From a92eec4397eeb0896963a0d5a9ff15ae04a874dc Mon Sep 17 00:00:00 2001
From: Alex Ionescu <aionescu@gmail.com>
Date: Sun, 23 Jul 2006 07:24:20 +0000
Subject: [PATCH] - SeAccessCheck should assume failure if no SD was passed.
 Also fixes bugcheck on startup since processes don't currently have SDs.

svn path=/trunk/; revision=23235
---
 reactos/ntoskrnl/ps/security.c | 1 +
 reactos/ntoskrnl/se/semgr.c    | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/reactos/ntoskrnl/ps/security.c b/reactos/ntoskrnl/ps/security.c
index ceb60f44d94..b706cb2f801 100644
--- a/reactos/ntoskrnl/ps/security.c
+++ b/reactos/ntoskrnl/ps/security.c
@@ -263,6 +263,7 @@ PspSetPrimaryToken(IN PEPROCESS Process,
             SubjectContext.ClientToken = NULL;
 
             /* Do the access check */
+            if (!SecurityDescriptor) DPRINT1("FIX PS SDs!!\n");
             Result = SeAccessCheck(SecurityDescriptor,
                                    &SubjectContext,
                                    FALSE,
diff --git a/reactos/ntoskrnl/se/semgr.c b/reactos/ntoskrnl/se/semgr.c
index e574518f3c5..f171e2aac82 100644
--- a/reactos/ntoskrnl/se/semgr.c
+++ b/reactos/ntoskrnl/se/semgr.c
@@ -871,6 +871,14 @@ SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
 
   PAGED_CODE();
 
+  /* Check if we didn't get an SD */
+  if (!SecurityDescriptor)
+  {
+      /* Automatic failure */
+      *AccessStatus = STATUS_ACCESS_DENIED;
+      return FALSE;
+  }
+
   CurrentAccess = PreviouslyGrantedAccess;
 
   if (SubjectContextLocked == FALSE)