From 07cd3fc8d01bf54cae482de7900dbb4296248e04 Mon Sep 17 00:00:00 2001
From: Aleksey Bragin <aleksey@reactos.org>
Date: Tue, 26 Oct 2010 21:34:52 +0000
Subject: [PATCH] [NTOS/MM] - Don't lie about page protection in
 MiQueryAddressState. Fixes PDFCreator-alike bugs. See issue #5627 for more
 details.

svn path=/trunk/; revision=49296
---
 reactos/ntoskrnl/mm/ARM3/virtual.c | 48 ++++++++++++++++++++++++++++--
 1 file changed, 45 insertions(+), 3 deletions(-)

diff --git a/reactos/ntoskrnl/mm/ARM3/virtual.c b/reactos/ntoskrnl/mm/ARM3/virtual.c
index c681f0626b9..09fb2dfa0c7 100644
--- a/reactos/ntoskrnl/mm/ARM3/virtual.c
+++ b/reactos/ntoskrnl/mm/ARM3/virtual.c
@@ -1048,6 +1048,48 @@ MmFlushVirtualMemory(IN PEPROCESS Process,
     return STATUS_SUCCESS;
 }
 
+ULONG
+NTAPI
+MiGetPageProtection(IN PMMPTE PointerPte)
+{
+    MMPTE TempPte;
+    PMMPFN Pfn;
+    PAGED_CODE();
+
+    /* Copy this PTE's contents */
+    TempPte = *PointerPte;
+
+    /* Assure it's not totally zero */
+    ASSERT(TempPte.u.Long);
+
+    /* Check for a special prototype format */
+    if (TempPte.u.Soft.Valid == 0 &&
+        TempPte.u.Soft.Prototype == 1)
+    {
+        /* Unsupported now */
+        UNIMPLEMENTED;
+        ASSERT(FALSE);
+    }
+
+    /* In the easy case of transition or demand zero PTE just return its protection */
+    if (!TempPte.u.Hard.Valid) return MmProtectToValue[TempPte.u.Soft.Protection];
+
+    /* If we get here, the PTE is valid, so look up the page in PFN database */
+    Pfn = &MmPfnDatabase[TempPte.u.Hard.PageFrameNumber];
+
+    if (!Pfn->u3.e1.PrototypePte)
+    {
+        /* Return protection of the original pte */
+        return MmProtectToValue[Pfn->OriginalPte.u.Soft.Protection];
+    }
+
+    /* This is hardware PTE */
+    UNIMPLEMENTED;
+    ASSERT(FALSE);
+
+    return PAGE_NOACCESS;
+}
+
 ULONG
 NTAPI
 MiQueryAddressState(IN PVOID Va,
@@ -1119,9 +1161,9 @@ MiQueryAddressState(IN PVOID Va,
             {
                 /* This means it's committed */
                 State = MEM_COMMIT;
-                
-                /* For now, we lie about the protection */
-                Protect = PAGE_EXECUTE_READWRITE;
+
+                /* Get protection state of this page */
+                Protect = MiGetPageProtection(PointerPte);
             }
             else
             {