mirror of
https://github.com/reactos/reactos.git
synced 2024-12-26 17:14:41 +00:00
- if a file object is a named pipe don't allow the FILE_APPEND_DATA access right as it equals FILE_CREATE_PIPE_INSTANCE (NtFlushBuffersFile and NtWriteFile)
- add more parameters probing and capturing code svn path=/trunk/; revision=18932
This commit is contained in:
Thomas Bluemel
parent
6e138c7f47
commit
0ecd041efc
1 changed files with 292 additions and 90 deletions
|
|
@ -755,7 +755,6 @@ IoCreateFile(OUT PHANDLE FileHandle,
|
|||
IO_SECURITY_CONTEXT SecurityContext;
|
||||
KPROCESSOR_MODE AccessMode;
|
||||
HANDLE LocalHandle;
|
||||
IO_STATUS_BLOCK LocalIoStatusBlock;
|
||||
LARGE_INTEGER SafeAllocationSize;
|
||||
PVOID SystemEaBuffer = NULL;
|
||||
NTSTATUS Status = STATUS_SUCCESS;
|
||||
|
|
@ -988,7 +987,7 @@ IoCreateFile(OUT PHANDLE FileHandle,
|
|||
//trigger FileObject/Event dereferencing
|
||||
Irp->Tail.Overlay.OriginalFileObject = FileObject;
|
||||
Irp->RequestorMode = AccessMode;
|
||||
Irp->UserIosb = &LocalIoStatusBlock;
|
||||
Irp->UserIosb = IoStatusBlock;
|
||||
Irp->AssociatedIrp.SystemBuffer = SystemEaBuffer;
|
||||
Irp->Tail.Overlay.AuxiliaryBuffer = NULL;
|
||||
Irp->Tail.Overlay.Thread = PsGetCurrentThread();
|
||||
|
|
@ -1054,7 +1053,7 @@ IoCreateFile(OUT PHANDLE FileHandle,
|
|||
AccessMode,
|
||||
FALSE,
|
||||
NULL);
|
||||
Status = LocalIoStatusBlock.Status;
|
||||
Status = IoStatusBlock->Status;
|
||||
}
|
||||
if (!NT_SUCCESS(Status))
|
||||
{
|
||||
|
|
@ -1069,7 +1068,6 @@ IoCreateFile(OUT PHANDLE FileHandle,
|
|||
_SEH_TRY
|
||||
{
|
||||
*FileHandle = LocalHandle;
|
||||
*IoStatusBlock = LocalIoStatusBlock;
|
||||
}
|
||||
_SEH_HANDLE
|
||||
{
|
||||
|
|
@ -1380,20 +1378,41 @@ STDCALL
|
|||
NtCancelIoFile(IN HANDLE FileHandle,
|
||||
OUT PIO_STATUS_BLOCK IoStatusBlock)
|
||||
{
|
||||
NTSTATUS Status;
|
||||
PFILE_OBJECT FileObject;
|
||||
PETHREAD Thread;
|
||||
PIRP Irp;
|
||||
KIRQL OldIrql;
|
||||
BOOLEAN OurIrpsInList = FALSE;
|
||||
LARGE_INTEGER Interval;
|
||||
KPROCESSOR_MODE PreviousMode;
|
||||
NTSTATUS Status = STATUS_SUCCESS;
|
||||
|
||||
if ((ULONG_PTR)IoStatusBlock >= (ULONG_PTR)MmUserProbeAddress &&
|
||||
KeGetPreviousMode() != KernelMode)
|
||||
return STATUS_ACCESS_VIOLATION;
|
||||
PAGED_CODE();
|
||||
|
||||
Status = ObReferenceObjectByHandle(FileHandle, 0, IoFileObjectType,
|
||||
KeGetPreviousMode(), (PVOID*)&FileObject,
|
||||
PreviousMode = KeGetPreviousMode();
|
||||
|
||||
if (PreviousMode != KernelMode)
|
||||
{
|
||||
_SEH_TRY
|
||||
{
|
||||
ProbeForWrite(IoStatusBlock,
|
||||
sizeof(IO_STATUS_BLOCK),
|
||||
sizeof(ULONG));
|
||||
}
|
||||
_SEH_HANDLE
|
||||
{
|
||||
Status = _SEH_GetExceptionCode();
|
||||
}
|
||||
_SEH_END;
|
||||
|
||||
if (!NT_SUCCESS(Status)) return Status;
|
||||
}
|
||||
|
||||
