diff --git a/reactos/win32ss/user/winsrv/consrv/condrv/console.c b/reactos/win32ss/user/winsrv/consrv/condrv/console.c index 861c4721f74..0c4cb6ac9ec 100644 --- a/reactos/win32ss/user/winsrv/consrv/condrv/console.c +++ b/reactos/win32ss/user/winsrv/consrv/condrv/console.c @@ -143,9 +143,13 @@ static NTSTATUS RemoveConsoleByHandle(IN HANDLE Handle) { NTSTATUS Status = STATUS_SUCCESS; - ULONG Index = HandleToULong(Handle) >> 2; PCONSOLE Console; + BOOLEAN ValidHandle = ((HandleToULong(Handle) & 0x3) == 0x3); + ULONG Index = HandleToULong(Handle) >> 2; + + if (!ValidHandle) return STATUS_INVALID_HANDLE; + ASSERT( (ConsoleList == NULL && ConsoleListSize == 0) || (ConsoleList != NULL && ConsoleListSize != 0) ); @@ -339,10 +343,13 @@ ConDrvValidateConsole(OUT PCONSOLE* Console, IN BOOLEAN LockConsole) { BOOLEAN RetVal = FALSE; - - ULONG Index = HandleToULong(ConsoleHandle) >> 2; PCONSOLE ValidatedConsole; + BOOLEAN ValidHandle = ((HandleToULong(ConsoleHandle) & 0x3) == 0x3); + ULONG Index = HandleToULong(ConsoleHandle) >> 2; + + if (!ValidHandle) return FALSE; + if (!Console) return FALSE; *Console = NULL; diff --git a/reactos/win32ss/user/winsrv/consrv/console.c b/reactos/win32ss/user/winsrv/consrv/console.c index 9403daa081f..932d623ff21 100644 --- a/reactos/win32ss/user/winsrv/consrv/console.c +++ b/reactos/win32ss/user/winsrv/consrv/console.c @@ -159,7 +159,7 @@ VOID FASTCALL ConSrvReleaseConsole(PCONSOLE Console, BOOL WasConsoleLocked) { - /* Just call the driver*/ + /* Just call the driver */ ConDrvReleaseConsole(Console, WasConsoleLocked); } diff --git a/reactos/win32ss/user/winsrv/consrv/handle.c b/reactos/win32ss/user/winsrv/consrv/handle.c index f5ef3e755f3..9e6ac97ba3b 100644 --- a/reactos/win32ss/user/winsrv/consrv/handle.c +++ b/reactos/win32ss/user/winsrv/consrv/handle.c @@ -387,6 +387,8 @@ ConSrvRemoveObject(PCONSOLE_PROCESS_DATA ProcessData, RtlEnterCriticalSection(&ProcessData->HandleTableLock); ASSERT(ProcessData->HandleTable); + // ASSERT( (ProcessData->HandleTable == NULL && ProcessData->HandleTableSize == 0) || + // (ProcessData->HandleTable != NULL && ProcessData->HandleTableSize != 0) ); if (Index >= ProcessData->HandleTableSize || (Object = ProcessData->HandleTable[Index].Object) == NULL) @@ -781,6 +783,9 @@ CSR_API(SrvVerifyConsoleIoHandle) RtlEnterCriticalSection(&ProcessData->HandleTableLock); + // ASSERT( (ProcessData->HandleTable == NULL && ProcessData->HandleTableSize == 0) || + // (ProcessData->HandleTable != NULL && ProcessData->HandleTableSize != 0) ); + if (!IsConsoleHandle(ConsoleHandle) || Index >= ProcessData->HandleTableSize || ProcessData->HandleTable[Index].Object == NULL) @@ -816,6 +821,9 @@ CSR_API(SrvDuplicateHandle) RtlEnterCriticalSection(&ProcessData->HandleTableLock); + // ASSERT( (ProcessData->HandleTable == NULL && ProcessData->HandleTableSize == 0) || + // (ProcessData->HandleTable != NULL && ProcessData->HandleTableSize != 0) ); + if ( /** !IsConsoleHandle(ConsoleHandle) || **/ Index >= ProcessData->HandleTableSize || (Entry = &ProcessData->HandleTable[Index])->Object == NULL)