- use inlined probing macros for basic types

- minor optimizations by comparing the processor mode against KernelMode (==0) instead of UserMode (==1)

svn path=/trunk/; revision=17467
This commit is contained in:
Thomas Bluemel 2005-08-21 19:04:23 +00:00
parent 84f88f6480
commit 5e348c00c1
31 changed files with 85 additions and 174 deletions

View file

@ -1145,9 +1145,7 @@ NtOpenKey(OUT PHANDLE KeyHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(KeyHandle, ProbeForWriteHandle(KeyHandle);
sizeof(HANDLE),
sizeof(ULONG));
} }
_SEH_HANDLE _SEH_HANDLE
{ {

View file

@ -242,7 +242,7 @@ NtPulseEvent(IN HANDLE EventHandle,
EventHandle, PreviousState); EventHandle, PreviousState);
/* Check buffer validity */ /* Check buffer validity */
if(PreviousState && PreviousMode == UserMode) { if(PreviousState && PreviousMode != KernelMode) {
_SEH_TRY { _SEH_TRY {
@ -376,7 +376,7 @@ NtResetEvent(IN HANDLE EventHandle,
EventHandle, PreviousState); EventHandle, PreviousState);
/* Check buffer validity */ /* Check buffer validity */
if(PreviousState && PreviousMode == UserMode) { if(PreviousState && PreviousMode != KernelMode) {
_SEH_TRY { _SEH_TRY {
@ -441,7 +441,7 @@ NtSetEvent(IN HANDLE EventHandle,
EventHandle, PreviousState); EventHandle, PreviousState);
/* Check buffer validity */ /* Check buffer validity */
if(PreviousState != NULL && PreviousMode == UserMode) { if(PreviousState != NULL && PreviousMode != KernelMode) {
_SEH_TRY { _SEH_TRY {

View file

@ -1541,7 +1541,7 @@ NtQuerySystemInformation (IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
_SEH_TRY _SEH_TRY
{ {
if (PreviousMode == UserMode) if (PreviousMode != KernelMode)
{ {
/* SystemKernelDebuggerInformation needs only BOOLEAN alignment */ /* SystemKernelDebuggerInformation needs only BOOLEAN alignment */
ProbeForWrite(SystemInformation, Length, 1); ProbeForWrite(SystemInformation, Length, 1);

View file

@ -261,7 +261,7 @@ typedef struct _INFORMATION_CLASS_INFO
#define ProbeQueryInfoBuffer(Buffer, BufferLen, Alignment, RetLen, PrevMode, StatusVar) \ #define ProbeQueryInfoBuffer(Buffer, BufferLen, Alignment, RetLen, PrevMode, StatusVar) \
do { \ do { \
if(PrevMode == UserMode) \ if(PrevMode != KernelMode) \
{ \ { \
_SEH_TRY \ _SEH_TRY \
{ \ { \
@ -291,7 +291,7 @@ typedef struct _INFORMATION_CLASS_INFO
#define ProbeSetInfoBuffer(Buffer, BufferLen, Alignment, PrevMode, StatusVar) \ #define ProbeSetInfoBuffer(Buffer, BufferLen, Alignment, PrevMode, StatusVar) \
do { \ do { \
if(PrevMode == UserMode) \ if(PrevMode != KernelMode) \
{ \ { \
_SEH_TRY \ _SEH_TRY \
{ \ { \

View file

@ -781,18 +781,13 @@ IoCreateFile(OUT PHANDLE FileHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(FileHandle, ProbeForWriteHandle(FileHandle);
sizeof(HANDLE),
sizeof(ULONG));
ProbeForWrite(IoStatusBlock, ProbeForWrite(IoStatusBlock,
sizeof(IO_STATUS_BLOCK), sizeof(IO_STATUS_BLOCK),
sizeof(ULONG)); sizeof(ULONG));
if(AllocationSize != NULL) if(AllocationSize != NULL)
{ {
ProbeForRead(AllocationSize, SafeAllocationSize = ProbeForReadLargeInteger(AllocationSize);
sizeof(LARGE_INTEGER),
sizeof(ULONG));
SafeAllocationSize = *AllocationSize;
} }
else else
SafeAllocationSize.QuadPart = 0; SafeAllocationSize.QuadPart = 0;
@ -1395,7 +1390,7 @@ NtCancelIoFile(IN HANDLE FileHandle,
LARGE_INTEGER Interval; LARGE_INTEGER Interval;
if ((ULONG_PTR)IoStatusBlock >= (ULONG_PTR)MmUserProbeAddress && if ((ULONG_PTR)IoStatusBlock >= (ULONG_PTR)MmUserProbeAddress &&
KeGetPreviousMode() == UserMode) KeGetPreviousMode() != KernelMode)
return STATUS_ACCESS_VIOLATION; return STATUS_ACCESS_VIOLATION;
Status = ObReferenceObjectByHandle(FileHandle, 0, IoFileObjectType, Status = ObReferenceObjectByHandle(FileHandle, 0, IoFileObjectType,