Status = ObReferenceObjectByHandle(FileHandle,
|
||||
0,
|
||||
IoFileObjectType,
|
||||
PreviousMode,
|
||||
(PVOID*)&FileObject,
|
||||
NULL);
|
||||
if (!NT_SUCCESS(Status))
|
||||
return Status;
|
||||
|
|
@ -1531,23 +1550,39 @@ NtCreateMailslotFile(OUT PHANDLE FileHandle,
|
|||
MAILSLOT_CREATE_PARAMETERS Buffer;
|
||||
|
||||
DPRINT("NtCreateMailslotFile(FileHandle 0x%p, DesiredAccess %x, "
|
||||
"ObjectAttributes 0x%p ObjectAttributes->ObjectName->Buffer %S)\n",
|
||||
FileHandle,DesiredAccess,ObjectAttributes,
|
||||
ObjectAttributes->ObjectName->Buffer);
|
||||
"ObjectAttributes 0x%p)\n",
|
||||
FileHandle,DesiredAccess,ObjectAttributes);
|
||||
|
||||
PAGED_CODE();
|
||||
|
||||
/* Check for Timeout */
|
||||
if (TimeOut)
|
||||
if (TimeOut != NULL)
|
||||
{
|
||||
/* Enable it */
|
||||
Buffer.TimeoutSpecified = TRUE;
|
||||
if (KeGetPreviousMode() != KernelMode)
|
||||
{
|
||||
NTSTATUS Status = STATUS_SUCCESS;
|
||||
|
||||
/* FIXME: Add SEH */
|
||||
Buffer.ReadTimeout = *TimeOut;
|
||||
_SEH_TRY
|
||||
{
|
||||
Buffer.ReadTimeout = ProbeForReadLargeInteger(TimeOut);
|
||||
}
|
||||
_SEH_HANDLE
|
||||
{
|
||||
Status = _SEH_GetExceptionCode();
|
||||
}
|
||||
_SEH_END;
|
||||
|
||||
if (!NT_SUCCESS(Status)) return Status;
|
||||
}
|
||||
else
|
||||
{
|
||||
Buffer.ReadTimeout = *TimeOut;
|
||||
}
|
||||
|
||||
Buffer.TimeoutSpecified = TRUE;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* No timeout */
|
||||
Buffer.TimeoutSpecified = FALSE;
|
||||
}
|
||||
|
||||
|
|
@ -1592,26 +1627,40 @@ NtCreateNamedPipeFile(PHANDLE FileHandle,
|
|||
NAMED_PIPE_CREATE_PARAMETERS Buffer;
|
||||
|
||||
DPRINT("NtCreateNamedPipeFile(FileHandle 0x%p, DesiredAccess %x, "
|
||||
"ObjectAttributes 0x%p ObjectAttributes->ObjectName->Buffer %S)\n",
|
||||
FileHandle,DesiredAccess,ObjectAttributes,
|
||||
ObjectAttributes->ObjectName->Buffer);
|
||||
"ObjectAttributes 0x%p)\n",
|
||||
FileHandle,DesiredAccess,ObjectAttributes);
|
||||
|
||||
PAGED_CODE();
|
||||
|
||||
/* Check for Timeout */
|
||||
if (DefaultTimeout)
|
||||
if (DefaultTimeout != NULL)
|
||||
{
|
||||
/* Enable it */
|
||||
Buffer.TimeoutSpecified = TRUE;
|
||||
if (KeGetPreviousMode() != KernelMode)
|
||||
{
|
||||
NTSTATUS Status = STATUS_SUCCESS;
|
||||
|
||||
/* FIXME: Add SEH */
|
||||
Buffer.DefaultTimeout = *DefaultTimeout;
|
||||
_SEH_TRY
|
||||
{
|
||||
Buffer.DefaultTimeout = ProbeForReadLargeInteger(DefaultTimeout);
|
||||
}
|
||||
_SEH_HANDLE
|
||||
{
|
||||
Status = _SEH_GetExceptionCode();
|
||||
}
|
||||
_SEH_END;
|
||||
|
||||
if (!NT_SUCCESS(Status)) return Status;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* No timeout */
|
||||
Buffer.TimeoutSpecified = FALSE;
|
||||
Buffer.DefaultTimeout = *DefaultTimeout;
|
||||
}
|
||||
|
||||
Buffer.TimeoutSpecified = TRUE;
|
||||
}
|
||||
else
|
||||
Buffer.TimeoutSpecified = FALSE;
|
||||
|
||||
/* Set Settings */
|
||||
Buffer.NamedPipeType = NamedPipeType;
|
||||
Buffer.ReadMode = ReadMode;
|
||||
|
|
@ -1724,6 +1773,8 @@ NTSTATUS
|
|||
STDCALL
|
||||
NtFlushWriteBuffer(VOID)
|
||||
{
|
||||
PAGED_CODE();
|
||||
|
||||
KeFlushWriteBuffer();
|
||||
return STATUS_SUCCESS;
|
||||
}
|
||||
|
|
@ -1746,20 +1797,56 @@ NtFlushBuffersFile(IN HANDLE FileHandle,
|
|||
PFILE_OBJECT FileObject = NULL;
|
||||
PIRP Irp;
|
||||
PIO_STACK_LOCATION StackPtr;
|
||||
NTSTATUS Status;
|
||||
NTSTATUS Status = STATUS_SUCCESS;
|
||||
PDEVICE_OBJECT DeviceObject;
|
||||
KEVENT Event;
|
||||
BOOLEAN LocalEvent = FALSE;
|
||||
KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
|
||||
ACCESS_MASK DesiredAccess = FILE_WRITE_DATA;
|
||||
OBJECT_HANDLE_INFORMATION ObjectHandleInfo;
|
||||
KPROCESSOR_MODE PreviousMode;
|
||||
|
||||
PAGED_CODE();
|
||||
|
||||
PreviousMode = KeGetPreviousMode();
|
||||
|
||||
if (PreviousMode != KernelMode)
|
||||
{
|
||||
_SEH_TRY
|
||||
{
|
||||
ProbeForWrite(IoStatusBlock,
|
||||
sizeof(IO_STATUS_BLOCK),
|
||||
sizeof(ULONG));
|
||||
}
|
||||
_SEH_HANDLE
|
||||
{
|
||||
Status = _SEH_GetExceptionCode();
|
||||
}
|
||||
_SEH_END;
|
||||
|
||||
if (!NT_SUCCESS(Status)) return Status;
|
||||
}
|
||||
|
||||
/* Get the File Object */
|
||||
Status = ObReferenceObjectByHandle(FileHandle,
|
||||
FILE_WRITE_DATA,
|
||||
NULL,
|
||||
0,
|
||||
IoFileObjectType,
|
||||
PreviousMode,
|
||||
(PVOID*)&FileObject,
|
||||
NULL);
|
||||
if (Status != STATUS_SUCCESS) return(Status);
|
||||
&ObjectHandleInfo);
|
||||
if (!NT_SUCCESS(Status)) return(Status);
|
||||
|
||||
/* check if the handle has either FILE_WRITE_DATA or FILE_APPEND_DATA was
|
||||
granted. However, if this is a named pipe, make sure we don't ask for
|
||||
FILE_APPEND_DATA as it interferes with the FILE_CREATE_PIPE_INSTANCE
|
||||
access right! */
|
||||
if (!(FileObject->Flags & FO_NAMED_PIPE))
|
||||
DesiredAccess |= FILE_APPEND_DATA;
|
||||
if (!RtlAreAnyAccessesGranted(ObjectHandleInfo.GrantedAccess,
|
||||
DesiredAccess))
|
||||
{
|
||||
ObDereferenceObject(FileObject);
|
||||
return STATUS_ACCESS_DENIED;
|
||||
}
|
||||
|
||||
/* Check if this is a direct open or not */
|
||||
if (FileObject->Flags & FO_DIRECT_DEVICE_OPEN)
|
||||
|
|
@ -1968,12 +2055,17 @@ NtLockFile(IN HANDLE FileHandle,
|
|||
PDEVICE_OBJECT DeviceObject;
|
||||
PKEVENT Event = NULL;
|
||||
BOOLEAN LocalEvent = FALSE;
|
||||
KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
|
||||
KPROCESSOR_MODE PreviousMode;
|
||||
LARGE_INTEGER CapturedByteOffset, CapturedLength;
|
||||
NTSTATUS Status = STATUS_SUCCESS;
|
||||
OBJECT_HANDLE_INFORMATION HandleInformation;
|
||||
|
||||
/* FIXME: instead of this, use SEH */
|
||||
