Uploaded image for project: 'Core ReactOS'
  1. Core ReactOS
  2. CORE-4223

fastfat buffer overflow can crash reactOS.

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Fix Version/s: None
    • Component/s: Drivers: Other
    • Labels:
      None
    • Environment:

      Operating System: ReactOS
      Platform: x86 Hardware

      Description

      with reactos 41214 build on linux for qemu,
      with cygwin-setup 1.7
      with default cygwin installation (which stop just before being finished).

      open a command line and type:

      cd \cygwin bin
      bash -i

      This crashes ReactOS, log here after:

      qemu -net nic -net user -serial stdio -m 128 -hda ReactOS.vmdk -cdrom cygwin-setup-1.7.iso
      Could not open '/dev/kqemu' - QEMU acceleration layer not activated
      (ntoskrnl/kd/kdio.c:220) -----------------------------------------------------
      (ntoskrnl/kd/kdio.c:221) ReactOS 0.4-SVN (Build 20090531-r41214)
      (ntoskrnl/kd/kdio.c:222) Command Line: DE DEBUGPORT=COM1 BAUDRATE=115200 SOS
      (ntoskrnl/kd/kdio.c:223) ARC Paths: multi(0)disk(0)rdisk(0)partition(1) \ multi(0)disk(0)rdisk(0)partition(1) \ReactOS\
      Used memory 130676Kb
      (ntoskrnl/mm/mminit.c:284) Start End Type
      (ntoskrnl/mm/mminit.c:285) 0x80000000 - 0x80800000 Undefined region
      (ntoskrnl/mm/mminit.c:288) 0x80800000 - 0x80E00000 FreeLDR Kernel mapping region
      (ntoskrnl/mm/mminit.c:291) 0x80E00000 - 0x80F00000 PFN Database region
      (ntoskrnl/mm/mminit.c:298) 0x80F00000 - 0x87300000 Non paged pool region
      (ntoskrnl/mm/mminit.c:301) 0x87300000 - 0x8D700000 Paged pool region
      (ntoskrnl/ke/i386/kiinit.c:43) Large Page support detected but not yet taken advantage of!
      (ntoskrnl/ke/i386/patpge.c:62) Advanced Memory features detected but not yet taken advantage of.
      WARNING: KdDebuggerInitialize1 at drivers/base/kdcom/i386/kdbg.c:489 is UNIMPLEMENTED!
      WARNING: IoReportResourceUsage at ntoskrnl/io/iomgr/iorsrce.c:700 is UNIMPLEMENTED!
      WARNING: IoReportResourceUsage at ntoskrnl/io/iomgr/iorsrce.c:700 is UNIMPLEMENTED!
      (ntoskrnl/io/iomgr/driver.c:1348) '\Driver\BUSLOGIC' initialization failed, status (0xc00000c0)
      (drivers/storage/class/ramdisk/ramdisk.c:2310) RAM Disk Driver Initialized
      (ntoskrnl/io/iomgr/deviface.c:892) IoRegisterDeviceInterface(): creating symbolic link ??\Root#*PNP0F13#0000#

      {378de44c-56ef-11d1-bc8c-00a0c91405dd}

      -> \Device\0000000d
      (ntoskrnl/io/iomgr/deviface.c:892) IoRegisterDeviceInterface(): creating symbolic link ??\Root#*PNP0501#0000#

      {86e0d1e0-8089-11d0-9ce4-08003e301f73}

      -> \Device\0000000c
      (ntoskrnl/io/iomgr/deviface.c:892) IoRegisterDeviceInterface(): creating symbolic link ??\Root#*PNP0501#0000#

      {4d36e978-e325-11ce-bfc1-08002be10318}

      -> \Device\0000000c
      (drivers/network/ndis/ndis/miniport.c:2292)(NdisMRegisterMiniport) Initializing an NDIS 3.0 miniport
      (drivers/bus/pci/pdo.c:1383) Unknown IOCTL 0x7
      (ntoskrnl/io/iomgr/deviface.c:892) IoRegisterDeviceInterface(): creating symbolic link ??\Root#*PNP0303#0000#

      {884b96c3-56ef-11d1-bc8c-00a0c91405dd}

      -> \Device\0000000a
      (ntoskrnl/io/iomgr/driver.c:1348) '\Driver\Floppy' initialization failed, status (0xc000000e)
      WARNING: MmPageEntireDriver at ntoskrnl/mm/drvlck.c:88 is UNIMPLEMENTED!
      WARNING: MmPageEntireDriver at ntoskrnl/mm/drvlck.c:88 is UNIMPLEMENTED!
      WARNING: MmPageEntireDriver at ntoskrnl/mm/drvlck.c:88 is UNIMPLEMENTED!
      (ntoskrnl/io/iomgr/file.c:414) Using IopParseDevice() hack
      (subsystems/win32/win32k/ntuser/input.c:904)
      Raw Input Thread 0x81368620
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      WARNING: NtUserInitialize at subsystems/win32/win32k/ntuser/ntstubs.c:823 is UNIMPLEMENTED!
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
      (subsystems/win32/win32k/objects/gdiobj.c:814) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x40000)
      (base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID

      {CB3A4009-46F0-11D0-B08F-00609713053F}
      (base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID {CB3A4009-46F0-11D0-B08F-00609713053F}

      (base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID

      {CB3A4009-46F0-11D0-B08F-00609713053F}
      (base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID {CB3A4009-46F0-11D0-B08F-00609713053F}

      (base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID

      {CB3A4009-46F0-11D0-B08F-00609713053F}
      (base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID {CB3A4009-46F0-11D0-B08F-00609713053F}

      (subsystems/win32/win32k/ntuser/desktop.c:591) RtlQueryRegistryValues failed for PaintDesktopVersion (c0000034)
      err:(base/system/winlogon/screensaver.c:86) ImpersonateLoggedOnUser() failed with error 5
      err:(base/system/userinit/userinit.c:559) USERPREFERENCESMASK size: 4
      err:(base/system/userinit/userinit.c:586) No User Preferences set in registry or incorrect type (error 2)
      err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
      err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
      Using shell hooks for notification of shell events.
      (subsystems/win32/win32k/ntuser/hook.c:1143) Not implemented: HookId 3 Global TRUE
      err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
      err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
      err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
      err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
      err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
      err:(dll/win32/setupapi/queue.c:1659) copy error 2 L"C:\\ReactOS\\inf
      isapnp.sys" -> L"C:\\ReactOS\\System32\\drivers
      isapnp.sys"
      fixme:(dll/win32/shell32/shlview.c:1595) LVN_KEYDOWN key=0x0000000d
      MainFrameBase::OpenShellFolders(): parent_pidl=C:\Documents and Settings\Administrator.REACTOS\Bureau
      fixme:(dll/win32/shell32/she_ocmenu.c:1247) pidl is a shortcut
      (subsystems/win32/win32k/ntuser/clipboard.c:1159) No WINSTA_ACCESSCLIPBOARD access
      fixme:(dll/win32/shell32/shlexec.c:1541) flags ignored: 0x00010000
      (subsystems/win32/csrss/win32csr/guiconsole.c:1524) GuiConsoleResize X 560 Y 375
      (subsystems/win32/csrss/win32csr/guiconsole.c:1524) GuiConsoleResize X 560 Y 375
      (subsystems/win32/csrss/win32csr/guiconsole.c:2151) received event Console 00930950 GuiData 009309D0 X 80 Y 25
      WARNING: SeAppendPrivileges at ntoskrnl/se/priv.c:296 is UNIMPLEMENTED!
      WARNING: SeAppendPrivileges at ntoskrnl/se/priv.c:296 is UNIMPLEMENTED!
      WARNING: SeAppendPrivileges at ntoskrnl/se/priv.c:296 is UNIMPLEMENTED!
      WARNING: SeAppendPrivileges at ntoskrnl/se/priv.c:296 is UNIMPLEMENTED!
      Entered debugger on last-chance exception (Exception Code: 0xc0000005) (Page Fault)
      Memory at 0x00000000 could not be read: Page not present.
      kdb:> bt
      Eip:
      <FASTFAT.SYS:1a53>
      Frames:
      <FASTFAT.SYS:98e9>
      <FASTFAT.SYS:99f9>
      <NTOSKRNL.EXE:567ad (ntoskrnl/io/iomgr/irp.c:1137 (@IofCallDriver@8))>
      <NTOSKRNL.EXE:4c379 (ntoskrnl/io/iomgr/file.c:705 (IopParseDevice@40))>
      <NTOSKRNL.EXE:4cc33 (ntoskrnl/io/iomgr/file.c:923 (IopParseFile@40))>
      <NTOSKRNL.EXE:9d2b3 (ntoskrnl/ob/obname.c:380 (ObpLookupObjectName@44))>
      <NTOSKRNL.EXE:9b32b (ntoskrnl/ob/obhandle.c:2504 (ObOpenObjectByName@28))>
      <NTOSKRNL.EXE:4dbf3 (ntoskrnl/io/iomgr/file.c:1803 (IoCreateFile@56))>
      <NTOSKRNL.EXE:4eded (ntoskrnl/io/iomgr/file.c:2714 (NtOpenFile@24))>
      <NTOSKRNL.EXE:bac0c (ntoskrnl/ke/i386/trap.s:244 (KiFastCallEntry))>
      <ntdll.dll:6592>
      <cygwin1.dll:88638>
      <cygwin1.dll:66e2>
      <cygwin1.dll:4a96>
      <ec835356>
      Couldn't access memory at 0x57E58959!
      kdb:>

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Heis Spiter Pierre Schweitzer
                Reporter:
                jeanmichel.123 jeanmichel.123
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: