Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-04-12 00:29:04 +00:00
Code Issues Projects Releases Packages Wiki Activity

[WIN32K] Fix protection of USER heap

Browse source 
Create the section with PAGE_READWRITE, not PAGE_EXECUTE_READWRITE and map in user mode with PAGE_READONLY, not PAGE_EXECUTE_READ.
Original commit was ea5261f in 2006. The comments suggest that back then the heap code had issues with it, which is not the case anymore.
This commit is contained in:
Timo Kreuzer 2024-08-26 10:31:18 +03:00
parent 9139d0fab1
commit db419efbf2
2 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
win32ss/user/ntuser/desktop.c
View file

@ -3262,7 +3262,7 @@ IntMapDesktopView(IN PDESKTOP pdesk)
&ViewSize, &ViewSize,
ViewUnmap, ViewUnmap,
SEC_NO_CHANGE, SEC_NO_CHANGE,
PAGE_EXECUTE_READ); /* Would prefer PAGE_READONLY, but thanks to RTL heaps... */ PAGE_READONLY);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {
ERR("Failed to map desktop\n"); ERR("Failed to map desktop\n");

12
win32ss/user/ntuser/usrheap.c
View file

@ -81,7 +81,7 @@ IntUserHeapCommitRoutine(
&ViewSize, &ViewSize,
ViewUnmap, ViewUnmap,
SEC_NO_CHANGE, SEC_NO_CHANGE,
PAGE_EXECUTE_READ); /* Would prefer PAGE_READONLY, but thanks to RTL heaps... */ PAGE_READONLY);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
return Status; return Status;
@ -97,7 +97,7 @@ IntUserHeapCommitRoutine(
0, 0,
CommitSize, CommitSize,
MEM_COMMIT, MEM_COMMIT,
PAGE_EXECUTE_READ); PAGE_READONLY);
if (NT_SUCCESS(Status)) if (NT_SUCCESS(Status))
{ {
@ -139,7 +139,7 @@ IntUserHeapCreate(IN PVOID SectionObject,
&ViewSize, &ViewSize,
ViewUnmap, ViewUnmap,
SEC_NO_CHANGE, SEC_NO_CHANGE,
PAGE_EXECUTE_READ); /* Would prefer PAGE_READONLY, but thanks to RTL heaps... */ PAGE_READONLY);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
return NULL; return NULL;
@ -148,7 +148,7 @@ IntUserHeapCreate(IN PVOID SectionObject,
0, 0,
&ViewSize, &ViewSize,
MEM_COMMIT, MEM_COMMIT,
PAGE_EXECUTE_READ); /* Would prefer PAGE_READONLY, but thanks to RTL heaps... */ PAGE_READONLY);
MmUnmapViewOfSection(PsGetCurrentProcess(), MmUnmapViewOfSection(PsGetCurrentProcess(),
MappedView); MappedView);
@ -193,7 +193,7 @@ UserCreateHeap(OUT PVOID *SectionObject,
SECTION_ALL_ACCESS, SECTION_ALL_ACCESS,
NULL, NULL,
&SizeHeap, &SizeHeap,
PAGE_EXECUTE_READWRITE, /* Would prefer PAGE_READWRITE, but thanks to RTL heaps... */ PAGE_READWRITE,
SEC_RESERVE | 1, SEC_RESERVE | 1,
NULL, NULL,
NULL); NULL);
@ -315,7 +315,7 @@ MapGlobalUserHeap(IN PEPROCESS Process,
&ViewSize, &ViewSize,
ViewUnmap, ViewUnmap,
SEC_NO_CHANGE, SEC_NO_CHANGE,
PAGE_EXECUTE_READ); /* Would prefer PAGE_READONLY, but thanks to RTL heaps... */ PAGE_READONLY);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {
ERR_CH(UserProcess, "MapGlobalUserHeap - Failed to map the global heap! 0x%x\n", Status); ERR_CH(UserProcess, "MapGlobalUserHeap - Failed to map the global heap! 0x%x\n", Status);