- CsrReleaseObject: Fix locking to prevent possibility of closing the same handle twice.

- GuiConsolePaint: Clip the paint area to the screen buffer, to stop heap corruption if the window gets oversized.
- ConioDeleteConsole: Do decrement the active screen buffer's refcount, but only after calling ConioCleanupConsole to destroy the window.
- Remove Win32CsrInsertObject. This function did two unrelated things (initialize lock and create handle), but in the only place it was used (CsrCreateScreenBuffer) the lock had already been initialized in CsrInitConsoleScreenBuffer, so this use was erroneous.
- Rename Win32CsrInsertObject2 (creates handle only) to Win32CsrInsertObject.

svn path=/trunk/; revision=34559

reactos/subsystems/win32/csrss/api/handle.c

@@ -115,23 +115,23 @@ CsrReleaseObject(PCSRSS_PROCESS_DATA ProcessData,
                  HANDLE Handle)
 {
   ULONG h = (((ULONG)Handle) >> 2) - 1;
-  NTSTATUS Status;
+  Object_t *Object;
 
   if (ProcessData == NULL)
     {
       return STATUS_INVALID_PARAMETER;
     }
-  if (!CsrIsConsoleHandle(Handle) || h >= ProcessData->HandleTableSize || ProcessData->HandleTable[h] == NULL)
+  RtlEnterCriticalSection(&ProcessData->HandleTableLock);
+  if (!CsrIsConsoleHandle(Handle) || h >= ProcessData->HandleTableSize
+      || (Object = ProcessData->HandleTable[h]) == NULL)
     {
+      RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
       return STATUS_INVALID_HANDLE;
     }
-
-  Status = CsrReleaseObjectByPointer(ProcessData->HandleTable[h]);
-
-  RtlEnterCriticalSection(&ProcessData->HandleTableLock);
-  ProcessData->HandleTable[h] = 0;
+  ProcessData->HandleTable[h] = NULL;
   RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
-  return Status;
+
+  return CsrReleaseObjectByPointer(Object);
 }
 
 NTSTATUS STDCALL CsrInsertObject( PCSRSS_PROCESS_DATA ProcessData, PHANDLE Handle, Object_t *Object )

reactos/subsystems/win32/csrss/win32csr/conio.c

@@ -13,9 +13,6 @@
 #define NDEBUG
 #include <debug.h>
 
-extern NTSTATUS FASTCALL
-Win32CsrInsertObject2(PCSRSS_PROCESS_DATA, PHANDLE, Object_t *);
-
 /* GLOBALS *******************************************************************/
 
 #define ConioInitRect(Rect, Top, Left, Bottom, Right) \
@@ -315,9 +312,9 @@ CSR_API(CsrAllocConsole)
     if (NewConsole || !ProcessData->bInheritHandles)
     {
         /* Insert the Objects */
-        Status = Win32CsrInsertObject2(ProcessData,
-                                       &Request->Data.AllocConsoleRequest.InputHandle,
-                                       &Console->Header);
+        Status = Win32CsrInsertObject(ProcessData,
+                                      &Request->Data.AllocConsoleRequest.InputHandle,
+                                      &Console->Header);
         if (! NT_SUCCESS(Status))
         {
             DPRINT1("Failed to insert object\n");
@@ -326,9 +323,9 @@ CSR_API(CsrAllocConsole)
             return Request->Status = Status;
         }
 
-        Status = Win32CsrInsertObject2(ProcessData,
-                                       &Request->Data.AllocConsoleRequest.OutputHandle,
-                                       &Console->ActiveBuffer->Header);
+        Status = Win32CsrInsertObject(ProcessData,
+                                      &Request->Data.AllocConsoleRequest.OutputHandle,
+                                      &Console->ActiveBuffer->Header);
         if (!NT_SUCCESS(Status))
         {
             DPRINT1("Failed to insert object\n");
@@ -984,16 +981,14 @@ ConioDeleteConsole(Object_t *Object)
       HeapFree(Win32CsrApiHeap, 0, Event);
     }
 
-#if 0 // FIXME
+  ConioCleanupConsole(Console);
   if (0 == InterlockedDecrement(&Console->ActiveBuffer->Header.ReferenceCount))
     {
       ConioDeleteScreenBuffer((Object_t *) Console->ActiveBuffer);
     }
-#endif
 
   Console->ActiveBuffer = NULL;
   Console->hActiveBuffer = INVALID_HANDLE_VALUE;
-  ConioCleanupConsole(Console);
 
   CloseHandle(Console->ActiveEvent);
   DeleteCriticalSection(&Console->Header.Lock);

reactos/subsystems/win32/csrss/win32csr/dllmain.c

@@ -95,16 +95,6 @@ DllMain(HANDLE hDll,
 
 NTSTATUS FASTCALL
 Win32CsrInsertObject(PCSRSS_PROCESS_DATA ProcessData,
-                     PHANDLE Handle,
-                     Object_t *Object)
-{
-  InitializeCriticalSection(&(Object->Lock));
-
-  return (CsrExports.CsrInsertObjectProc)(ProcessData, Handle, Object);
-}
-
-NTSTATUS FASTCALL
-Win32CsrInsertObject2(PCSRSS_PROCESS_DATA ProcessData,
                       PHANDLE Handle,
                       Object_t *Object)
 {

reactos/subsystems/win32/csrss/win32csr/guiconsole.c

@@ -887,6 +887,9 @@ GuiConsolePaint(PCSRSS_CONSOLE Console,
 
     EnterCriticalSection(&Buff->Header.Lock);
 
+    if (BottomLine >= Buff->MaxY) BottomLine = Buff->MaxY - 1;
+    if (RightChar >= Buff->MaxX) RightChar = Buff->MaxX - 1;
+
     OldFont = SelectObject(hDC,
                            GuiData->Font);