From 2d9edcdec1783928c587f74295e96b026b3d4c94 Mon Sep 17 00:00:00 2001 From: Aleksey Bragin Date: Thu, 25 Aug 2011 22:25:25 +0000 Subject: [PATCH] [NTDLL/LDR] - Fix wrong loop condition which would often lead to heap underread. - Fix wrong subkey string length calculation, which would result in an incorrect string being used to open an image specific key. - Don't close the key handle in LdrQueryImageFileKeyOption() because it's used more than once and closed after it's not needed anymore. - Use Zw* functions instead of Nt* where necessary in LdrQueryImageFileKeyOption(). - Per-image execution options work now (e.g. enabling DPH). svn path=/trunk/; revision=53446 --- reactos/dll/ntdll/ldr/ldrinit.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/reactos/dll/ntdll/ldr/ldrinit.c b/reactos/dll/ntdll/ldr/ldrinit.c index a39ad0c3181..ba8292a5d72 100644 --- a/reactos/dll/ntdll/ldr/ldrinit.c +++ b/reactos/dll/ntdll/ldr/ldrinit.c @@ -144,14 +144,14 @@ LdrOpenImageFileOptionsKey(IN PUNICODE_STRING SubKey, /* Extract the name */ SubKeyString = *SubKey; p1 = (PWCHAR)((ULONG_PTR)SubKeyString.Buffer + SubKeyString.Length); - while (SubKey->Length) + while (SubKeyString.Length) { if (p1[-1] == L'\\') break; p1--; SubKeyString.Length -= sizeof(*p1); } SubKeyString.Buffer = p1; - SubKeyString.Length = SubKeyString.MaximumLength - SubKeyString.Length - sizeof(WCHAR); + SubKeyString.Length = SubKey->Length - SubKeyString.Length; /* Setup the object attributes */ InitializeObjectAttributes(&ObjectAttributes, @@ -192,7 +192,7 @@ LdrQueryImageFileKeyOption(IN HKEY KeyHandle, if (!NT_SUCCESS(Status)) return Status; /* Query the value */ - Status = NtQueryValueKey(KeyHandle, + Status = ZwQueryValueKey(KeyHandle, &ValueNameString, KeyValuePartialInformation, KeyValueInformation, @@ -213,7 +213,7 @@ LdrQueryImageFileKeyOption(IN HKEY KeyHandle, } /* Try again */ - Status = NtQueryValueKey(KeyHandle, + Status = ZwQueryValueKey(KeyHandle, &ValueNameString, KeyValuePartialInformation, KeyValueInformation, @@ -326,8 +326,7 @@ LdrQueryImageFileKeyOption(IN HKEY KeyHandle, /* Check if buffer was in heap */ if (FreeHeap) RtlFreeHeap(RtlGetProcessHeap(), 0, KeyValueInformation); - /* Close key and return */ - NtClose(KeyHandle); + /* Return status */ return Status; }