Uploaded image for project: 'Core ReactOS'
  1. Core ReactOS
  2. CORE-8094

NtUserGetObjectInformation missing exception handling and NULL check

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Critical
    • Resolution: Fixed
    • Fix Version/s: 0.3.17
    • Component/s: Win32SS
    • Labels:

      Description

      user32_winetest performs calls such as:
      507 ret = GetUserObjectInformationA(old_input_desk, UOI_NAME, name, 1024, NULL);

      This crashes:

      Running Wine Test, Module: user32, Test: winstation
      
      Entered debugger on last-chance exception (Exception Code: 0xc0000005) (Page Fault)
      Memory at 0x00000000 could not be written: Page not present.
      kdb:> bt
      Eip:
      <win32k.sys:7b48e (win32ss/user/ntuser/winsta.c:730 (NtUserGetObjectInformation))>
      Frames:
      <NTOSKRNL.EXE:140230 (ntoskrnl/include/internal/arch/../i386/ke.h:688 (KiFastCallEntryHandler))>
      <NTOSKRNL.EXE:3ced (:0 (KiFastCallEntry))>
      <ntdll.dll:1b500>
      <user32_winetest.exe:cf371>
      <user32_winetest.exe:d1a28>
      <user32_winetest.exe:d5359>
      <user32_winetest.exe:d6356>
      <user32_winetest.exe:d63b8>
      <kernel32.dll:fb63>
      <00000000>
      kdb:>
      [SYSREG] Rebooting VM (retry 2)

      ... because NtUserGetObjectInformation doesn't use SEH and ProbeForWrite to write to nLengthNeeded:

         /* try to copy data to caller */
         if (Status == STATUS_SUCCESS)
         {
            TRACE("Trying to copy data to caller (len = %lu, len needed = %lu)\n", nLength, nDataSize);
            *nLengthNeeded = nDataSize;
            if (nLength >= nDataSize)
               Status = MmCopyToCaller(pvInformation, pvData, nDataSize);
            else
               Status = STATUS_BUFFER_TOO_SMALL;
         }

      Also, this parameter is optional and should not be written to if NULL.

        Attachments

          Activity

            People

            • Assignee:
              ThFabba ThFabba
              Reporter:
              ThFabba ThFabba
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: