[LDR] Protect calls from LdrpCallInitRoutine and LdrpCallTlsInitializers with SEH.

CORE-14532
This commit is contained in:
Mark Jansen 2018-04-08 21:51:20 +02:00
parent 1ea68d0510
commit dfff8ed0d8
No known key found for this signature in database
GPG key ID: B39240EE84BEAE8B
2 changed files with 140 additions and 68 deletions

View file

@ -1476,10 +1476,18 @@ LdrUnloadDll(IN PVOID BaseAddress)
LdrEntry->EntryPointActivationContext); LdrEntry->EntryPointActivationContext);
/* Call the entrypoint */ /* Call the entrypoint */
LdrpCallInitRoutine(LdrEntry->EntryPoint, _SEH2_TRY
LdrEntry->DllBase, {
DLL_PROCESS_DETACH, LdrpCallInitRoutine(LdrEntry->EntryPoint,
NULL); LdrEntry->DllBase,
DLL_PROCESS_DETACH,
NULL);
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
/* Do nothing */
}
_SEH2_END;
/* Release the context */ /* Release the context */
RtlDeactivateActivationContextUnsafeFast(&ActCtx); RtlDeactivateActivationContextUnsafeFast(&ActCtx);

View file

@ -552,30 +552,38 @@ LdrpInitializeThread(IN PCONTEXT Context)
RtlActivateActivationContextUnsafeFast(&ActCtx, RtlActivateActivationContextUnsafeFast(&ActCtx,
LdrEntry->EntryPointActivationContext); LdrEntry->EntryPointActivationContext);
/* Check if it has TLS */ _SEH2_TRY
if (LdrEntry->TlsIndex)
{ {
/* Check if it has TLS */
if (LdrEntry->TlsIndex)
{
/* Make sure we're not shutting down */
if (!LdrpShutdownInProgress)
{
/* Call TLS */
LdrpCallTlsInitializers(LdrEntry->DllBase, DLL_THREAD_ATTACH);
}
}
/* Make sure we're not shutting down */ /* Make sure we're not shutting down */
if (!LdrpShutdownInProgress) if (!LdrpShutdownInProgress)
{ {
/* Call TLS */ /* Call the Entrypoint */
LdrpCallTlsInitializers(LdrEntry->DllBase, DLL_THREAD_ATTACH); DPRINT("%wZ - Calling entry point at %p for thread attaching, %p/%p\n",
&LdrEntry->BaseDllName, LdrEntry->EntryPoint,
NtCurrentTeb()->RealClientId.UniqueProcess,
NtCurrentTeb()->RealClientId.UniqueThread);
LdrpCallInitRoutine(LdrEntry->EntryPoint,
LdrEntry->DllBase,
DLL_THREAD_ATTACH,
NULL);
} }
} }
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
/* Make sure we're not shutting down */
if (!LdrpShutdownInProgress)
{ {
/* Call the Entrypoint */ /* Do nothing */
DPRINT("%wZ - Calling entry point at %p for thread attaching, %p/%p\n",
&LdrEntry->BaseDllName, LdrEntry->EntryPoint,
NtCurrentTeb()->RealClientId.UniqueProcess,
NtCurrentTeb()->RealClientId.UniqueThread);
LdrpCallInitRoutine(LdrEntry->EntryPoint,
LdrEntry->DllBase,
DLL_THREAD_ATTACH,
NULL);
} }
_SEH2_END;
/* Deactivate the ActCtx */ /* Deactivate the ActCtx */
RtlDeactivateActivationContextUnsafeFast(&ActCtx); RtlDeactivateActivationContextUnsafeFast(&ActCtx);
@ -599,8 +607,16 @@ LdrpInitializeThread(IN PCONTEXT Context)
RtlActivateActivationContextUnsafeFast(&ActCtx, RtlActivateActivationContextUnsafeFast(&ActCtx,
LdrpImageEntry->EntryPointActivationContext); LdrpImageEntry->EntryPointActivationContext);
/* Do TLS callbacks */ _SEH2_TRY
LdrpCallTlsInitializers(Peb->ImageBaseAddress, DLL_THREAD_ATTACH); {
/* Do TLS callbacks */
LdrpCallTlsInitializers(Peb->ImageBaseAddress, DLL_THREAD_ATTACH);