View file

@ -237,9 +237,7 @@ NtCreateIoCompletion(OUT PHANDLE IoCompletionHandle,
_SEH_TRY { _SEH_TRY {
ProbeForWrite(IoCompletionHandle, ProbeForWriteHandle(IoCompletionHandle);
sizeof(HANDLE),
sizeof(ULONG));
} _SEH_HANDLE { } _SEH_HANDLE {
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
@ -309,9 +307,7 @@ NtOpenIoCompletion(OUT PHANDLE IoCompletionHandle,
_SEH_TRY { _SEH_TRY {
ProbeForWrite(IoCompletionHandle, ProbeForWriteHandle(IoCompletionHandle);
sizeof(HANDLE),
sizeof(ULONG));
} _SEH_HANDLE { } _SEH_HANDLE {
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
@ -432,21 +428,14 @@ NtRemoveIoCompletion(IN HANDLE IoCompletionHandle,
_SEH_TRY { _SEH_TRY {
ProbeForWrite(CompletionKey, ProbeForWritePointer(CompletionKey);
sizeof(PVOID), ProbeForWritePointer(CompletionContext);
sizeof(ULONG));
ProbeForWrite(CompletionContext,
sizeof(PVOID),
sizeof(ULONG));
ProbeForWrite(IoStatusBlock, ProbeForWrite(IoStatusBlock,
sizeof(IO_STATUS_BLOCK), sizeof(IO_STATUS_BLOCK),
sizeof(ULONG)); sizeof(ULONG));
if (Timeout != NULL) { if (Timeout != NULL) {
ProbeForRead(Timeout, SafeTimeout = ProbeForReadLargeInteger(Timeout);
sizeof(LARGE_INTEGER),
sizeof(ULONG));
SafeTimeout = *Timeout;
Timeout = &SafeTimeout; Timeout = &SafeTimeout;
} }
} _SEH_HANDLE { } _SEH_HANDLE {

View file

@ -173,7 +173,7 @@ NtGetPlugPlayEvent(IN ULONG Reserved1,
DPRINT("NtGetPlugPlayEvent() called\n"); DPRINT("NtGetPlugPlayEvent() called\n");
/* Function can only be called from user-mode */ /* Function can only be called from user-mode */
if (KeGetPreviousMode() != UserMode) if (KeGetPreviousMode() == KernelMode)
{ {
DPRINT1("NtGetPlugPlayEvent cannot be called from kernel mode!\n"); DPRINT1("NtGetPlugPlayEvent cannot be called from kernel mode!\n");
return STATUS_ACCESS_DENIED; return STATUS_ACCESS_DENIED;
@ -636,7 +636,7 @@ NtPlugPlayControl(IN PLUGPLAY_CONTROL_CLASS PlugPlayControlClass,
PlugPlayControlClass, Buffer, BufferLength); PlugPlayControlClass, Buffer, BufferLength);
/* Function can only be called from user-mode */ /* Function can only be called from user-mode */
if (KeGetPreviousMode() != UserMode) if (KeGetPreviousMode() == KernelMode)
{ {
DPRINT1("NtGetPlugPlayEvent cannot be called from kernel mode!\n"); DPRINT1("NtGetPlugPlayEvent cannot be called from kernel mode!\n");
return STATUS_ACCESS_DENIED; return STATUS_ACCESS_DENIED;

View file

@ -1206,7 +1206,7 @@ KdbEnterDebuggerException(
ul = min(ExpNr, RTL_NUMBER_OF(KdbEnterConditions) - 1); ul = min(ExpNr, RTL_NUMBER_OF(KdbEnterConditions) - 1);
EnterCondition = KdbEnterConditions[ul][FirstChance ? 0 : 1]; EnterCondition = KdbEnterConditions[ul][FirstChance ? 0 : 1];
if (EnterCondition == KdbDoNotEnter || if (EnterCondition == KdbDoNotEnter ||
(EnterCondition == KdbEnterFromUmode && PreviousMode != UserMode) || (EnterCondition == KdbEnterFromUmode && PreviousMode == KernelMode) ||
(EnterCondition == KdbEnterFromKmode && PreviousMode != KernelMode)) (EnterCondition == KdbEnterFromKmode && PreviousMode != KernelMode))
{ {
EnterConditionMet = FALSE; EnterConditionMet = FALSE;

View file

@ -360,7 +360,7 @@ KiInsertQueueApc(PKAPC Apc,
} }
} else if ((Thread->State == Waiting) && } else if ((Thread->State == Waiting) &&
(Thread->WaitMode == UserMode) && (Thread->WaitMode != KernelMode) &&
(Thread->Alertable)) { (Thread->Alertable)) {
DPRINT("Waking up Thread for User-Mode APC Delivery \n"); DPRINT("Waking up Thread for User-Mode APC Delivery \n");
@ -703,7 +703,7 @@ KiDeliverApc(KPROCESSOR_MODE DeliveryMode,
/* Now we do the User APCs */ /* Now we do the User APCs */
if ((!IsListEmpty(&Thread->ApcState.ApcListHead[UserMode])) && if ((!IsListEmpty(&Thread->ApcState.ApcListHead[UserMode])) &&
(DeliveryMode == UserMode) && (Thread->ApcState.UserApcPending == TRUE)) { (DeliveryMode != KernelMode) && (Thread->ApcState.UserApcPending == TRUE)) {
/* It's not pending anymore */ /* It's not pending anymore */
Thread->ApcState.UserApcPending = FALSE; Thread->ApcState.UserApcPending = FALSE;

View file

@ -63,7 +63,7 @@ KiDispatchException(PEXCEPTION_RECORD ExceptionRecord,
TContext.ContextFlags = CONTEXT_FULL; TContext.ContextFlags = CONTEXT_FULL;
/* Check the mode */ /* Check the mode */
if (PreviousMode == UserMode) if (PreviousMode != KernelMode)
{ {
/* Add Debugger Registers if this is User Mode */ /* Add Debugger Registers if this is User Mode */
TContext.ContextFlags = TContext.ContextFlags | CONTEXT_DEBUGGER; TContext.ContextFlags = TContext.ContextFlags | CONTEXT_DEBUGGER;
@ -91,7 +91,7 @@ KiDispatchException(PEXCEPTION_RECORD ExceptionRecord,
if (Action != kdDoNotHandleException) if (Action != kdDoNotHandleException)
{ {
/* See what kind of Exception this is */ /* See what kind of Exception this is */
if (PreviousMode == UserMode) if (PreviousMode != KernelMode)
{ {
/* User mode exception, search the frames if we have to */ /* User mode exception, search the frames if we have to */
if (SearchFrames) if (SearchFrames)

View file

@ -498,7 +498,7 @@ KiHandleFpuFault(PKTRAP_FRAME Tf, ULONG ExceptionNr)
PreviousMode = ((Tf->Cs & 0xffff) == USER_CS) ? (UserMode) : (KernelMode); PreviousMode = ((Tf->Cs & 0xffff) == USER_CS) ? (UserMode) : (KernelMode);
DPRINT("Math/Xmm fault happened! (PreviousMode = %s)\n", DPRINT("Math/Xmm fault happened! (PreviousMode = %s)\n",
(PreviousMode == UserMode) ? ("UserMode") : ("KernelMode")); (PreviousMode != KernelMode) ? ("UserMode") : ("KernelMode"));
ASSERT(NpxThread == CurrentThread); /* FIXME: Is not always true I think */ ASSERT(NpxThread == CurrentThread); /* FIXME: Is not always true I think */

