Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-28 10:04:49 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOSKRNL] Address issues raised in PR 3361 review

Browse source
This commit is contained in:
Jérôme Gardou 2020-12-02 15:17:28 +01:00
parent 70c62aa2c9
commit d2fa434cb7
3 changed files with 24 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ntoskrnl/cache/section/data.c vendored
View file

@ -274,8 +274,6 @@ MmFinalizeSegment(PMM_SECTION_SEGMENT Segment)
DPRINT("Finalize segment %p\n", Segment);
__debugbreak();
MmLockSectionSegment(Segment);
RemoveEntryList(&Segment->ListOfSegments);
if (Segment->Flags & MM_DATAFILE_SEGMENT) {
@ -622,8 +620,6 @@ MiFreeSegmentPage(PMM_SECTION_SEGMENT Segment,
ULONG_PTR Entry;
PFILE_OBJECT FileObject = Segment->FileObject;
__debugbreak();
Entry = MmGetPageEntrySectionSegment(Segment, FileOffset);
DPRINTC("MiFreeSegmentPage(%p:%I64x -> Entry %Ix\n",
Segment,

8
ntoskrnl/mm/ARM3/section.c
View file

@ -1094,6 +1094,14 @@ MiMapViewInSystemSpace(IN PVOID Section,
*ViewSize = SectionSize - SectionOffset->QuadPart;
}
/* Check overflow */
if ((SectionOffset->QuadPart + *ViewSize) < SectionOffset->QuadPart)
{
DPRINT1("Integer overflow between size & offset!\n");
MiDereferenceControlArea(ControlArea);
return STATUS_INVALID_VIEW_SIZE;
}
/* Check if the caller wanted a larger section than the view */
if (SectionOffset->QuadPart + *ViewSize > SectionSize)
{

