From 0ecd041efc71de95187be5716c680bf2116b8ff2 Mon Sep 17 00:00:00 2001 From: Thomas Bluemel Date: Tue, 1 Nov 2005 16:17:25 +0000 Subject: [PATCH] - if a file object is a named pipe don't allow the FILE_APPEND_DATA access right as it equals FILE_CREATE_PIPE_INSTANCE (NtFlushBuffersFile and NtWriteFile) - add more parameters probing and capturing code svn path=/trunk/; revision=18932 --- reactos/ntoskrnl/io/file.c | 382 ++++++++++++++++++++++++++++--------- 1 file changed, 292 insertions(+), 90 deletions(-) diff --git a/reactos/ntoskrnl/io/file.c b/reactos/ntoskrnl/io/file.c index b2d17f29306..ab9d8b7e888 100644 --- a/reactos/ntoskrnl/io/file.c +++ b/reactos/ntoskrnl/io/file.c @@ -755,7 +755,6 @@ IoCreateFile(OUT PHANDLE FileHandle, IO_SECURITY_CONTEXT SecurityContext; KPROCESSOR_MODE AccessMode; HANDLE LocalHandle; - IO_STATUS_BLOCK LocalIoStatusBlock; LARGE_INTEGER SafeAllocationSize; PVOID SystemEaBuffer = NULL; NTSTATUS Status = STATUS_SUCCESS; @@ -988,7 +987,7 @@ IoCreateFile(OUT PHANDLE FileHandle, //trigger FileObject/Event dereferencing Irp->Tail.Overlay.OriginalFileObject = FileObject; Irp->RequestorMode = AccessMode; - Irp->UserIosb = &LocalIoStatusBlock; + Irp->UserIosb = IoStatusBlock; Irp->AssociatedIrp.SystemBuffer = SystemEaBuffer; Irp->Tail.Overlay.AuxiliaryBuffer = NULL; Irp->Tail.Overlay.Thread = PsGetCurrentThread(); @@ -1054,7 +1053,7 @@ IoCreateFile(OUT PHANDLE FileHandle, AccessMode, FALSE, NULL); - Status = LocalIoStatusBlock.Status; + Status = IoStatusBlock->Status; } if (!NT_SUCCESS(Status)) { @@ -1069,7 +1068,6 @@ IoCreateFile(OUT PHANDLE FileHandle, _SEH_TRY { *FileHandle = LocalHandle; - *IoStatusBlock = LocalIoStatusBlock; } _SEH_HANDLE { @@ -1380,20 +1378,41 @@ STDCALL NtCancelIoFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock) { - NTSTATUS Status; PFILE_OBJECT FileObject; PETHREAD Thread; PIRP Irp; KIRQL OldIrql; BOOLEAN OurIrpsInList = FALSE; LARGE_INTEGER Interval; + KPROCESSOR_MODE PreviousMode; + NTSTATUS Status = STATUS_SUCCESS; - if ((ULONG_PTR)IoStatusBlock >= (ULONG_PTR)MmUserProbeAddress && - KeGetPreviousMode() != KernelMode) - return STATUS_ACCESS_VIOLATION; + PAGED_CODE(); - Status = ObReferenceObjectByHandle(FileHandle, 0, IoFileObjectType, - KeGetPreviousMode(), (PVOID*)&FileObject, + PreviousMode = KeGetPreviousMode(); + + if (PreviousMode != KernelMode) + { + _SEH_TRY + { + ProbeForWrite(IoStatusBlock, + sizeof(IO_STATUS_BLOCK), + sizeof(ULONG)); + } + _SEH_HANDLE + { + Status = _SEH_GetExceptionCode(); + } + _SEH_END; + + if (!NT_SUCCESS(Status)) return Status; + } + + Status = ObReferenceObjectByHandle(FileHandle, + 0, + IoFileObjectType, + PreviousMode, + (PVOID*)&FileObject, NULL); if (!NT_SUCCESS(Status)) return Status; @@ -1531,23 +1550,39 @@ NtCreateMailslotFile(OUT PHANDLE FileHandle, MAILSLOT_CREATE_PARAMETERS Buffer; DPRINT("NtCreateMailslotFile(FileHandle 0x%p, DesiredAccess %x, " - "ObjectAttributes 0x%p ObjectAttributes->ObjectName->Buffer %S)\n", - FileHandle,DesiredAccess,ObjectAttributes, - ObjectAttributes->ObjectName->Buffer); + "ObjectAttributes 0x%p)\n", + FileHandle,DesiredAccess,ObjectAttributes); + PAGED_CODE(); /* Check for Timeout */ - if (TimeOut) + if (TimeOut != NULL) { - /* Enable it */ - Buffer.TimeoutSpecified = TRUE; + if (KeGetPreviousMode() != KernelMode) + { + NTSTATUS Status = STATUS_SUCCESS; - /* FIXME: Add SEH */ - Buffer.ReadTimeout = *TimeOut; + _SEH_TRY + { + Buffer.ReadTimeout = ProbeForReadLargeInteger(TimeOut); + } + _SEH_HANDLE + { + Status = _SEH_GetExceptionCode(); + } + _SEH_END; + + if (!NT_SUCCESS(Status)) return Status; + } + else + { + Buffer.ReadTimeout = *TimeOut; + } + + Buffer.TimeoutSpecified = TRUE; } else { - /* No timeout */ Buffer.TimeoutSpecified = FALSE; } @@ -1592,25 +1627,39 @@ NtCreateNamedPipeFile(PHANDLE FileHandle, NAMED_PIPE_CREATE_PARAMETERS Buffer; DPRINT("NtCreateNamedPipeFile(FileHandle 0x%p, DesiredAccess %x, " - "ObjectAttributes 0x%p ObjectAttributes->ObjectName->Buffer %S)\n", - FileHandle,DesiredAccess,ObjectAttributes, - ObjectAttributes->ObjectName->Buffer); + "ObjectAttributes 0x%p)\n", + FileHandle,DesiredAccess,ObjectAttributes); + PAGED_CODE(); /* Check for Timeout */ - if (DefaultTimeout) + if (DefaultTimeout != NULL) { - /* Enable it */ - Buffer.TimeoutSpecified = TRUE; + if (KeGetPreviousMode() != KernelMode) + { + NTSTATUS Status = STATUS_SUCCESS; - /* FIXME: Add SEH */ - Buffer.DefaultTimeout = *DefaultTimeout; + _SEH_TRY + { + Buffer.DefaultTimeout = ProbeForReadLargeInteger(DefaultTimeout); + } + _SEH_HANDLE + { + Status = _SEH_GetExceptionCode(); + } + _SEH_END; + + if (!NT_SUCCESS(Status)) return Status; + } + else + { + Buffer.DefaultTimeout = *DefaultTimeout; + } + + Buffer.TimeoutSpecified = TRUE; } else - { - /* No timeout */ Buffer.TimeoutSpecified = FALSE; - } /* Set Settings */ Buffer.NamedPipeType = NamedPipeType; @@ -1724,6 +1773,8 @@ NTSTATUS STDCALL NtFlushWriteBuffer(VOID) { + PAGED_CODE(); + KeFlushWriteBuffer(); return STATUS_SUCCESS; } @@ -1746,20 +1797,56 @@ NtFlushBuffersFile(IN HANDLE FileHandle, PFILE_OBJECT FileObject = NULL; PIRP Irp; PIO_STACK_LOCATION StackPtr; - NTSTATUS Status; + NTSTATUS Status = STATUS_SUCCESS; PDEVICE_OBJECT DeviceObject; KEVENT Event; BOOLEAN LocalEvent = FALSE; - KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); + ACCESS_MASK DesiredAccess = FILE_WRITE_DATA; + OBJECT_HANDLE_INFORMATION ObjectHandleInfo; + KPROCESSOR_MODE PreviousMode; + + PAGED_CODE(); + + PreviousMode = KeGetPreviousMode(); + + if (PreviousMode != KernelMode) + { + _SEH_TRY + { + ProbeForWrite(IoStatusBlock, + sizeof(IO_STATUS_BLOCK), + sizeof(ULONG)); + } + _SEH_HANDLE + { + Status = _SEH_GetExceptionCode(); + } + _SEH_END; + + if (!NT_SUCCESS(Status)) return Status; + } /* Get the File Object */ Status = ObReferenceObjectByHandle(FileHandle, - FILE_WRITE_DATA, - NULL, + 0, + IoFileObjectType, PreviousMode, (PVOID*)&FileObject, - NULL); - if (Status != STATUS_SUCCESS) return(Status); + &ObjectHandleInfo); + if (!NT_SUCCESS(Status)) return(Status); + + /* check if the handle has either FILE_WRITE_DATA or FILE_APPEND_DATA was + granted. However, if this is a named pipe, make sure we don't ask for + FILE_APPEND_DATA as it interferes with the FILE_CREATE_PIPE_INSTANCE + access right! */ + if (!(FileObject->Flags & FO_NAMED_PIPE)) + DesiredAccess |= FILE_APPEND_DATA; + if (!RtlAreAnyAccessesGranted(ObjectHandleInfo.GrantedAccess, + DesiredAccess)) + { + ObDereferenceObject(FileObject); + return STATUS_ACCESS_DENIED; + } /* Check if this is a direct open or not */ if (FileObject->Flags & FO_DIRECT_DEVICE_OPEN) @@ -1968,12 +2055,17 @@ NtLockFile(IN HANDLE FileHandle, PDEVICE_OBJECT DeviceObject; PKEVENT Event = NULL; BOOLEAN LocalEvent = FALSE; - KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); + KPROCESSOR_MODE PreviousMode; + LARGE_INTEGER CapturedByteOffset, CapturedLength; NTSTATUS Status = STATUS_SUCCESS; OBJECT_HANDLE_INFORMATION HandleInformation; - - /* FIXME: instead of this, use SEH */ - if (!Length || !ByteOffset) return STATUS_INVALID_PARAMETER; + + PAGED_CODE(); + + PreviousMode = KeGetPreviousMode(); + + CapturedByteOffset.QuadPart = 0; + CapturedLength.QuadPart = 0; /* Get File Object */ Status = ObReferenceObjectByHandle(FileHandle, @@ -1984,12 +2076,41 @@ NtLockFile(IN HANDLE FileHandle, &HandleInformation); if (!NT_SUCCESS(Status)) return Status; - /* Must have FILE_READ_DATA | FILE_WRITE_DATA access */ - if (!(HandleInformation.GrantedAccess & (FILE_WRITE_DATA | FILE_READ_DATA))) + if (PreviousMode != KernelMode) { - DPRINT1("Invalid access rights\n"); - ObDereferenceObject(FileObject); - return STATUS_ACCESS_DENIED; + /* Must have either FILE_READ_DATA or FILE_WRITE_DATA access unless + we're in KernelMode! */ + if (!(HandleInformation.GrantedAccess & (FILE_WRITE_DATA | FILE_READ_DATA))) + { + DPRINT1("Invalid access rights\n"); + ObDereferenceObject(FileObject); + return STATUS_ACCESS_DENIED; + } + + _SEH_TRY + { + ProbeForWrite(IoStatusBlock, + sizeof(IO_STATUS_BLOCK), + sizeof(ULONG)); + CapturedByteOffset = ProbeForReadLargeInteger(ByteOffset); + CapturedLength = ProbeForReadLargeInteger(Length); + } + _SEH_HANDLE + { + Status = _SEH_GetExceptionCode(); + } + _SEH_END; + + if (!NT_SUCCESS(Status)) + { + ObDereferenceObject(FileObject); + return Status; + } + } + else + { + CapturedByteOffset = *ByteOffset; + CapturedLength = *Length; } /* Get Event Object */ @@ -2043,7 +2164,7 @@ NtLockFile(IN HANDLE FileHandle, ObDereferenceObject(FileObject); return STATUS_INSUFFICIENT_RESOURCES; } - *LocalLength = *Length; + *LocalLength = CapturedLength; /* Set up the IRP */ Irp->RequestorMode = PreviousMode; @@ -2060,8 +2181,8 @@ NtLockFile(IN HANDLE FileHandle, /* Set Parameters */ StackPtr->Parameters.LockControl.Length = LocalLength; - StackPtr->Parameters.LockControl.ByteOffset = *ByteOffset; - StackPtr->Parameters.LockControl.Key = Key ? Key : 0; + StackPtr->Parameters.LockControl.ByteOffset = CapturedByteOffset; + StackPtr->Parameters.LockControl.Key = Key; /* Set Flags */ if (FailImmediately) StackPtr->Flags = SL_FAIL_IMMEDIATELY; @@ -2709,7 +2830,7 @@ NtReadFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, - IN PLARGE_INTEGER ByteOffset OPTIONAL, /* NOT optional for asynch. operations! */ + IN PLARGE_INTEGER ByteOffset OPTIONAL, IN PULONG Key OPTIONAL) { NTSTATUS Status = STATUS_SUCCESS; @@ -2717,14 +2838,19 @@ NtReadFile(IN HANDLE FileHandle, PIRP Irp = NULL; PDEVICE_OBJECT DeviceObject; PIO_STACK_LOCATION StackPtr; - KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); + KPROCESSOR_MODE PreviousMode; BOOLEAN LocalEvent = FALSE; PKEVENT EventObject = NULL; + LARGE_INTEGER CapturedByteOffset; DPRINT("NtReadFile(FileHandle 0x%p Buffer 0x%p Length %x ByteOffset 0x%p, " "IoStatusBlock 0x%p)\n", FileHandle, Buffer, Length, ByteOffset, IoStatusBlock); + PAGED_CODE(); + + PreviousMode = KeGetPreviousMode(); + CapturedByteOffset.QuadPart = 0; /* Validate User-Mode Buffers */ if(PreviousMode != KernelMode) @@ -2734,11 +2860,14 @@ NtReadFile(IN HANDLE FileHandle, ProbeForWrite(IoStatusBlock, sizeof(IO_STATUS_BLOCK), sizeof(ULONG)); - #if 0 ProbeForWrite(Buffer, Length, - sizeof(ULONG)); - #endif + 1); + if (ByteOffset != NULL) + { + CapturedByteOffset = ProbeForReadLargeInteger(ByteOffset); + } + /* FIXME - probe other pointers and capture information */ } _SEH_HANDLE { @@ -2748,6 +2877,13 @@ NtReadFile(IN HANDLE FileHandle, if(!NT_SUCCESS(Status)) return Status; } + else + { + if (ByteOffset != NULL) + { + CapturedByteOffset = *ByteOffset; + } + } /* Get File Object */ Status = ObReferenceObjectByHandle(FileHandle, @@ -2759,9 +2895,9 @@ NtReadFile(IN HANDLE FileHandle, if (!NT_SUCCESS(Status)) return Status; /* Check the Byte Offset */ - if (!ByteOffset || - (ByteOffset->u.LowPart == FILE_USE_FILE_POINTER_POSITION && - ByteOffset->u.HighPart == -1)) + if (ByteOffset == NULL || + (CapturedByteOffset.u.LowPart == FILE_USE_FILE_POINTER_POSITION && + CapturedByteOffset.u.HighPart == -1)) { /* a valid ByteOffset is required if asynch. op. */ if (!(FileObject->Flags & FO_SYNCHRONOUS_IO)) @@ -2772,7 +2908,7 @@ NtReadFile(IN HANDLE FileHandle, } /* Use the Current Byte OFfset */ - ByteOffset = &FileObject->CurrentByteOffset; + CapturedByteOffset = FileObject->CurrentByteOffset; } /* Check for event */ @@ -2821,7 +2957,7 @@ NtReadFile(IN HANDLE FileHandle, DeviceObject, Buffer, Length, - ByteOffset, + &CapturedByteOffset, EventObject, IoStatusBlock); if (Irp == NULL) @@ -3276,7 +3412,7 @@ NtUnlockFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER ByteOffset, IN PLARGE_INTEGER Length, - OUT ULONG Key OPTIONAL) + IN ULONG Key OPTIONAL) { PFILE_OBJECT FileObject = NULL; PLARGE_INTEGER LocalLength = NULL; @@ -3285,12 +3421,17 @@ NtUnlockFile(IN HANDLE FileHandle, PDEVICE_OBJECT DeviceObject; KEVENT Event; BOOLEAN LocalEvent = FALSE; - KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); + KPROCESSOR_MODE PreviousMode; NTSTATUS Status = STATUS_SUCCESS; + LARGE_INTEGER CapturedByteOffset, CapturedLength; OBJECT_HANDLE_INFORMATION HandleInformation; - - /* FIXME: instead of this, use SEH */ - if (!Length || !ByteOffset) return STATUS_INVALID_PARAMETER; + + PAGED_CODE(); + + PreviousMode = KeGetPreviousMode(); + + CapturedByteOffset.QuadPart = 0; + CapturedLength.QuadPart = 0; /* Get File Object */ Status = ObReferenceObjectByHandle(FileHandle, @@ -3301,12 +3442,41 @@ NtUnlockFile(IN HANDLE FileHandle, &HandleInformation); if (!NT_SUCCESS(Status)) return Status; - /* Must have FILE_READ_DATA | FILE_WRITE_DATA access */ - if (!(HandleInformation.GrantedAccess & (FILE_WRITE_DATA | FILE_READ_DATA))) + if (PreviousMode != KernelMode) { - DPRINT1("Invalid access rights\n"); - ObDereferenceObject(FileObject); - return STATUS_ACCESS_DENIED; + /* Must have either FILE_READ_DATA or FILE_WRITE_DATA access unless we're + in KernelMode! */ + if (!(HandleInformation.GrantedAccess & (FILE_WRITE_DATA | FILE_READ_DATA))) + { + DPRINT1("Invalid access rights\n"); + ObDereferenceObject(FileObject); + return STATUS_ACCESS_DENIED; + } + + _SEH_TRY + { + ProbeForWrite(IoStatusBlock, + sizeof(IO_STATUS_BLOCK), + sizeof(ULONG)); + CapturedByteOffset = ProbeForReadLargeInteger(ByteOffset); + CapturedLength = ProbeForReadLargeInteger(Length); + } + _SEH_HANDLE + { + Status = _SEH_GetExceptionCode(); + } + _SEH_END; + + if (!NT_SUCCESS(Status)) + { + ObDereferenceObject(FileObject); + return Status; + } + } + else + { + CapturedByteOffset = *ByteOffset; + CapturedLength = *Length; } /* Check if this is a direct open or not */ @@ -3349,7 +3519,7 @@ NtUnlockFile(IN HANDLE FileHandle, ObDereferenceObject(FileObject); return STATUS_INSUFFICIENT_RESOURCES; } - *LocalLength = *Length; + *LocalLength = CapturedLength; /* Set up the IRP */ Irp->Flags = (LocalEvent) ? IRP_SYNCHRONOUS_API : 0; @@ -3367,8 +3537,8 @@ NtUnlockFile(IN HANDLE FileHandle, /* Set Parameters */ StackPtr->Parameters.LockControl.Length = LocalLength; - StackPtr->Parameters.LockControl.ByteOffset = *ByteOffset; - StackPtr->Parameters.LockControl.Key = Key ? Key : 0; + StackPtr->Parameters.LockControl.ByteOffset = CapturedByteOffset; + StackPtr->Parameters.LockControl.Key = Key; /* Call the Driver */ Status = IoCallDriver(DeviceObject, Irp); @@ -3424,34 +3594,49 @@ NtWriteFile (IN HANDLE FileHandle, IN PLARGE_INTEGER ByteOffset OPTIONAL, /* NOT optional for asynch. operations! */ IN PULONG Key OPTIONAL) { - OBJECT_HANDLE_INFORMATION HandleInformation; + OBJECT_HANDLE_INFORMATION ObjectHandleInfo; NTSTATUS Status = STATUS_SUCCESS; PFILE_OBJECT FileObject; PIRP Irp = NULL; PDEVICE_OBJECT DeviceObject; PIO_STACK_LOCATION StackPtr; - KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); + KPROCESSOR_MODE PreviousMode; BOOLEAN LocalEvent = FALSE; PKEVENT EventObject = NULL; + LARGE_INTEGER CapturedByteOffset; + ULONG CapturedKey = 0; + ACCESS_MASK DesiredAccess = FILE_WRITE_DATA; DPRINT("NtWriteFile(FileHandle 0x%p Buffer 0x%p Length %x ByteOffset 0x%p, " "IoStatusBlock 0x%p)\n", FileHandle, Buffer, Length, ByteOffset, IoStatusBlock); + PAGED_CODE(); + + PreviousMode = KeGetPreviousMode(); + CapturedByteOffset.QuadPart = 0; + /* Validate User-Mode Buffers */ if(PreviousMode != KernelMode) { _SEH_TRY { - #if 0 ProbeForWrite(IoStatusBlock, sizeof(IO_STATUS_BLOCK), sizeof(ULONG)); ProbeForRead(Buffer, Length, - sizeof(ULONG)); - #endif + 1); + if (ByteOffset != NULL) + { + CapturedByteOffset = ProbeForReadLargeInteger(ByteOffset); + } + + if (Key != NULL) + { + CapturedKey = ProbeForReadUlong(Key); + } } _SEH_HANDLE { @@ -3461,6 +3646,17 @@ NtWriteFile (IN HANDLE FileHandle, if(!NT_SUCCESS(Status)) return Status; } + else + { + if (ByteOffset != NULL) + { + CapturedByteOffset = *ByteOffset; + } + if (Key != NULL) + { + CapturedKey = *Key; + } + } /* Get File Object */ Status = ObReferenceObjectByHandle(FileHandle, @@ -3468,24 +3664,29 @@ NtWriteFile (IN HANDLE FileHandle, IoFileObjectType, PreviousMode, (PVOID*)&FileObject, - &HandleInformation); + &ObjectHandleInfo); if (!NT_SUCCESS(Status)) return Status; - /* Must have FILE_WRITE_DATA | FILE_APPEND_DATA access */ - if (!(HandleInformation.GrantedAccess & (FILE_WRITE_DATA | FILE_APPEND_DATA))) + /* check if the handle has either FILE_WRITE_DATA or FILE_APPEND_DATA was + granted. However, if this is a named pipe, make sure we don't ask for + FILE_APPEND_DATA as it interferes with the FILE_CREATE_PIPE_INSTANCE + access right! */ + if (!(FileObject->Flags & FO_NAMED_PIPE)) + DesiredAccess |= FILE_APPEND_DATA; + if (!RtlAreAnyAccessesGranted(ObjectHandleInfo.GrantedAccess, + DesiredAccess)) { - DPRINT1("Invalid access rights\n"); ObDereferenceObject(FileObject); return STATUS_ACCESS_DENIED; } /* Check if we got write Access */ - if (HandleInformation.GrantedAccess & FILE_WRITE_DATA) + if (ObjectHandleInfo.GrantedAccess & FILE_WRITE_DATA) { /* Check the Byte Offset */ - if (!ByteOffset || - (ByteOffset->u.LowPart == FILE_USE_FILE_POINTER_POSITION && - ByteOffset->u.HighPart == -1)) + if (ByteOffset == NULL || + (CapturedByteOffset.u.LowPart == FILE_USE_FILE_POINTER_POSITION && + CapturedByteOffset.u.HighPart == -1)) { /* a valid ByteOffset is required if asynch. op. */ if (!(FileObject->Flags & FO_SYNCHRONOUS_IO)) @@ -3496,10 +3697,11 @@ NtWriteFile (IN HANDLE FileHandle, } /* Use the Current Byte OFfset */ - ByteOffset = &FileObject->CurrentByteOffset; + CapturedByteOffset = FileObject->CurrentByteOffset; } } - else if (HandleInformation.GrantedAccess & FILE_APPEND_DATA) + else if ((ObjectHandleInfo.GrantedAccess & FILE_APPEND_DATA) && + !(FileObject->Flags & FO_NAMED_PIPE)) { /* a valid ByteOffset is required if asynch. op. */ if (!(FileObject->Flags & FO_SYNCHRONOUS_IO)) @@ -3510,8 +3712,8 @@ NtWriteFile (IN HANDLE FileHandle, } /* Give the drivers somethign to understand */ - ByteOffset->u.LowPart = FILE_WRITE_TO_END_OF_FILE; - ByteOffset->u.HighPart = 0xffffffff; + CapturedByteOffset.u.LowPart = FILE_WRITE_TO_END_OF_FILE; + CapturedByteOffset.u.HighPart = 0xffffffff; } /* Check if we got an event */ @@ -3560,7 +3762,7 @@ NtWriteFile (IN HANDLE FileHandle, DeviceObject, Buffer, Length, - ByteOffset, + &CapturedByteOffset, EventObject, IoStatusBlock); if (Irp == NULL) @@ -3601,7 +3803,7 @@ NtWriteFile (IN HANDLE FileHandle, /* Setup Stack Data */ StackPtr = IoGetNextIrpStackLocation(Irp); StackPtr->FileObject = FileObject; - StackPtr->Parameters.Write.Key = Key ? *Key : 0; + StackPtr->Parameters.Write.Key = CapturedKey; if (FileObject->Flags & FO_WRITE_THROUGH) StackPtr->Flags = SL_WRITE_THROUGH; /* Call the Driver */