View file

@ -1435,7 +1435,7 @@ KeTestAlertThread(IN KPROCESSOR_MODE AlertMode)
Thread->Alerted[AlertMode] = FALSE; Thread->Alerted[AlertMode] = FALSE;
} else if ((AlertMode == UserMode) && (!IsListEmpty(&Thread->ApcState.ApcListHead[UserMode]))) { } else if ((AlertMode != KernelMode) && (!IsListEmpty(&Thread->ApcState.ApcListHead[UserMode]))) {
/* If the mode is User and the Queue isn't empty, set Pending */ /* If the mode is User and the Queue isn't empty, set Pending */
Thread->ApcState.UserApcPending = TRUE; Thread->ApcState.UserApcPending = TRUE;
@ -1480,9 +1480,7 @@ NtAlertResumeThread(IN HANDLE ThreadHandle,
_SEH_TRY { _SEH_TRY {
ProbeForWrite(SuspendCount, ProbeForWriteUlong(SuspendCount);
sizeof(HANDLE),
sizeof(ULONG));
} _SEH_HANDLE { } _SEH_HANDLE {
@ -1578,26 +1576,30 @@ NtDelayExecution(IN BOOLEAN Alertable,
/* Check if parameters are valid */ /* Check if parameters are valid */
if(PreviousMode != KernelMode) { if(PreviousMode != KernelMode) {
_SEH_TRY { Status = STATUS_SUCCESS;
ProbeForRead(DelayInterval, _SEH_TRY {
sizeof(LARGE_INTEGER),
sizeof(ULONG));
/* make a copy on the kernel stack and let DelayInterval point to it so /* make a copy on the kernel stack and let DelayInterval point to it so
we don't need to wrap KeDelayExecutionThread in SEH! */ we don't need to wrap KeDelayExecutionThread in SEH! */
SafeInterval = *DelayInterval; SafeInterval = ProbeForReadLargeInteger(DelayInterval);
DelayInterval = &SafeInterval;
} _SEH_HANDLE { } _SEH_HANDLE {
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} _SEH_END; } _SEH_END;
if (!NT_SUCCESS(Status))
{
return Status;
}
} }
/* Call the Kernel Function */ /* Call the Kernel Function */
Status = KeDelayExecutionThread(PreviousMode, Status = KeDelayExecutionThread(PreviousMode,
Alertable, Alertable,
&SafeInterval); DelayInterval);
/* Return Status */ /* Return Status */
return Status; return Status;

View file

@ -223,7 +223,7 @@ KeRemoveQueue(IN PKQUEUE Queue,
Thread->WaitBlockList = &Thread->WaitBlock[0]; Thread->WaitBlockList = &Thread->WaitBlock[0];
/* Fail if there's an APC Pending */ /* Fail if there's an APC Pending */
if (WaitMode == UserMode && Thread->ApcState.UserApcPending) { if (WaitMode != KernelMode && Thread->ApcState.UserApcPending) {
/* Return the status and increase the pending threads */ /* Return the status and increase the pending threads */
ListEntry = (PLIST_ENTRY)STATUS_USER_APC; ListEntry = (PLIST_ENTRY)STATUS_USER_APC;

View file

@ -47,7 +47,7 @@ KiCheckAlertability(BOOLEAN Alertable,
/* If there are User APCs Pending, then we can't really be alertable */ /* If there are User APCs Pending, then we can't really be alertable */
} else if ((!IsListEmpty(&CurrentThread->ApcState.ApcListHead[UserMode])) && } else if ((!IsListEmpty(&CurrentThread->ApcState.ApcListHead[UserMode])) &&
(WaitMode == UserMode)) { (WaitMode != KernelMode)) {
DPRINT("APCs are Pending\n"); DPRINT("APCs are Pending\n");
CurrentThread->ApcState.UserApcPending = TRUE; CurrentThread->ApcState.UserApcPending = TRUE;
@ -55,7 +55,7 @@ KiCheckAlertability(BOOLEAN Alertable,
} }
/* If there are User APCs Pending and we are waiting in usermode, then we must notify the caller */ /* If there are User APCs Pending and we are waiting in usermode, then we must notify the caller */
} else if ((CurrentThread->ApcState.UserApcPending) && (WaitMode == UserMode)) { } else if ((CurrentThread->ApcState.UserApcPending) && (WaitMode != KernelMode)) {
DPRINT("APCs are Pending\n"); DPRINT("APCs are Pending\n");
*Status = STATUS_USER_APC; *Status = STATUS_USER_APC;
} }

View file

@ -265,14 +265,10 @@ NtConnectPort (PHANDLE UnsafeConnectedPortHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(UnsafeConnectedPortHandle, ProbeForWriteHandle(UnsafeConnectedPortHandle);
sizeof(HANDLE),
sizeof(ULONG));
if (UnsafeMaximumMessageSize != NULL) if (UnsafeMaximumMessageSize != NULL)
{ {
ProbeForWrite(UnsafeMaximumMessageSize, ProbeForWriteUlong(UnsafeMaximumMessageSize);
sizeof(ULONG),
sizeof(ULONG));
} }
} }
_SEH_HANDLE _SEH_HANDLE
@ -341,10 +337,7 @@ NtConnectPort (PHANDLE UnsafeConnectedPortHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForRead(UnsafeConnectDataLength, ConnectDataLength = ProbeForReadUlong(UnsafeConnectDataLength);
sizeof(ULONG),
1);
ConnectDataLength = *UnsafeConnectDataLength;
} }
_SEH_HANDLE _SEH_HANDLE
{ {
@ -374,9 +367,7 @@ NtConnectPort (PHANDLE UnsafeConnectedPortHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(UnsafeConnectData, ProbeForWriteUlong(UnsafeConnectData);
ConnectDataLength,
1);
RtlCopyMemory(ConnectData, RtlCopyMemory(ConnectData,
UnsafeConnectData, UnsafeConnectData,
ConnectDataLength); ConnectDataLength);