39
ntoskrnl/mm/section.c
View file

@ -2050,7 +2050,7 @@ MmCreatePhysicalMemorySection(VOID)
/*
* Create the section mapping physical memory
*/
SectionSize.QuadPart = ~((ULONG_PTR)0);
SectionSize.QuadPart = MmNumberOfPhysicalPages * PAGE_SIZE;
InitializeObjectAttributes(&Obj,
&Name,
OBJ_PERMANENT | OBJ_KERNEL_EXCLUSIVE,
@ -2192,7 +2192,6 @@ MmCreateDataFileSection(PSECTION *SectionObject,
(PVOID*)&Section);
if (!NT_SUCCESS(Status))
{
ObDereferenceObject(FileObject);
return(Status);
}
/*
@ -2240,7 +2239,6 @@ MmCreateDataFileSection(PSECTION *SectionObject,
if (MaximumSize.QuadPart == 0)
{
ObDereferenceObject(Section);
ObDereferenceObject(FileObject);
return STATUS_MAPPED_FILE_SIZE_ZERO;
}
}
@ -2254,7 +2252,6 @@ MmCreateDataFileSection(PSECTION *SectionObject,
if (!NT_SUCCESS(Status))
{
ObDereferenceObject(Section);
ObDereferenceObject(FileObject);
return(STATUS_SECTION_NOT_EXTENDED);
}
}
@ -2263,7 +2260,6 @@ MmCreateDataFileSection(PSECTION *SectionObject,
if (FileObject->SectionObjectPointer == NULL)
{
ObDereferenceObject(Section);
ObDereferenceObject(FileObject);
return STATUS_INVALID_FILE_FOR_SECTION;
}
@ -2274,7 +2270,6 @@ MmCreateDataFileSection(PSECTION *SectionObject,
if (Status != STATUS_SUCCESS)
{
ObDereferenceObject(Section);
ObDereferenceObject(FileObject);
return(Status);
}
@ -2305,7 +2300,6 @@ MmCreateDataFileSection(PSECTION *SectionObject,
//KeSetEvent((PVOID)&FileObject->Lock, IO_NO_INCREMENT, FALSE);
MiReleasePfnLock(OldIrql);
ObDereferenceObject(Section);
ObDereferenceObject(FileObject);
return(STATUS_NO_MEMORY);
}
@ -2329,6 +2323,7 @@ MmCreateDataFileSection(PSECTION *SectionObject,
ExInitializeFastMutex(&Segment->Lock);
Segment->FileObject = FileObject;
ObReferenceObject(FileObject);
Segment->Image.FileOffset = 0;
Segment->Protection = SectionPageProtection;
@ -2370,9 +2365,6 @@ MmCreateDataFileSection(PSECTION *SectionObject,
}
MmUnlockSectionSegment(Segment);
/* The segment already has a reference to a file object. Don't bother keeping one.*/
ObDereferenceObject(FileObject);
}
Section->SizeOfSection = MaximumSize;
@ -3053,7 +3045,6 @@ MmCreateImageSection(PSECTION *SectionObject,
(PVOID*)(PVOID)&Section);
if (!NT_SUCCESS(Status))
{
ObDereferenceObject(FileObject);
return(Status);
}
@ -3093,17 +3084,14 @@ MmCreateImageSection(PSECTION *SectionObject,
NTSTATUS StatusExeFmt;
PMM_SECTION_SEGMENT DataSectionObject;
ImageSectionObject = ExAllocatePoolWithTag(NonPagedPool, sizeof(MM_IMAGE_SECTION_OBJECT), TAG_MM_SECTION_SEGMENT);
ImageSectionObject = ExAllocatePoolZero(NonPagedPool, sizeof(MM_IMAGE_SECTION_OBJECT), TAG_MM_SECTION_SEGMENT);
if (ImageSectionObject == NULL)
{
MiReleasePfnLock(OldIrql);
ObDereferenceObject(FileObject);
ObDereferenceObject(Section);
return(STATUS_NO_MEMORY);
}
RtlZeroMemory(ImageSectionObject, sizeof(MM_IMAGE_SECTION_OBJECT));
ImageSectionObject->SegFlags = MM_SEGMENT_INCREATE;
ImageSectionObject->RefCount = 1;
FileObject->SectionObjectPointer->ImageSectionObject = ImageSectionObject;
@ -3172,7 +3160,6 @@ MmCreateImageSection(PSECTION *SectionObject,
ExFreePoolWithTag(ImageSectionObject, TAG_MM_SECTION_SEGMENT);
ObDereferenceObject(Section);
ObDereferenceObject(FileObject);
return(Status);
}
@ -3194,12 +3181,15 @@ MmCreateImageSection(PSECTION *SectionObject,
ExFreePool(ImageSectionObject->Segments);
ExFreePool(ImageSectionObject);
ObDereferenceObject(Section);
ObDereferenceObject(FileObject);
return(Status);
}
OldIrql = MiAcquirePfnLock();
ImageSectionObject->SegFlags &= ~MM_SEGMENT_INCREATE;
/* Take a ref on the file on behalf of the newly created structure */
ObReferenceObject(FileObject);
MiReleasePfnLock(OldIrql);
Status = StatusExeFmt;
@ -3213,9 +3203,6 @@ MmCreateImageSection(PSECTION *SectionObject,
Section->Segment = (PSEGMENT)ImageSectionObject;
/* We let the Image Section Object hold the reference */
ObDereferenceObject(FileObject);
Status = STATUS_SUCCESS;
}
//KeSetEvent((PVOID)&FileObject->Lock, IO_NO_INCREMENT, FALSE);
@ -3693,8 +3680,10 @@ NtQuerySection(
_SEH2_TRY
{
*((SECTION_BASIC_INFORMATION*)SectionInformation) = Sbi;
if (ResultLength)
if (ResultLength != NULL)
{
*ResultLength = sizeof(Sbi);
}
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
@ -3718,7 +3707,9 @@ NtQuerySection(
PSECTION_IMAGE_INFORMATION Sii = (PSECTION_IMAGE_INFORMATION)SectionInformation;
*Sii = ImageSectionObject->ImageInformation;
if (ResultLength != NULL)
{
*ResultLength = sizeof(*Sii);
}
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
@ -4374,6 +4365,7 @@ MmCreateSection (OUT PVOID * Section,
SectionPageProtection,
AllocationAttributes,
FileObject);
ObDereferenceObject(FileObject);
}
#ifndef NEWCC
else if (FileObject != NULL)
@ -4386,6 +4378,7 @@ MmCreateSection (OUT PVOID * Section,
AllocationAttributes,
FileObject,
FileHandle != NULL);
ObDereferenceObject(FileObject);
}
#else
else if (FileHandle != NULL || FileObject != NULL)
@ -4393,8 +4386,8 @@ MmCreateSection (OUT PVOID * Section,
Status = MmCreateCacheSection(SectionObject,
DesiredAccess,
ObjectAttributes,
SizeOfSection,
InitialPageProtection,
MaximumSize,
SectionPageProtection,
AllocationAttributes,
FileObject);
}