From 0f30e8163ed71585bb7df0b1c606f406b9a9296d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?George=20Bi=C8=99oc?= Date: Sun, 30 Nov 2025 19:05:56 +0100 Subject: [PATCH] [NTOS:PS] Annotate the Query/Set related functions with SAL2 - Annotate the functions in query.c file with SAL2 of which they weren't annotated before - Use _Out_writes_bytes_to_opt_ to further clarify the output parameter is being written to it based on the length size provided. This is so the code analyzer understands such a parameter is being written into only the specific amount of bytes. --- ntoskrnl/include/internal/ps.h | 4 ++-- ntoskrnl/ps/query.c | 38 ++++++++++++++++++++-------------- sdk/include/ndk/psfuncs.h | 8 ++++--- sdk/include/psdk/winternl.h | 6 ++++-- sdk/include/xdk/psfuncs.h | 11 +++++----- 5 files changed, 39 insertions(+), 28 deletions(-) diff --git a/ntoskrnl/include/internal/ps.h b/ntoskrnl/include/internal/ps.h index 5be13cfc632..b8440d488c1 100644 --- a/ntoskrnl/include/internal/ps.h +++ b/ntoskrnl/include/internal/ps.h @@ -144,8 +144,8 @@ PsChangeQuantumTable( NTSTATUS NTAPI PsReferenceProcessFilePointer( - IN PEPROCESS Process, - OUT PFILE_OBJECT *FileObject + _In_ PEPROCESS Process, + _Outptr_ PFILE_OBJECT *FileObject ); // diff --git a/ntoskrnl/ps/query.c b/ntoskrnl/ps/query.c index 4d788ddbd6f..257467a5d5b 100644 --- a/ntoskrnl/ps/query.c +++ b/ntoskrnl/ps/query.c @@ -21,8 +21,9 @@ ULONG PspTraceLevel = 0; NTSTATUS NTAPI -PsReferenceProcessFilePointer(IN PEPROCESS Process, - OUT PFILE_OBJECT *FileObject) +PsReferenceProcessFilePointer( + _In_ PEPROCESS Process, + _Outptr_ PFILE_OBJECT *FileObject) { PSECTION Section; PAGED_CODE(); @@ -210,7 +211,8 @@ NTAPI NtQueryInformationProcess( _In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, - _Out_ PVOID ProcessInformation, + _Out_writes_bytes_to_opt_(ProcessInformationLength, *ReturnLength) + PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength) { @@ -1384,10 +1386,11 @@ NtQueryInformationProcess( */ NTSTATUS NTAPI -NtSetInformationProcess(IN HANDLE ProcessHandle, - IN PROCESSINFOCLASS ProcessInformationClass, - IN PVOID ProcessInformation, - IN ULONG ProcessInformationLength) +NtSetInformationProcess( + _In_ HANDLE ProcessHandle, + _In_ PROCESSINFOCLASS ProcessInformationClass, + _In_reads_bytes_(ProcessInformationLength) PVOID ProcessInformation, + _In_ ULONG ProcessInformationLength) { PEPROCESS Process; KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); @@ -2302,10 +2305,11 @@ NtSetInformationProcess(IN HANDLE ProcessHandle, */ NTSTATUS NTAPI -NtSetInformationThread(IN HANDLE ThreadHandle, - IN THREADINFOCLASS ThreadInformationClass, - IN PVOID ThreadInformation, - IN ULONG ThreadInformationLength) +NtSetInformationThread( + _In_ HANDLE ThreadHandle, + _In_ THREADINFOCLASS ThreadInformationClass, + _In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation, + _In_ ULONG ThreadInformationLength) { PETHREAD Thread; KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); @@ -2914,11 +2918,13 @@ NtSetInformationThread(IN HANDLE ThreadHandle, */ NTSTATUS NTAPI -NtQueryInformationThread(IN HANDLE ThreadHandle, - IN THREADINFOCLASS ThreadInformationClass, - OUT PVOID ThreadInformation, - IN ULONG ThreadInformationLength, - OUT PULONG ReturnLength OPTIONAL) +NtQueryInformationThread( + _In_ HANDLE ThreadHandle, + _In_ THREADINFOCLASS ThreadInformationClass, + _Out_writes_bytes_to_opt_(ThreadInformationLength, *ReturnLength) + PVOID ThreadInformation, + _In_ ULONG ThreadInformationLength, + _Out_opt_ PULONG ReturnLength) { PETHREAD Thread; KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); diff --git a/sdk/include/ndk/psfuncs.h b/sdk/include/ndk/psfuncs.h index a4c0fdf690c..2d18f341be9 100644 --- a/sdk/include/ndk/psfuncs.h +++ b/sdk/include/ndk/psfuncs.h @@ -527,7 +527,8 @@ NTAPI NtQueryInformationProcess( _In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, - _Out_ PVOID ProcessInformation, + _Out_writes_bytes_to_opt_(ProcessInformationLength, *ReturnLength) + PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength ); @@ -539,7 +540,8 @@ NTAPI NtQueryInformationThread( _In_ HANDLE ThreadHandle, _In_ THREADINFOCLASS ThreadInformationClass, - _Out_ PVOID ThreadInformation, + _Out_writes_bytes_to_opt_(ThreadInformationLength, *ReturnLength) + PVOID ThreadInformation, _In_ ULONG ThreadInformationLength, _Out_opt_ PULONG ReturnLength ); @@ -582,7 +584,7 @@ NTAPI NtSetInformationProcess( _In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, - _In_ PVOID ProcessInformation, + _In_reads_bytes_(ProcessInformationLength) PVOID ProcessInformation, _In_ ULONG ProcessInformationLength ); diff --git a/sdk/include/psdk/winternl.h b/sdk/include/psdk/winternl.h index 9aba45ad762..d8c96ccbff7 100644 --- a/sdk/include/psdk/winternl.h +++ b/sdk/include/psdk/winternl.h @@ -416,7 +416,8 @@ NTAPI NtQueryInformationProcess( _In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, - _Out_ PVOID ProcessInformation, + _Out_writes_bytes_to_opt_(ProcessInformationLength, *ReturnLength) + PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength); @@ -432,7 +433,8 @@ NTAPI NtQueryInformationThread( _In_ HANDLE ThreadHandle, _In_ THREADINFOCLASS ThreadInformationClass, - _Out_ PVOID ThreadInformation, + _Out_writes_bytes_to_opt_(ThreadInformationLength, *ReturnLength) + PVOID ThreadInformation, _In_ ULONG ThreadInformationLength, _Out_opt_ PULONG ReturnLength); diff --git a/sdk/include/xdk/psfuncs.h b/sdk/include/xdk/psfuncs.h index b59dee4c96d..b2ecf7aac25 100644 --- a/sdk/include/xdk/psfuncs.h +++ b/sdk/include/xdk/psfuncs.h @@ -46,11 +46,12 @@ NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess( - _In_ HANDLE ProcessHandle, - _In_ PROCESSINFOCLASS ProcessInformationClass, - _Out_ PVOID ProcessInformation, - _In_ ULONG ProcessInformationLength, - _Out_opt_ PULONG ReturnLength); + _In_ HANDLE ProcessHandle, + _In_ PROCESSINFOCLASS ProcessInformationClass, + _Out_writes_bytes_to_opt_(ProcessInformationLength, *ReturnLength) + PVOID ProcessInformation, + _In_ ULONG ProcessInformationLength, + _Out_opt_ PULONG ReturnLength); $endif (_NTDDK_) $if (_NTIFS_)