[WIN32K:NTUSER] In UserCreateWinstaDirectory(), use a string-safe printf, and use OBJ_KERNEL_HANDLE as well as a suitable desired access value in a ZwCreateDirectoryObject() call.

This commit is contained in:
Hermès Bélusca-Maïto 2018-06-16 19:44:56 +02:00
parent 2345d63ce3
commit f47afc3b61
No known key found for this signature in database
GPG key ID: 3B2539C65E7B93D0

View file

@ -47,11 +47,11 @@ NTSTATUS
NTAPI NTAPI
UserCreateWinstaDirectory(VOID) UserCreateWinstaDirectory(VOID)
{ {
PPEB Peb;
NTSTATUS Status; NTSTATUS Status;
WCHAR wstrWindowStationsDir[MAX_PATH]; PPEB Peb;
OBJECT_ATTRIBUTES ObjectAttributes; OBJECT_ATTRIBUTES ObjectAttributes;
HANDLE hWinstaDir; HANDLE hWinstaDir;
WCHAR wstrWindowStationsDir[MAX_PATH];
/* Create the WindowStations directory and cache its path for later use */ /* Create the WindowStations directory and cache its path for later use */
Peb = NtCurrentPeb(); Peb = NtCurrentPeb();
@ -64,11 +64,14 @@ UserCreateWinstaDirectory(VOID)
} }
else else
{ {
swprintf(wstrWindowStationsDir, Status = RtlStringCbPrintfW(wstrWindowStationsDir,
L"%ws\\%lu%ws", sizeof(wstrWindowStationsDir),
SESSION_DIR, L"%ws\\%lu%ws",
Peb->SessionId, SESSION_DIR,
WINSTA_OBJ_DIR); Peb->SessionId,
WINSTA_OBJ_DIR);
if (!NT_SUCCESS(Status))
return Status;
if (!RtlCreateUnicodeString(&gustrWindowStationsDir, wstrWindowStationsDir)) if (!RtlCreateUnicodeString(&gustrWindowStationsDir, wstrWindowStationsDir))
{ {
@ -78,10 +81,10 @@ UserCreateWinstaDirectory(VOID)
InitializeObjectAttributes(&ObjectAttributes, InitializeObjectAttributes(&ObjectAttributes,
&gustrWindowStationsDir, &gustrWindowStationsDir,
0, OBJ_KERNEL_HANDLE,
NULL, NULL,
NULL); NULL);
Status = ZwCreateDirectoryObject(&hWinstaDir, 0, &ObjectAttributes); Status = ZwCreateDirectoryObject(&hWinstaDir, DIRECTORY_CREATE_OBJECT, &ObjectAttributes);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {
ERR("Could not create %wZ directory (Status 0x%X)\n", &gustrWindowStationsDir, Status); ERR("Could not create %wZ directory (Status 0x%X)\n", &gustrWindowStationsDir, Status);