View file

@ -778,7 +778,7 @@ MmMapLockedPagesSpecifyCache ( IN PMDL Mdl,
/* Calculate the number of pages required. */ /* Calculate the number of pages required. */
PageCount = PAGE_ROUND_UP(Mdl->ByteCount + Mdl->ByteOffset) / PAGE_SIZE; PageCount = PAGE_ROUND_UP(Mdl->ByteCount + Mdl->ByteOffset) / PAGE_SIZE;
if (AccessMode == UserMode) if (AccessMode != KernelMode)
{ {
MEMORY_AREA *Result; MEMORY_AREA *Result;
LARGE_INTEGER BoundaryAddressMultiple; LARGE_INTEGER BoundaryAddressMultiple;
@ -885,7 +885,7 @@ MmMapLockedPagesSpecifyCache ( IN PMDL Mdl,
{ {
return NULL; return NULL;
} }
if (AccessMode == UserMode) if (AccessMode != KernelMode)
{ {
/* Throw exception */ /* Throw exception */
ExRaiseStatus(STATUS_ACCESS_VIOLATION); ExRaiseStatus(STATUS_ACCESS_VIOLATION);

View file

@ -801,18 +801,12 @@ NtCreatePagingFile(IN PUNICODE_STRING FileName,
{ {
return(Status); return(Status);
} }
if (PreviousMode == UserMode) if (PreviousMode != KernelMode)
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForRead(InitialSize, SafeInitialSize = ProbeForReadLargeInteger(InitialSize);
sizeof(LARGE_INTEGER), SafeMaximumSize = ProbeForReadLargeInteger(MaximumSize);
sizeof(ULONG));
SafeInitialSize = *InitialSize;
ProbeForRead(MaximumSize,
sizeof(LARGE_INTEGER),
sizeof(ULONG));
SafeMaximumSize = *MaximumSize;
} }
_SEH_HANDLE _SEH_HANDLE
{ {

View file

@ -3317,11 +3317,8 @@ NtCreateSection (OUT PHANDLE SectionHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForRead(MaximumSize,
sizeof(LARGE_INTEGER),
sizeof(ULONG));
/* make a copy on the stack */ /* make a copy on the stack */
SafeMaximumSize = *MaximumSize; SafeMaximumSize = ProbeForReadLargeInteger(MaximumSize);
MaximumSize = &SafeMaximumSize; MaximumSize = &SafeMaximumSize;
} }
_SEH_HANDLE _SEH_HANDLE
@ -3401,9 +3398,7 @@ NtOpenSection(PHANDLE SectionHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(SectionHandle, ProbeForWriteHandle(SectionHandle);
sizeof(HANDLE),
sizeof(ULONG));
} }
_SEH_HANDLE _SEH_HANDLE
{ {
@ -3573,21 +3568,15 @@ NtMapViewOfSection(IN HANDLE SectionHandle,
{ {
if(BaseAddress != NULL) if(BaseAddress != NULL)
{ {
ProbeForWrite(BaseAddress, ProbeForWritePointer(BaseAddress);
sizeof(PVOID),
sizeof(ULONG));
SafeBaseAddress = *BaseAddress; SafeBaseAddress = *BaseAddress;
} }
if(SectionOffset != NULL) if(SectionOffset != NULL)
{ {
ProbeForWrite(SectionOffset, ProbeForWriteLargeInteger(SectionOffset);
sizeof(LARGE_INTEGER),
sizeof(ULONG));
SafeSectionOffset = *SectionOffset; SafeSectionOffset = *SectionOffset;
} }
ProbeForWrite(ViewSize, ProbeForWriteUlong(ViewSize);
sizeof(ULONG),
sizeof(ULONG));
SafeViewSize = *ViewSize; SafeViewSize = *ViewSize;
} }
_SEH_HANDLE _SEH_HANDLE
@ -4133,11 +4122,8 @@ NtExtendSection(IN HANDLE SectionHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForRead(NewMaximumSize,
sizeof(LARGE_INTEGER),
sizeof(ULONG));
/* make a copy on the stack */ /* make a copy on the stack */
SafeNewMaximumSize = *NewMaximumSize; SafeNewMaximumSize = ProbeForReadLargeInteger(NewMaximumSize);
NewMaximumSize = &SafeNewMaximumSize; NewMaximumSize = &SafeNewMaximumSize;
} }
_SEH_HANDLE _SEH_HANDLE

View file

@ -303,9 +303,7 @@ NtQueryVirtualMemory (IN HANDLE ProcessHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(UnsafeResultLength, ProbeForWriteUlong(UnsafeResultLength);
sizeof(ULONG),
sizeof(ULONG));
} }
_SEH_HANDLE _SEH_HANDLE
{ {
@ -458,15 +456,9 @@ NtProtectVirtualMemory(IN HANDLE ProcessHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(UnsafeBaseAddress, ProbeForWritePointer(UnsafeBaseAddress);
sizeof(PVOID), ProbeForWriteUlong(UnsafeNumberOfBytesToProtect);
sizeof(ULONG)); ProbeForWriteUlong(UnsafeOldAccessProtection);
ProbeForWrite(UnsafeBaseAddress,
sizeof(ULONG),
sizeof(ULONG));
ProbeForWrite(UnsafeOldAccessProtection,
sizeof(ULONG),
sizeof(ULONG));
BaseAddress = *UnsafeBaseAddress; BaseAddress = *UnsafeBaseAddress;
NumberOfBytesToProtect = *UnsafeNumberOfBytesToProtect; NumberOfBytesToProtect = *UnsafeNumberOfBytesToProtect;
@ -573,9 +565,7 @@ NtReadVirtualMemory(IN HANDLE ProcessHandle,
1); 1);
if(NumberOfBytesRead != NULL) if(NumberOfBytesRead != NULL)
{ {
ProbeForWrite(NumberOfBytesRead, ProbeForWriteUlong(NumberOfBytesRead);
sizeof(ULONG),
sizeof(ULONG));
} }
} }
_SEH_HANDLE _SEH_HANDLE
@ -776,9 +766,7 @@ NtWriteVirtualMemory(IN HANDLE ProcessHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(NumberOfBytesWritten, ProbeForWriteUlong(NumberOfBytesWritten);
sizeof(ULONG),
sizeof(ULONG));
} }
_SEH_HANDLE _SEH_HANDLE
{ {

View file

@ -58,9 +58,7 @@ NtOpenDirectoryObject (OUT PHANDLE DirectoryHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(DirectoryHandle, ProbeForWriteHandle(DirectoryHandle);
sizeof(HANDLE),
sizeof(ULONG));
} }
_SEH_HANDLE _SEH_HANDLE
{ {
@ -186,18 +184,14 @@ NtQueryDirectoryObject (IN HANDLE DirectoryHandle,
ProbeForWrite(Buffer, ProbeForWrite(Buffer,
BufferLength, BufferLength,
sizeof(WCHAR)); sizeof(WCHAR));
ProbeForWrite(Context, ProbeForWriteUlong(Context);
sizeof(ULONG),
sizeof(ULONG));
if(!RestartScan) if(!RestartScan)
{ {
SkipEntries = *Context; SkipEntries = *Context;
} }
if(ReturnLength != NULL) if(ReturnLength != NULL)
{ {
ProbeForWrite(ReturnLength, ProbeForWriteUlong(ReturnLength);
sizeof(ULONG),
sizeof(ULONG));
} }
} }
_SEH_HANDLE _SEH_HANDLE
@ -449,9 +443,7 @@ NtCreateDirectoryObject (OUT PHANDLE DirectoryHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(DirectoryHandle, ProbeForWriteHandle(DirectoryHandle);
sizeof(HANDLE),
sizeof(ULONG));
} }
_SEH_HANDLE _SEH_HANDLE
{ {

View file

@ -388,9 +388,7 @@ NtDuplicateObject (IN HANDLE SourceProcessHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(TargetHandle, ProbeForWriteHandle(TargetHandle);
sizeof(HANDLE),
sizeof(ULONG));
} }
_SEH_HANDLE _SEH_HANDLE
{ {

