Short: The code was suffering from an off-by-one bug (inconsistency between inclusive end exclusive end address), which could lead to freeing one page above the initialization code. This led to freeing part of the kernel import section on x64. Now it is consistently using the aligned/exclusive end address.
Long:
* Initialization sections are freed both for the boot loaded images as well as for drivers that are loaded later. Obviously the second mechanism needs to be able to run at any time, so it is not initialization code itself. For some reason someone decided though, it would be a smart idea to implement the code twice, once for the boot loaded images, once for drivers and concluding that the former was initialization code itself and had to be freed.
* Since freeing the code that frees the initialization sections, while it is doing that is not possible, it uses a "smart trick", initially skipping that range, returning its start and end to the caller and have the caller free it afterwards.
* The code was using the end address in an inconsistent way, partly aligning it to the start of the following section, sometimes pointing to the last byte that should be freed. The function that freed each chunk was assuming the latter (i.e. that the end was included in the range) and thus freed the page that contained the end address. The end address for the range that was returned to the caller was aligned to the start of the next section, and the caller used it to free the range including the following page. On x64 this was the start of the import section of ntoskrnl. How that worked on x86 I don't even want to know.
This fixes a race condition, where the message thread was still running when InstallReactOS returned and syssetup.dll was unloaded by the caller (setup.exe).
Volume boot record is also implemented, it supports reading BTRFS tree structures with upto 64k node size.
This support required to change all path in Free Loader to lowercase for better performance.
CORE-13769
- Checks are actually uses-after-free, "by design" :-<
- Actual test code duplicates EngCreateSemaphore.c, EngAcquireSemaphore.c and EngReleaseSemaphore.c.
Normally CSRSS must not be connected to any winsta or desktop by default. It should manually connect
to a winsta/desktop only when it has to do some GUI operations, and then disconnect afterwards.
[USERSRV] Temporarily hackfix the harderror dialog display to the current input desktop.
as documented in "Advanced Windows NT" by Jeffrey M. Richter (Microsoft Press),
and in https://is.muni.cz/el/1433/jaro2010/PB167/um/cv5/undocumented_CreateProcess.pdf .
[INCLUDE][SERVICES][WIN32K:NTUSER] Add an undocumented STARTF_INHERITDESKTOP flag
for the STARTUPINFO::dwFlags structure member, whose purpose is to tell Win32k
that the created handles to the window station and desktop to which the
process is connecting to, can be inherited by its child processes.
It is used when starting interactive services.
Observed via API monitoring on Windows 2003.
CORE-11933 and PR #621.
Since this API is also called from WINSRV when calling the AllocConsole() API,
it can be tested more-or-less easily. The internal helper IntResolveDesktop()
is also tested during process connection to a window station, when such process
first calls a USER32 or GDI32 function.
This is also the functionality tested by the user32:desktop apitest.
- Adjust how IntResolveDesktop() is called.
CORE-11933 and PR #621.
We are potentially going to modify the window station name to be
created or opened, by one with the format "Service-0x<luidhigh>-<luidlow>$",
in case the user provides an empty name.
Since we want to use the user-mode ObjectAttributes structure pointer so
that the Object manager can correctly perform the access checks and the
capture, we actually need to construct the new window station name in the
user memory space! This allows us then to fetch the new name in the
ObjectAttributes structure so that Ob can use it.
All of this is performed under SEH.
For NtUserOpenWindowStation(), we also need to be Windows-compatible and
detect whether user-mode gave instead the special "Service-0x00000000-00000000$"
name (observed via API monitoring) that is used when one tries to open a
window station with empty name.
