {
+        win_skip( "cannot open \Device\ConDrv\Server, skipping RootDirectory test" );
+    }
+    else
+    {
+        RtlInitUnicodeString( &name, L"" );
+        InitializeObjectAttributes( &attr, &name, 0, handle, NULL );
+        status = NtCreateFile( &h2, SYNCHRONIZE, &attr, &iosb, NULL, 0,
+                               FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                               FILE_OPEN, 0, NULL, 0 );
+        ok( status == STATUS_NOT_FOUND, "NtCreateFile returned %#lx\n", status );
+
+        CloseHandle( handle );
+    }
+}
+
 static void test_AttachConsole_child(DWORD console_pid)
 {
     HANDLE pipe_in, pipe_out;
@@ -5581,6 +5616,7 @@ START_TEST(console)
         test_AttachConsole(hConOut);
         test_AllocConsole();
         test_FreeConsole();
+        test_condrv_server_as_root_directory();
         test_CreateProcessCUI();
         test_CtrlHandlerSubsystem();
     }
diff --git a/server/console.c b/server/console.c
index bef48c205ed..c3e7bf57e92 100644
--- a/server/console.c
+++ b/server/console.c
@@ -887,6 +887,12 @@ static struct object *console_server_lookup_name( struct object *obj, struct uni
     static const WCHAR referenceW[] = {'R','e','f','e','r','e','n','c','e'};
     assert( obj->ops == &console_server_ops );

+    if (!name)
+    {
+        set_error( STATUS_NOT_FOUND );
+        return NULL;
+    }
+
     if (name->len == sizeof(referenceW) && !memcmp( name->str, referenceW, name->len ))
     {
         struct screen_buffer *screen_buffer;

[PATCH v3 0/2] MR4392: server: Don't crash when opening null path with a console handle as RootDirectory. - approved

[Elizabeth Figura (＠zfigura)]

This merge request was approved by Elizabeth Figura.