View file

@ -186,9 +186,7 @@ NtCreateSymbolicLinkObject(OUT PHANDLE LinkHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(LinkHandle, ProbeForWriteHandle(LinkHandle);
sizeof(HANDLE),
sizeof(ULONG));
} }
_SEH_HANDLE _SEH_HANDLE
{ {
@ -303,9 +301,7 @@ NtOpenSymbolicLinkObject(OUT PHANDLE LinkHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(LinkHandle, ProbeForWriteHandle(LinkHandle);
sizeof(HANDLE),
sizeof(ULONG));
} }
_SEH_HANDLE _SEH_HANDLE
{ {
@ -388,9 +384,7 @@ NtQuerySymbolicLinkObject(IN HANDLE LinkHandle,
if(ResultLength != NULL) if(ResultLength != NULL)
{ {
ProbeForWrite(ResultLength, ProbeForWriteUlong(ResultLength);
sizeof(ULONG),
sizeof(ULONG));
} }
} }
_SEH_HANDLE _SEH_HANDLE

View file

@ -75,12 +75,8 @@ NtWaitForMultipleObjects(IN ULONG ObjectCount,
if(TimeOut) if(TimeOut)
{ {
ProbeForRead(TimeOut,
sizeof(LARGE_INTEGER),
sizeof(ULONG));
/* Make a local copy of the timeout on the stack */ /* Make a local copy of the timeout on the stack */
SafeTimeOut = *TimeOut; SafeTimeOut = ProbeForReadLargeInteger(TimeOut);
TimeOut = &SafeTimeOut; TimeOut = &SafeTimeOut;
} }
} }
@ -273,11 +269,8 @@ NtWaitForSingleObject(IN HANDLE ObjectHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForRead(TimeOut,
sizeof(LARGE_INTEGER),
sizeof(ULONG));
/* Make a copy on the stack */ /* Make a copy on the stack */
SafeTimeOut = *TimeOut; SafeTimeOut = ProbeForReadLargeInteger(TimeOut);
TimeOut = &SafeTimeOut; TimeOut = &SafeTimeOut;
} }
_SEH_HANDLE _SEH_HANDLE
@ -354,11 +347,8 @@ NtSignalAndWaitForSingleObject(IN HANDLE ObjectHandleToSignal,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForRead(TimeOut,
sizeof(LARGE_INTEGER),
sizeof(ULONG));
/* Make a copy on the stack */ /* Make a copy on the stack */
SafeTimeOut = *TimeOut; SafeTimeOut = ProbeForReadLargeInteger(TimeOut);
TimeOut = &SafeTimeOut; TimeOut = &SafeTimeOut;
} }
_SEH_HANDLE _SEH_HANDLE

View file

@ -212,7 +212,7 @@ NtCreateJobObject (
CurrentProcess = PsGetCurrentProcess(); CurrentProcess = PsGetCurrentProcess();
/* check for valid buffers */ /* check for valid buffers */
if(PreviousMode == UserMode) if(PreviousMode != KernelMode)
{ {
_SEH_TRY _SEH_TRY
{ {
@ -382,7 +382,7 @@ NtOpenJobObject (
PreviousMode = ExGetPreviousMode(); PreviousMode = ExGetPreviousMode();
/* check for valid buffers */ /* check for valid buffers */
if(PreviousMode == UserMode) if(PreviousMode != KernelMode)
{ {
_SEH_TRY _SEH_TRY
{ {

View file

@ -75,7 +75,7 @@ NtOpenProcessTokenEx(IN HANDLE ProcessHandle,
PreviousMode = ExGetPreviousMode(); PreviousMode = ExGetPreviousMode();
if(PreviousMode == UserMode) if(PreviousMode != KernelMode)
{ {
_SEH_TRY _SEH_TRY
{ {

View file

@ -45,7 +45,7 @@ NtResumeThread(IN HANDLE ThreadHandle,
ThreadHandle, SuspendCount); ThreadHandle, SuspendCount);
/* Check buffer validity */ /* Check buffer validity */
if(SuspendCount && PreviousMode == UserMode) { if(SuspendCount && PreviousMode != KernelMode) {
_SEH_TRY { _SEH_TRY {

View file

@ -32,7 +32,7 @@ RtlCaptureUnicodeString(OUT PUNICODE_STRING Dest,
* Copy the source string structure to kernel space. * Copy the source string structure to kernel space.
*/ */
if(CurrentMode == UserMode) if(CurrentMode != KernelMode)
{ {
RtlZeroMemory(&Src, sizeof(Src)); RtlZeroMemory(&Src, sizeof(Src));

