Uploaded image for project: 'Core ReactOS'
  1. Core ReactOS
  2. CORE-9229

Use of uninitialized Context.QueryResult in winsrv!NotifyProcessForShutdown

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 0.4.0
    • Win32SS
    • None

    Description

      kd> kp
      ChildEBP RetAddr  
      00d3fd2c 753e1583 winsrv!_RTC_DefaultErrorFuncW(int errType = 3, wchar_t * file = 0x75418320 "unknown file", int line = 0xffffffff, wchar_t * module = 0x75418300 "unknown module", wchar_t * format = 0x754182b8 "Use of uninitialized variable %S!.")+0x3 [c:\ros\reactos-clean\reactos\lib\sdk\runtmchk\rtcapi.c @ 29]
      00d3fd50 75400335 winsrv!_RTC_UninitUse(char * _Varname = 0x7540046c "Context")+0x23 [c:\ros\reactos-clean\reactos\lib\sdk\runtmchk\rtcapi.c @ 107]
      00d3fdb4 754001d2 winsrv!NotifyProcessForShutdown(struct _CSR_PROCESS * CsrProcess = 0x00226a98, struct tagSHUTDOWN_SETTINGS * ShutdownSettings = 0x75418000, unsigned int Flags = 0x301)+0x115 [c:\ros\reactos-clean\reactos\win32ss\user\winsrv\usersrv\shutdown.c @ 574]
      00d3fdd4 10007053 winsrv!UserClientShutdown(struct _CSR_PROCESS * CsrProcess = 0x00226a98, unsigned long Flags = 0x301, unsigned char FirstPhase = 0x01 '')+0x202 [c:\ros\reactos-clean\reactos\win32ss\user\winsrv\usersrv\shutdown.c @ 788]
      00d3fe08 754014a0 csrsrv!CsrShutdownProcesses(struct _LUID * CallerLuid = 0x00d3fe30, unsigned long Flags = 0x301)+0x143 [c:\ros\reactos-clean\reactos\subsystems\win32\csrsrv\procsup.c @ 1329]
      00d3fe58 75401160 winsrv!UserExitReactos(struct _CSR_THREAD * CsrThread = 0x002266a8, unsigned int Flags = 0x301)+0x310 [c:\ros\reactos-clean\reactos\win32ss\user\winsrv\usersrv\shutdown.c @ 730]
      00d3fe68 10002486 winsrv!SrvExitWindowsEx(struct _CSR_API_MESSAGE * ApiMessage = 0x00d3fed8, _CSR_REPLY_CODE * ReplyCode = 0x00d3ffb4)+0x30 [c:\ros\reactos-clean\reactos\win32ss\user\winsrv\usersrv\shutdown.c @ 810]
      00d3fff4 00000000 csrsrv!CsrApiRequestThread(void * Parameter = 0x00000000)+0xc56 [c:\ros\reactos-clean\reactos\subsystems\win32\csrsrv\api.c @ 811]
      kd> ?? CsrProcess
      struct _CSR_PROCESS * 0x00226a98
      kd> dd 0x00226a98
      00226a98  000007f8 000007fc 00220da8 00225fa0
      00226aa8  00226b60 00226b60 00224ef0 00000000
      00226ab8  000002ac 00c30000 00c40000 000002b4
      00226ac8  00000027 00000002 00000000 00000000
      00226ad8  00000000 00000004 00000000 00000000
      00226ae8  00000000 00000001 00000000 00000000
      00226af8  00000280 00000008 00000000 00000000
      00226b08  00226b10 00000000 00000000 00000000
      kd> dd 0x00226b60-8
      00226b58  7a811100 01d04c70 00226aa8 00226aa8
      00226b68  10010f08 10010f08 000007f8 000007fc
      00226b78  00226a98 00000000 000002b0 00000004
      00226b88  00000001 00000000 00010008 08000008
      00226b98  a051f540 01d04c70 002266b0 002261e0
      00226ba8  10010d50 10010d50 0000009c 000006c4
      00226bb8  00224df0 00000000 00000234 00000000
      00226bc8  00000001 00000000 00010002 0c000008

      There's one thread (0x226b58) in CsrProcess->ThreadList, and its Flags member is 4 aka CsrThreadTerminated, so it got skipped in the loop, leaving Context.QueryResult untouched.

      Attachments

        Activity

          People

            hbelusca hbelusca
            ThFabba ThFabba
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: