Reject malformed DHCP subnet mask and router option lengths
before setup_adapter() consumes them.
This prevents attacker-controlled option lengths from expanding DHCP
option bytes into a fixed stack buffer while preserving valid
router address lists.
Validate the option lengths before use, keep router lists limited to
complete IPv4 addresses, and format registry IPv4 strings with
RtlIpv4AddressToStringA().
Booted amd64 QEMU image: no DHCP/client networking regression observed.
FsRtlCheckLockForReadAccess() accepts access through an exclusive
byte-range lock when the IRP key matches, even if another process
owns the lock. FsRtlFastUnlockAll() likewise removes exclusive locks
without checking the Process argument.
Require both the key and requestor process for exclusive-read access,
and skip exclusive locks owned by other processes in FsRtlFastUnlockAll().
This matches the ownership checks already used by
FsRtlFastCheckLockForRead() and FsRtlFastUnlockAllByKey().
Reference:
- https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-_fsrtl_advanced_fcb_header-fsrtlfastchecklockforread
llvm-mingw's static runtime (libc++, libmingwex, libc++abi, libunwind)
references symbols the NT 5.2 export surface does not provide. Add a
static library, linked into the Clang runtime chain below
DLL_EXPORT_VERSION 0x601, providing:
- C99 vsnprintf/snprintf on top of _vsnprintf/_vscprintf.
- __imp_* aliases binding dllimport references to the static CRT
definitions instead of ucrtbase import thunks, which collide with
them (lld: "<sym> was replaced").
- K32EnumProcessModules, forwarded to psapi's EnumProcessModules.
- The Win7 SRW lock and Vista condition variable surface, bound to the
RTL implementation linked statically from rtl_vista. Modules get one
self-contained, consistent synchronization implementation (ReactOS'
lock layout is not Windows-compatible), no kernel32_vista.dll
dependency, and stay runnable on any Windows version. Static SRW
linking suggested by Timo Kreuzer.
Address review feedback on the llvm-compat shims:
sync_static.c now uses the proper SDK/NDK headers with WINAPI/NTAPI, imp_alias.h
moved to sdk/include/reactos and fixes the msvcrtex slot decorations too, and a
new InitOnceExecuteOnce shim lets us drop libkernel32_vista from the interface.
MmFreeContiguousMemory() is callable at up to DISPATCH_LEVEL,
but MiFreeContiguousMemory() used PAGED_CODE(), which incorrectly asserted
above APC_LEVEL in checked builds.
Replace it with an assertion that enforces the exported IRQL contract.
IopDereferenceVpbAndFree frees a zero-reference VPB only while it is still
installed in RealDevice->Vpb. This can leave the device with a dangling
VPB pointer while detached VPBs are retained.
Reverse the identity test so only a detached, nonpersistent VPB is released
after its reference count reaches zero.
Reference:
- https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_vpb
MmUnloadSystemImage() had an explicit leak placeholder for driver images.
Implement the MmUnloadSystemImage() that performs matching teardown
for the image mappings, releasing the reserved system PTE range.
Also fix similar leak in MiLoadImageSection() by releasing image mappings
after load failures.
CORE-8294
Note that the driver images loaded at boot, which were not reloaded by
MiReloadBootLoadedDrivers(), remain at their loader-assigned addresses
and do not own system PTEs.
Fix ACPI table discovery on the UEFI boot path by teaching the ACPI OSL
to use the loader-provided ACPI root table information instead of relying
only on legacy BIOS RSDP scanning:
- Build a synthetic RSDP from the ACPI BIOS configuration node
populated by the bootloader
- Fallback to the old scan only if that data is unavailable
- Keep full 64-bit physical addresses when mapping ACPI tables
- Improve failure diagnostics if initialization still fails
This lets ACPICA initialize from the UEFI-provided RSDT/XSDT path.
CORE-11954
So QEMU Q35 on UEFI is now able to discover ACPI tables through the loader-
provided root table path, which fixes 0x7B INACCESSIBLE_BOOT_DEVICE bugcheck:
https://github.com/user-attachments/assets/25d4d9c9-4197-496b-84f9-e5642c65809d
Dragging the first-boot install/status window could make setup stall,
and the shell never started after that.
The problem is that the move/size modal loop can remove a posted `WM_QUIT`
while setup is tearing the thread down. That quit message then does not
reach the outer `GetMessage()` loop, so the setup thread keeps waiting
instead of exiting.
This fix keeps the `WM_QUIT` message alive by re-posting it and leaving
the move/size loop.
See also: https://devblogs.microsoft.com/oldnewthing/20050222-00/?p=36393
## How to test
Boot to first-boot setup, drag the install/status window while it is finishing,
and check that setup continues and Explorer starts instead of hanging.
`co_IntGetScrollBarInfo()` computed the `rgstate` bits into the output buffer
and then immediately overwrote them with the cached copy, so callers always
got stale state.
Fix this by copying the cached info before computing `rgstate`.
This also exposed an inverted `WS_DISABLED` test (per wine, disabled `SB_CTL`
should report `UNAVAILABLE`, not enabled ones), which is now fixed as well.
Remove the excessive repainting of the non-client window area (title caption/buttons and borders) whenever other windows are being dragged over.
CORE-5877, CORE-16672
Keep the configured event log `MaxSize` as a capacity limit and track the
physical file size separately.
New logs now start at the Windows 64 KiB file-size granularity, instead of
growing immediately to the full configured maximum. They are then grown in
64 KiB chunks as records are written, while preserving the logical used area
in the header offsets and EOF record.
AddControllers already disconnects the controller interrupt on its error paths but left InterruptObject pointing at the freed object.
Now that DriverEntry runs Cleanup on failure (and Unload() routes through it too), that stale pointer is handed to IoDisconnectInterrupt a second time, bugchecking with BAD_POOL_HEADER.
Clear InterruptObject right after disconnecting so Cleanup() skips it.
CORE-20669
The mask bounds check in `DIB_XXBPP_StretchBlt` allowed `sx == cx` (and similar for `sy`),
reading one pixel past the end of the mask bitmap.
On the contrary, the source-surface check a few lines below already does it right.
- Use shared locks for the display device and PDEV lookup paths.
These functions only walk existing lists and take references, while list updates
and mode-switch paths still use exclusive locking.
This avoids serializing read-only display queries unnecessarily.
- Use shared locks for other read-only NtUser calls.
Some win32k syscalls were still taking the exclusive user lock even though they only read existing state.
This switches a few simple query paths to the shared user lock instead: foreground window lookup, IME hotkey/context queries, layered window attributes, and title bar info.
The goal is to avoid taking the writer lock for read-only work while keeping the same behavior.
Fix the bug, where `NtUserMenuItemFromPoint()` returned `cItems` instead of `NO_SELECTED_ITEM`
when no item is under the point (`mi` is never NULL on a miss), so `MenuItemFromPoint()` callers
could have indexed one past the menu array.
FstubCreateDiskRaw is supposed to wipe the MBR when it makes a RAW disk.
Before this fix, that function only cleared the first of the 4 partition entries, so one entry (16 bytes) instead of the whole table (64).
As a consequence, the wiped MBR written back to disk still had entries 2, 3 and 4 sitting there with old data, and those came back as ghost/garbage partitions.
Ahmed Arif