if (!Length || !ByteOffset) return STATUS_INVALID_PARAMETER;
|
||||
PAGED_CODE();
|
||||
|
||||
PreviousMode = KeGetPreviousMode();
|
||||
|
||||
CapturedByteOffset.QuadPart = 0;
|
||||
CapturedLength.QuadPart = 0;
|
||||
|
||||
/* Get File Object */
|
||||
Status = ObReferenceObjectByHandle(FileHandle,
|
||||
|
|
@ -1984,7 +2076,10 @@ NtLockFile(IN HANDLE FileHandle,
|
|||
&HandleInformation);
|
||||
if (!NT_SUCCESS(Status)) return Status;
|
||||
|
||||
/* Must have FILE_READ_DATA | FILE_WRITE_DATA access */
|
||||
if (PreviousMode != KernelMode)
|
||||
{
|
||||
/* Must have either FILE_READ_DATA or FILE_WRITE_DATA access unless
|
||||
we're in KernelMode! */
|
||||
if (!(HandleInformation.GrantedAccess & (FILE_WRITE_DATA | FILE_READ_DATA)))
|
||||
{
|
||||
DPRINT1("Invalid access rights\n");
|
||||
|
|
@ -1992,6 +2087,32 @@ NtLockFile(IN HANDLE FileHandle,
|
|||
return STATUS_ACCESS_DENIED;
|
||||
}
|
||||
|
||||
_SEH_TRY
|
||||
{
|
||||
ProbeForWrite(IoStatusBlock,
|
||||
sizeof(IO_STATUS_BLOCK),
|
||||
sizeof(ULONG));
|
||||
CapturedByteOffset = ProbeForReadLargeInteger(ByteOffset);
|
||||
CapturedLength = ProbeForReadLargeInteger(Length);
|
||||
}
|
||||
_SEH_HANDLE
|
||||
{
|
||||
Status = _SEH_GetExceptionCode();
|
||||
}
|
||||
_SEH_END;
|
||||
|
||||
if (!NT_SUCCESS(Status))
|
||||
{
|
||||
ObDereferenceObject(FileObject);
|
||||
return Status;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
CapturedByteOffset = *ByteOffset;
|
||||
CapturedLength = *Length;
|
||||
}
|
||||
|
||||
/* Get Event Object */
|
||||
if (EventHandle)
|
||||
{
|
||||
|
|
@ -2043,7 +2164,7 @@ NtLockFile(IN HANDLE FileHandle,
|
|||
ObDereferenceObject(FileObject);
|
||||
return STATUS_INSUFFICIENT_RESOURCES;
|
||||
}
|
||||
*LocalLength = *Length;
|
||||
*LocalLength = CapturedLength;
|
||||
|
||||
/* Set up the IRP */
|
||||
Irp->RequestorMode = PreviousMode;
|
||||
|
|
@ -2060,8 +2181,8 @@ NtLockFile(IN HANDLE FileHandle,
|
|||
|
||||
/* Set Parameters */
|
||||
StackPtr->Parameters.LockControl.Length = LocalLength;
|
||||
StackPtr->Parameters.LockControl.ByteOffset = *ByteOffset;
|
||||
StackPtr->Parameters.LockControl.Key = Key ? Key : 0;
|
||||
StackPtr->Parameters.LockControl.ByteOffset = CapturedByteOffset;
|
||||
StackPtr->Parameters.LockControl.Key = Key;
|
||||
|
||||
/* Set Flags */
|
||||
if (FailImmediately) StackPtr->Flags = SL_FAIL_IMMEDIATELY;
|
||||
|
|
@ -2709,7 +2830,7 @@ NtReadFile(IN HANDLE FileHandle,
|
|||
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
||||
OUT PVOID Buffer,
|
||||
IN ULONG Length,
|
||||
IN PLARGE_INTEGER ByteOffset OPTIONAL, /* NOT optional for asynch. operations! */
|
||||
IN PLARGE_INTEGER ByteOffset OPTIONAL,
|
||||
IN PULONG Key OPTIONAL)
|
||||
{
|
||||
NTSTATUS Status = STATUS_SUCCESS;
|
||||
|
|