View file

@ -354,7 +354,7 @@ SepReleaseAcl(IN PACL CapturedAcl,
PAGED_CODE(); PAGED_CODE();
if(CapturedAcl != NULL && if(CapturedAcl != NULL &&
(AccessMode == UserMode || (AccessMode != KernelMode ||
(AccessMode == KernelMode && CaptureIfKernel))) (AccessMode == KernelMode && CaptureIfKernel)))
{ {
ExFreePool(CapturedAcl); ExFreePool(CapturedAcl);

View file

@ -338,7 +338,7 @@ SepReleaseSecurityQualityOfService(IN PSECURITY_QUALITY_OF_SERVICE CapturedSecur
PAGED_CODE(); PAGED_CODE();
if(CapturedSecurityQualityOfService != NULL && if(CapturedSecurityQualityOfService != NULL &&
(AccessMode == UserMode || (AccessMode != KernelMode ||
(AccessMode == KernelMode && CaptureIfKernel))) (AccessMode == KernelMode && CaptureIfKernel)))
{ {
ExFreePool(CapturedSecurityQualityOfService); ExFreePool(CapturedSecurityQualityOfService);
@ -819,7 +819,7 @@ SeReleaseSecurityDescriptor(
and CaptureIfKernelMode that you previously passed to and CaptureIfKernelMode that you previously passed to
SeCaptureSecurityDescriptor() in order to avoid memory leaks! */ SeCaptureSecurityDescriptor() in order to avoid memory leaks! */
if(CapturedSecurityDescriptor != NULL && if(CapturedSecurityDescriptor != NULL &&
(CurrentMode == UserMode || (CurrentMode != KernelMode ||
(CurrentMode == KernelMode && CaptureIfKernelMode))) (CurrentMode == KernelMode && CaptureIfKernelMode)))
{ {
/* only delete the descriptor when SeCaptureSecurityDescriptor() allocated one! */ /* only delete the descriptor when SeCaptureSecurityDescriptor() allocated one! */

View file

@ -316,7 +316,7 @@ SepReleaseSid(IN PSID CapturedSid,
PAGED_CODE(); PAGED_CODE();
if(CapturedSid != NULL && if(CapturedSid != NULL &&
(AccessMode == UserMode || (AccessMode != KernelMode ||
(AccessMode == KernelMode && CaptureIfKernel))) (AccessMode == KernelMode && CaptureIfKernel)))
{ {
ExFreePool(CapturedSid); ExFreePool(CapturedSid);

View file

@ -1440,9 +1440,7 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(NewTokenHandle, ProbeForWriteHandle(NewTokenHandle);
sizeof(HANDLE),
sizeof(ULONG));
} }
_SEH_HANDLE _SEH_HANDLE
{ {
@ -2053,6 +2051,7 @@ NtCreateToken(OUT PHANDLE TokenHandle,
ULONG uLength; ULONG uLength;
ULONG i; ULONG i;
ULONG nTokenPrivileges = 0; ULONG nTokenPrivileges = 0;
LARGE_INTEGER LocalExpirationTime = {};
KPROCESSOR_MODE PreviousMode; KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS; NTSTATUS Status = STATUS_SUCCESS;
@ -2064,15 +2063,11 @@ NtCreateToken(OUT PHANDLE TokenHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(TokenHandle, ProbeForWriteHandle(TokenHandle);
sizeof(HANDLE),
sizeof(ULONG));
ProbeForRead(AuthenticationId, ProbeForRead(AuthenticationId,
sizeof(LUID), sizeof(LUID),
sizeof(ULONG)); sizeof(ULONG));
ProbeForRead(ExpirationTime, LocalExpirationTime = ProbeForReadLargeInteger(ExpirationTime);
sizeof(LARGE_INTEGER),
sizeof(ULONG));
ProbeForRead(TokenUser, ProbeForRead(TokenUser,
sizeof(TOKEN_USER), sizeof(TOKEN_USER),
sizeof(ULONG)); sizeof(ULONG));
@ -2110,6 +2105,7 @@ NtCreateToken(OUT PHANDLE TokenHandle,
else else
{ {
nTokenPrivileges = TokenPrivileges->PrivilegeCount; nTokenPrivileges = TokenPrivileges->PrivilegeCount;
LocalExpirationTime = *ExpirationTime;
} }
Status = ZwAllocateLocallyUniqueId(&TokenId); Status = ZwAllocateLocallyUniqueId(&TokenId);
@ -2383,9 +2379,7 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle,
{ {
_SEH_TRY _SEH_TRY
{ {
ProbeForWrite(TokenHandle, ProbeForWriteHandle(TokenHandle);
sizeof(HANDLE),
sizeof(ULONG));
} }
_SEH_HANDLE _SEH_HANDLE
{ {