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
/* Do nothing */
}
_SEH2_END;
/* Deactivate the ActCtx */ /* Deactivate the ActCtx */
RtlDeactivateActivationContextUnsafeFast(&ActCtx); RtlDeactivateActivationContextUnsafeFast(&ActCtx);
@ -796,23 +812,31 @@ LdrpRunInitializeRoutines(IN PCONTEXT Context OPTIONAL)
RtlActivateActivationContextUnsafeFast(&ActCtx, RtlActivateActivationContextUnsafeFast(&ActCtx,
LdrEntry->EntryPointActivationContext); LdrEntry->EntryPointActivationContext);
/* Check if it has TLS */ _SEH2_TRY
if (LdrEntry->TlsIndex && Context)
{ {
/* Call TLS */ /* Check if it has TLS */
LdrpCallTlsInitializers(LdrEntry->DllBase, DLL_PROCESS_ATTACH); if (LdrEntry->TlsIndex && Context)
} {
/* Call TLS */
LdrpCallTlsInitializers(LdrEntry->DllBase, DLL_PROCESS_ATTACH);
}
/* Call the Entrypoint */ /* Call the Entrypoint */
if (ShowSnaps) if (ShowSnaps)
{ {
DPRINT1("%wZ - Calling entry point at %p for DLL_PROCESS_ATTACH\n", DPRINT1("%wZ - Calling entry point at %p for DLL_PROCESS_ATTACH\n",
&LdrEntry->BaseDllName, EntryPoint); &LdrEntry->BaseDllName, EntryPoint);
}
DllStatus = LdrpCallInitRoutine(EntryPoint,
LdrEntry->DllBase,
DLL_PROCESS_ATTACH,
Context);
} }
DllStatus = LdrpCallInitRoutine(EntryPoint, _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
LdrEntry->DllBase, {
DLL_PROCESS_ATTACH, DllStatus = FALSE;
Context); }
_SEH2_END;
/* Deactivate the ActCtx */ /* Deactivate the ActCtx */
RtlDeactivateActivationContextUnsafeFast(&ActCtx); RtlDeactivateActivationContextUnsafeFast(&ActCtx);
@ -862,8 +886,16 @@ LdrpRunInitializeRoutines(IN PCONTEXT Context OPTIONAL)
RtlActivateActivationContextUnsafeFast(&ActCtx, RtlActivateActivationContextUnsafeFast(&ActCtx,
LdrpImageEntry->EntryPointActivationContext); LdrpImageEntry->EntryPointActivationContext);
/* Do TLS callbacks */ _SEH2_TRY
LdrpCallTlsInitializers(Peb->ImageBaseAddress, DLL_PROCESS_ATTACH); {
/* Do TLS callbacks */
LdrpCallTlsInitializers(Peb->ImageBaseAddress, DLL_PROCESS_ATTACH);
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
/* Do nothing */
}
_SEH2_END;
/* Deactivate the ActCtx */ /* Deactivate the ActCtx */
RtlDeactivateActivationContextUnsafeFast(&ActCtx); RtlDeactivateActivationContextUnsafeFast(&ActCtx);
@ -958,20 +990,28 @@ LdrShutdownProcess(VOID)
RtlActivateActivationContextUnsafeFast(&ActCtx, RtlActivateActivationContextUnsafeFast(&ActCtx,
LdrEntry->EntryPointActivationContext); LdrEntry->EntryPointActivationContext);
/* Check if it has TLS */ _SEH2_TRY
if (LdrEntry->TlsIndex)
{ {
/* Call TLS */ /* Check if it has TLS */
LdrpCallTlsInitializers(LdrEntry->DllBase, DLL_PROCESS_DETACH); if (LdrEntry->TlsIndex)
} {
/* Call TLS */
LdrpCallTlsInitializers(LdrEntry->DllBase, DLL_PROCESS_DETACH);
}
/* Call the Entrypoint */ /* Call the Entrypoint */
DPRINT("%wZ - Calling entry point at %p for thread detaching\n", DPRINT("%wZ - Calling entry point at %p for thread detaching\n",
&LdrEntry->BaseDllName, LdrEntry->EntryPoint); &LdrEntry->BaseDllName, LdrEntry->EntryPoint);
LdrpCallInitRoutine(EntryPoint, LdrpCallInitRoutine(EntryPoint,
LdrEntry->DllBase, LdrEntry->DllBase,
DLL_PROCESS_DETACH, DLL_PROCESS_DETACH,
(PVOID)1); (PVOID)1);
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
/* Do nothing */
}
_SEH2_END;
/* Deactivate the ActCtx */ /* Deactivate the ActCtx */
RtlDeactivateActivationContextUnsafeFast(&ActCtx); RtlDeactivateActivationContextUnsafeFast(&ActCtx);
@ -991,8 +1031,16 @@ LdrShutdownProcess(VOID)
RtlActivateActivationContextUnsafeFast(&ActCtx, RtlActivateActivationContextUnsafeFast(&ActCtx,
LdrpImageEntry->EntryPointActivationContext); LdrpImageEntry->EntryPointActivationContext);
/* Do TLS callbacks */ _SEH2_TRY
LdrpCallTlsInitializers(Peb->ImageBaseAddress, DLL_PROCESS_DETACH); {
/* Do TLS callbacks */
LdrpCallTlsInitializers(Peb->ImageBaseAddress, DLL_PROCESS_DETACH);
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
/* Do nothing */
}
_SEH2_END;
/* Deactivate the ActCtx */ /* Deactivate the ActCtx */
RtlDeactivateActivationContextUnsafeFast(&ActCtx); RtlDeactivateActivationContextUnsafeFast(&ActCtx);
@ -1066,28 +1114,36 @@ LdrShutdownThread(VOID)
RtlActivateActivationContextUnsafeFast(&ActCtx, RtlActivateActivationContextUnsafeFast(&ActCtx,
LdrEntry->EntryPointActivationContext); LdrEntry->EntryPointActivationContext);
/* Check if it has TLS */ _SEH2_TRY
if (LdrEntry->TlsIndex)
{ {
/* Check if it has TLS */
if (LdrEntry->TlsIndex)
{
/* Make sure we're not shutting down */
if (!LdrpShutdownInProgress)
{
/* Call TLS */
LdrpCallTlsInitializers(LdrEntry->DllBase, DLL_THREAD_DETACH);
}
}
/* Make sure we're not shutting down */ /* Make sure we're not shutting down */
if (!LdrpShutdownInProgress) if (!LdrpShutdownInProgress)
{ {
/* Call TLS */ /* Call the Entrypoint */
LdrpCallTlsInitializers(LdrEntry->DllBase, DLL_THREAD_DETACH); DPRINT("%wZ - Calling entry point at %p for thread detaching\n",
&LdrEntry->BaseDllName, LdrEntry->EntryPoint);
LdrpCallInitRoutine(EntryPoint,
LdrEntry->DllBase,
DLL_THREAD_DETACH,
NULL);
} }
} }
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
/* Make sure we're not shutting down */
if (!LdrpShutdownInProgress)
{ {
/* Call the Entrypoint */ /* Do nothing */
DPRINT("%wZ - Calling entry point at %p for thread detaching\n",
&LdrEntry->BaseDllName, LdrEntry->EntryPoint);
LdrpCallInitRoutine(EntryPoint,
LdrEntry->DllBase,
DLL_THREAD_DETACH,
NULL);
} }
_SEH2_END;
/* Deactivate the ActCtx */ /* Deactivate the ActCtx */
RtlDeactivateActivationContextUnsafeFast(&ActCtx); RtlDeactivateActivationContextUnsafeFast(&ActCtx);
@ -1108,8 +1164,16 @@ LdrShutdownThread(VOID)
RtlActivateActivationContextUnsafeFast(&ActCtx, RtlActivateActivationContextUnsafeFast(&ActCtx,
LdrpImageEntry->EntryPointActivationContext); LdrpImageEntry->EntryPointActivationContext);
/* Do TLS callbacks */ _SEH2_TRY
LdrpCallTlsInitializers(Peb->ImageBaseAddress, DLL_THREAD_DETACH); {
/* Do TLS callbacks */
LdrpCallTlsInitializers(Peb->ImageBaseAddress, DLL_THREAD_DETACH);
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
/* Do nothing */
}
_SEH2_END;
/* Deactivate the ActCtx */ /* Deactivate the ActCtx */
RtlDeactivateActivationContextUnsafeFast(&ActCtx); RtlDeactivateActivationContextUnsafeFast(&ActCtx);