@ -2717,15 +2838,20 @@ NtReadFile(IN HANDLE FileHandle,
|
|||
PIRP Irp = NULL;
|
||||
PDEVICE_OBJECT DeviceObject;
|
||||
PIO_STACK_LOCATION StackPtr;
|
||||
KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
|
||||
KPROCESSOR_MODE PreviousMode;
|
||||
BOOLEAN LocalEvent = FALSE;
|
||||
PKEVENT EventObject = NULL;
|
||||
LARGE_INTEGER CapturedByteOffset;
|
||||
|
||||
DPRINT("NtReadFile(FileHandle 0x%p Buffer 0x%p Length %x ByteOffset 0x%p, "
|
||||
"IoStatusBlock 0x%p)\n", FileHandle, Buffer, Length, ByteOffset,
|
||||
IoStatusBlock);
|
||||
|
||||
PAGED_CODE();
|
||||
|
||||
PreviousMode = KeGetPreviousMode();
|
||||
CapturedByteOffset.QuadPart = 0;
|
||||
|
||||
/* Validate User-Mode Buffers */
|
||||
if(PreviousMode != KernelMode)
|
||||
{
|
||||
|
|
@ -2734,11 +2860,14 @@ NtReadFile(IN HANDLE FileHandle,
|
|||
ProbeForWrite(IoStatusBlock,
|
||||
sizeof(IO_STATUS_BLOCK),
|
||||
sizeof(ULONG));
|
||||
#if 0
|
||||
ProbeForWrite(Buffer,
|
||||
Length,
|
||||
sizeof(ULONG));
|
||||
#endif
|
||||
1);
|
||||
if (ByteOffset != NULL)
|
||||
{
|
||||
CapturedByteOffset = ProbeForReadLargeInteger(ByteOffset);
|
||||
}
|
||||
/* FIXME - probe other pointers and capture information */
|
||||
}
|
||||
_SEH_HANDLE
|
||||
{
|
||||
|
|
@ -2748,6 +2877,13 @@ NtReadFile(IN HANDLE FileHandle,
|
|||
|
||||
if(!NT_SUCCESS(Status)) return Status;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (ByteOffset != NULL)
|
||||
{
|
||||
CapturedByteOffset = *ByteOffset;
|
||||
}
|
||||
}
|
||||
|
||||
/* Get File Object */
|
||||
Status = ObReferenceObjectByHandle(FileHandle,
|
||||
|
|
@ -2759,9 +2895,9 @@ NtReadFile(IN HANDLE FileHandle,
|
|||
if (!NT_SUCCESS(Status)) return Status;
|
||||
|
||||
/* Check the Byte Offset */
|
||||
if (!ByteOffset ||
|
||||
(ByteOffset->u.LowPart == FILE_USE_FILE_POINTER_POSITION &&
|
||||
ByteOffset->u.HighPart == -1))
|
||||
if (ByteOffset == NULL ||
|
||||
(CapturedByteOffset.u.LowPart == FILE_USE_FILE_POINTER_POSITION &&
|
||||
CapturedByteOffset.u.HighPart == -1))
|
||||
{
|
||||
/* a valid ByteOffset is required if asynch. op. */
|
||||
if (!(FileObject->Flags & FO_SYNCHRONOUS_IO))
|
||||
|
|
@ -2772,7 +2908,7 @@ NtReadFile(IN HANDLE FileHandle,
|
|||
}
|
||||
|
||||
/* Use the Current Byte OFfset */
|
||||
ByteOffset = &FileObject->CurrentByteOffset;
|
||||
CapturedByteOffset = FileObject->CurrentByteOffset;
|
||||
}
|
||||
|
||||
/* Check for event */
|
||||
|
|
@ -2821,7 +2957,7 @@ NtReadFile(IN HANDLE FileHandle,
|
|||
DeviceObject,
|
||||
Buffer,
|
||||
Length,
|
||||
ByteOffset,
|
||||
&CapturedByteOffset,
|
||||
EventObject,
|
||||
IoStatusBlock);
|
||||
if (Irp == NULL)
|
||||
|
|
@ -3276,7 +3412,7 @@ NtUnlockFile(IN HANDLE FileHandle,
|
|||
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
||||
IN PLARGE_INTEGER ByteOffset,
|
||||
