From 732baee549e8b43f23ec9ba6773f36da1b44c831 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Herm=C3=A8s=20B=C3=A9lusca-Ma=C3=AFto?= Date: Tue, 6 Aug 2013 19:10:36 +0000 Subject: [PATCH] [CONSRV] - Fix console handle validation (triggered by recent Process changes by Alex). - Temporarily add commented-out asserts for testing purposes only. svn path=/trunk/; revision=59658 --- reactos/win32ss/user/winsrv/consrv/condrv/console.c | 13 ++++++++++--- reactos/win32ss/user/winsrv/consrv/console.c | 2 +- reactos/win32ss/user/winsrv/consrv/handle.c | 8 ++++++++ 3 files changed, 19 insertions(+), 4 deletions(-) diff --git a/reactos/win32ss/user/winsrv/consrv/condrv/console.c b/reactos/win32ss/user/winsrv/consrv/condrv/console.c index 861c4721f74..0c4cb6ac9ec 100644 --- a/reactos/win32ss/user/winsrv/consrv/condrv/console.c +++ b/reactos/win32ss/user/winsrv/consrv/condrv/console.c @@ -143,9 +143,13 @@ static NTSTATUS RemoveConsoleByHandle(IN HANDLE Handle) { NTSTATUS Status = STATUS_SUCCESS; - ULONG Index = HandleToULong(Handle) >> 2; PCONSOLE Console; + BOOLEAN ValidHandle = ((HandleToULong(Handle) & 0x3) == 0x3); + ULONG Index = HandleToULong(Handle) >> 2; + + if (!ValidHandle) return STATUS_INVALID_HANDLE; + ASSERT( (ConsoleList == NULL && ConsoleListSize == 0) || (ConsoleList != NULL && ConsoleListSize != 0) ); @@ -339,10 +343,13 @@ ConDrvValidateConsole(OUT PCONSOLE* Console, IN BOOLEAN LockConsole) { BOOLEAN RetVal = FALSE; - - ULONG Index = HandleToULong(ConsoleHandle) >> 2; PCONSOLE ValidatedConsole; + BOOLEAN ValidHandle = ((HandleToULong(ConsoleHandle) & 0x3) == 0x3); + ULONG Index = HandleToULong(ConsoleHandle) >> 2; + + if (!ValidHandle) return FALSE; + if (!Console) return FALSE; *Console = NULL; diff --git a/reactos/win32ss/user/winsrv/consrv/console.c b/reactos/win32ss/user/winsrv/consrv/console.c index 9403daa081f..932d623ff21 100644 --- a/reactos/win32ss/user/winsrv/consrv/console.c +++ b/reactos/win32ss/user/winsrv/consrv/console.c @@ -159,7 +159,7 @@ VOID FASTCALL ConSrvReleaseConsole(PCONSOLE Console, BOOL WasConsoleLocked) { - /* Just call the driver*/ + /* Just call the driver */ ConDrvReleaseConsole(Console, WasConsoleLocked); } diff --git a/reactos/win32ss/user/winsrv/consrv/handle.c b/reactos/win32ss/user/winsrv/consrv/handle.c index f5ef3e755f3..9e6ac97ba3b 100644 --- a/reactos/win32ss/user/winsrv/consrv/handle.c +++ b/reactos/win32ss/user/winsrv/consrv/handle.c @@ -387,6 +387,8 @@ ConSrvRemoveObject(PCONSOLE_PROCESS_DATA ProcessData, RtlEnterCriticalSection(&ProcessData->HandleTableLock); ASSERT(ProcessData->HandleTable); + // ASSERT( (ProcessData->HandleTable == NULL && ProcessData->HandleTableSize == 0) || + // (ProcessData->HandleTable != NULL && ProcessData->HandleTableSize != 0) ); if (Index >= ProcessData->HandleTableSize || (Object = ProcessData->HandleTable[Index].Object) == NULL) @@ -781,6 +783,9 @@ CSR_API(SrvVerifyConsoleIoHandle) RtlEnterCriticalSection(&ProcessData->HandleTableLock); + // ASSERT( (ProcessData->HandleTable == NULL && ProcessData->HandleTableSize == 0) || + // (ProcessData->HandleTable != NULL && ProcessData->HandleTableSize != 0) ); + if (!IsConsoleHandle(ConsoleHandle) || Index >= ProcessData->HandleTableSize || ProcessData->HandleTable[Index].Object == NULL) @@ -816,6 +821,9 @@ CSR_API(SrvDuplicateHandle) RtlEnterCriticalSection(&ProcessData->HandleTableLock); + // ASSERT( (ProcessData->HandleTable == NULL && ProcessData->HandleTableSize == 0) || + // (ProcessData->HandleTable != NULL && ProcessData->HandleTableSize != 0) ); + if ( /** !IsConsoleHandle(ConsoleHandle) || **/ Index >= ProcessData->HandleTableSize || (Entry = &ProcessData->HandleTable[Index])->Object == NULL)