IN PLARGE_INTEGER Length,
|
||||
OUT ULONG Key OPTIONAL)
|
||||
IN ULONG Key OPTIONAL)
|
||||
{
|
||||
PFILE_OBJECT FileObject = NULL;
|
||||
PLARGE_INTEGER LocalLength = NULL;
|
||||
|
|
@ -3285,12 +3421,17 @@ NtUnlockFile(IN HANDLE FileHandle,
|
|||
PDEVICE_OBJECT DeviceObject;
|
||||
KEVENT Event;
|
||||
BOOLEAN LocalEvent = FALSE;
|
||||
KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
|
||||
KPROCESSOR_MODE PreviousMode;
|
||||
NTSTATUS Status = STATUS_SUCCESS;
|
||||
LARGE_INTEGER CapturedByteOffset, CapturedLength;
|
||||
OBJECT_HANDLE_INFORMATION HandleInformation;
|
||||
|
||||
/* FIXME: instead of this, use SEH */
|
||||
if (!Length || !ByteOffset) return STATUS_INVALID_PARAMETER;
|
||||
PAGED_CODE();
|
||||
|
||||
PreviousMode = KeGetPreviousMode();
|
||||
|
||||
CapturedByteOffset.QuadPart = 0;
|
||||
CapturedLength.QuadPart = 0;
|
||||
|
||||
/* Get File Object */
|
||||
Status = ObReferenceObjectByHandle(FileHandle,
|
||||
|
|
@ -3301,7 +3442,10 @@ NtUnlockFile(IN HANDLE FileHandle,
|
|||
&HandleInformation);
|
||||
if (!NT_SUCCESS(Status)) return Status;
|
||||
|
||||
/* Must have FILE_READ_DATA | FILE_WRITE_DATA access */
|
||||
if (PreviousMode != KernelMode)
|
||||
{
|
||||
/* Must have either FILE_READ_DATA or FILE_WRITE_DATA access unless we're
|
||||
in KernelMode! */
|
||||
if (!(HandleInformation.GrantedAccess & (FILE_WRITE_DATA | FILE_READ_DATA)))
|
||||
{
|
||||
DPRINT1("Invalid access rights\n");
|
||||
|
|
@ -3309,6 +3453,32 @@ NtUnlockFile(IN HANDLE FileHandle,
|
|||
return STATUS_ACCESS_DENIED;
|
||||
}
|
||||
|
||||
_SEH_TRY
|
||||
{
|
||||
ProbeForWrite(IoStatusBlock,
|
||||
sizeof(IO_STATUS_BLOCK),
|
||||
sizeof(ULONG));
|
||||
CapturedByteOffset = ProbeForReadLargeInteger(ByteOffset);
|
||||
CapturedLength = ProbeForReadLargeInteger(Length);
|
||||
}
|
||||
_SEH_HANDLE
|
||||
{
|
||||
Status = _SEH_GetExceptionCode();
|
||||
}
|
||||
_SEH_END;
|
||||
|
||||
if (!NT_SUCCESS(Status))
|
||||
{
|
||||
ObDereferenceObject(FileObject);
|
||||
return Status;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
CapturedByteOffset = *ByteOffset;
|
||||
CapturedLength = *Length;
|
||||
}
|
||||
|
||||
/* Check if this is a direct open or not */
|
||||
if (FileObject->Flags & FO_DIRECT_DEVICE_OPEN)
|
||||
{
|
||||
|
|
@ -3349,7 +3519,7 @@ NtUnlockFile(IN HANDLE FileHandle,
|
|||
ObDereferenceObject(FileObject);
|
||||
return STATUS_INSUFFICIENT_RESOURCES;
|
||||
}
|
||||
*LocalLength = *Length;
|
||||
*LocalLength = CapturedLength;
|
||||
|
||||
/* Set up the IRP */
|
||||
Irp->Flags = (LocalEvent) ? IRP_SYNCHRONOUS_API : 0;
|
||||
|
|
@ -3367,8 +3537,8 @@ NtUnlockFile(IN HANDLE FileHandle,
|
|||
|
||||
/* Set Parameters */
|
||||
StackPtr->Parameters.LockControl.Length = LocalLength;
|
||||
StackPtr->Parameters.LockControl.ByteOffset = *ByteOffset;
|
||||
StackPtr->Parameters.LockControl.Key = Key ? Key : 0;
|
||||
StackPtr->Parameters.LockControl.ByteOffset = CapturedByteOffset;
|
||||
StackPtr->Parameters.LockControl.Key = Key;
|
||||
|
||||
/* Call the Driver */
|
||||
Status = IoCallDriver(DeviceObject, Irp);
|
||||
|
|
@ -3424,34 +3594,49 @@ NtWriteFile (IN HANDLE FileHandle,
|
|||
IN PLARGE_INTEGER ByteOffset OPTIONAL, /* NOT optional for asynch. operations! */
|
||||
IN PULONG Key OPTIONAL)
|
||||
{
|
||||
OBJECT_HANDLE_INFORMATION HandleInformation;
|
||||
OBJECT_HANDLE_INFORMATION ObjectHandleInfo;
|
||||
NTSTATUS Status = STATUS_SUCCESS;
|
||||
PFILE_OBJECT FileObject;
|
||||
PIRP Irp = NULL;
|
||||
PDEVICE_OBJECT DeviceObject;
|
||||
PIO_STACK_LOCATION StackPtr;
|
||||
KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
|
||||
KPROCESSOR_MODE PreviousMode;
|
||||
BOOLEAN LocalEvent = FALSE;
|
||||
PKEVENT EventObject = NULL;
|
||||
LARGE_INTEGER CapturedByteOffset;
|
||||
ULONG CapturedKey = 0;
|
||||
ACCESS_MASK DesiredAccess = FILE_WRITE_DATA;
|
||||
|
||||
DPRINT("NtWriteFile(FileHandle 0x%p Buffer 0x%p Length %x ByteOffset 0x%p, "
|
||||
"IoStatusBlock 0x%p)\n", FileHandle, Buffer, Length, ByteOffset,
|
||||
IoStatusBlock);
|
||||
|
||||
PAGED_CODE();
|
||||
|
||||
PreviousMode = KeGetPreviousMode();
|
||||
CapturedByteOffset.QuadPart = 0;
|
||||
|
||||
/* Validate User-Mode Buffers */
|
||||
if(PreviousMode != KernelMode)
|
||||
{
|
||||
_SEH_TRY
|
||||
{
|
||||
#if 0
|
||||
ProbeForWrite(IoStatusBlock,
|
||||
sizeof(IO_STATUS_BLOCK),
|
||||
sizeof(ULONG));
|
||||
|
||||
ProbeForRead(Buffer,
|
||||
Length,
|
||||
sizeof(ULONG));
|
||||
#endif
|
||||
1);
|
||||
if (ByteOffset != NULL)
|
||||
{
|
||||
CapturedByteOffset = ProbeForReadLargeInteger(ByteOffset);
|
||||
}
|
||||
|
||||
if (Key != NULL)
|
||||
{
|
||||
CapturedKey = ProbeForReadUlong(Key);
|
||||
}
|
||||
}
|
||||
_SEH_HANDLE
|
||||
{
|
||||
|
|
@ -3461,6 +3646,17 @@ NtWriteFile (IN HANDLE FileHandle,
|
|||
|
||||
if(!NT_SUCCESS(Status)) return Status;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (ByteOffset != NULL)
|
||||
{
|
||||
CapturedByteOffset = *ByteOffset;
|
||||
}
|
||||
if (Key != NULL)
|
||||
{
|
||||
CapturedKey = *Key;
|
||||
}
|
||||
}
|
||||
|
||||
/* Get File Object */
|
||||
Status = ObReferenceObjectByHandle(FileHandle,
|
||||
|
|
@ -3468,24 +3664,29 @@ NtWriteFile (IN HANDLE FileHandle,
|
|||
IoFileObjectType,
|
||||
PreviousMode,
|
||||
(PVOID*)&FileObject,
|
||||
&HandleInformation);
|
||||
&ObjectHandleInfo);
|
||||
if (!NT_SUCCESS(Status)) return Status;
|
||||
|
||||
/* Must have FILE_WRITE_DATA | FILE_APPEND_DATA access */
|
||||
if (!(HandleInformation.GrantedAccess & (FILE_WRITE_DATA | FILE_APPEND_DATA)))
|
||||
/* check if the handle has either FILE_WRITE_DATA or FILE_APPEND_DATA was
|
||||
granted. However, if this is a named pipe, make sure we don't ask for
|
||||
FILE_APPEND_DATA as it interferes with the FILE_CREATE_PIPE_INSTANCE
|
||||
access right! */
|
||||
if (!(FileObject->Flags & FO_NAMED_PIPE))
|
||||
DesiredAccess |= FILE_APPEND_DATA;
|
||||
if (!RtlAreAnyAccessesGranted(ObjectHandleInfo.GrantedAccess,
|
||||
DesiredAccess))
|
||||
{
|
||||
DPRINT1("Invalid access rights\n");
|
||||
ObDereferenceObject(FileObject);
|
||||
return STATUS_ACCESS_DENIED;
|
||||
}
|
||||
|
||||
/* Check if we got write Access */
|
||||
if (HandleInformation.GrantedAccess & FILE_WRITE_DATA)
|
||||
if (ObjectHandleInfo.GrantedAccess & FILE_WRITE_DATA)
|
||||
{
|
||||
/* Check the Byte Offset */
|
||||
if (!ByteOffset ||
|
||||
(ByteOffset->u.LowPart == FILE_USE_FILE_POINTER_POSITION &&
|
||||
ByteOffset->u.HighPart == -1))
|
||||
if (ByteOffset == NULL ||
|
||||
(CapturedByteOffset.u.LowPart == FILE_USE_FILE_POINTER_POSITION &&
|
||||
CapturedByteOffset.u.HighPart == -1))
|
||||
{
|
||||
/* a valid ByteOffset is required if asynch. op. */
|
||||
if (!(FileObject->Flags & FO_SYNCHRONOUS_IO))
|
||||
|
|
@ -3496,10 +3697,11 @@ NtWriteFile (IN HANDLE FileHandle,
|
|||
}
|
||||
|
||||
/* Use the Current Byte OFfset */
|
||||
ByteOffset = &FileObject->CurrentByteOffset;
|
||||
CapturedByteOffset = FileObject->CurrentByteOffset;
|
||||
}
|
||||
}
|
||||
else if (HandleInformation.GrantedAccess & FILE_APPEND_DATA)
|
||||
else if ((ObjectHandleInfo.GrantedAccess & FILE_APPEND_DATA) &&
|
||||
!(FileObject->Flags & FO_NAMED_PIPE))
|
||||
{
|
||||
/* a valid ByteOffset is required if asynch. op. */
|
||||
if (!(FileObject->Flags & FO_SYNCHRONOUS_IO))
|
||||
|
|
@ -3510,8 +3712,8 @@ NtWriteFile (IN HANDLE FileHandle,
|
|||
}
|
||||
|
||||
/* Give the drivers somethign to understand */
|
||||
ByteOffset->u.LowPart = FILE_WRITE_TO_END_OF_FILE;
|
||||
ByteOffset->u.HighPart = 0xffffffff;
|
||||
CapturedByteOffset.u.LowPart = FILE_WRITE_TO_END_OF_FILE;
|
||||
CapturedByteOffset.u.HighPart = 0xffffffff;
|
||||
}
|
||||
|
||||
/* Check if we got an event */
|
||||
|
|
@ -3560,7 +3762,7 @@ NtWriteFile (IN HANDLE FileHandle,
|
|||
DeviceObject,
|
||||
Buffer,
|
||||
Length,
|
||||
ByteOffset,
|
||||
&CapturedByteOffset,
|
||||
EventObject,
|
||||
IoStatusBlock);
|
||||
if (Irp == NULL)
|
||||
|
|
@ -3601,7 +3803,7 @@ NtWriteFile (IN HANDLE FileHandle,
|
|||
/* Setup Stack Data */
|
||||
StackPtr = IoGetNextIrpStackLocation(Irp);
|
||||
StackPtr->FileObject = FileObject;
|
||||
StackPtr->Parameters.Write.Key = Key ? *Key : 0;
|
||||
StackPtr->Parameters.Write.Key = CapturedKey;
|
||||
if (FileObject->Flags & FO_WRITE_THROUGH) StackPtr->Flags = SL_WRITE_THROUGH;
|
||||
|
||||
/* Call the Driver */
|
||||
|
|
|
|||
Loading…
Reference in a new issue