projects / reactos.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Synchronize with trunk r58457.
[reactos.git] / subsystems / win32 / csrsrv / api.c
1 /*
2 * COPYRIGHT: See COPYING in the top level directory
3 * PROJECT: ReactOS Client/Server Runtime SubSystem
4 * FILE: subsystems/win32/csrsrv/api.c
5 * PURPOSE: CSR Server DLL API LPC Implementation
6 * "\windows\ApiPort" port process management functions
7 * PROGRAMMERS: Alex Ionescu (alex@relsoft.net)
8 */
9
10 /* INCLUDES *******************************************************************/
11
12 #include "srv.h"
13
14 #define NDEBUG
15 #include <debug.h>
16
17 /* GLOBALS ********************************************************************/
18
19 BOOLEAN (*CsrClientThreadSetup)(VOID) = NULL;
20 UNICODE_STRING CsrApiPortName;
21 volatile LONG CsrpStaticThreadCount;
22 volatile LONG CsrpDynamicThreadTotal;
23 extern ULONG CsrMaxApiRequestThreads;
24
25 /* FUNCTIONS ******************************************************************/
26
27 /*++
28 * @name CsrCallServerFromServer
29 * @implemented NT4
30 *
31 * The CsrCallServerFromServer routine calls a CSR API from within a server.
32 * It avoids using LPC messages since the request isn't coming from a client.
33 *
34 * @param ReceiveMsg
35 * Pointer to the CSR API Message to send to the server.
36 *
37 * @param ReplyMsg
38 * Pointer to the CSR API Message to receive from the server.
39 *
40 * @return STATUS_SUCCESS in case of success, STATUS_ILLEGAL_FUNCTION
41 * if the ApiNumber is invalid, or STATUS_ACCESS_VIOLATION if there
42 * was a problem executing the API.
43 *
44 * @remarks None.
45 *
46 *--*/
47 NTSTATUS
48 NTAPI
49 CsrCallServerFromServer(IN PCSR_API_MESSAGE ReceiveMsg,
50 IN OUT PCSR_API_MESSAGE ReplyMsg)
51 {
52 ULONG ServerId;
53 PCSR_SERVER_DLL ServerDll;
54 ULONG ApiId;
55 CSR_REPLY_CODE ReplyCode = CsrReplyImmediately;
56
57 /* Get the Server ID */
58 ServerId = CSR_API_NUMBER_TO_SERVER_ID(ReceiveMsg->ApiNumber);
59
60 /* Make sure that the ID is within limits, and the Server DLL loaded */
61 if ((ServerId >= CSR_SERVER_DLL_MAX) ||
62 (!(ServerDll = CsrLoadedServerDll[ServerId])))
63 {
64 /* We are beyond the Maximum Server ID */
65 DPRINT1("CSRSS: %lx is invalid ServerDllIndex (%08x)\n", ServerId, ServerDll);
66 ReplyMsg->Status = (ULONG)STATUS_ILLEGAL_FUNCTION;
67 return STATUS_ILLEGAL_FUNCTION;
68 }
69 else
70 {
71 /* Get the API ID, normalized with our Base ID */
72 ApiId = CSR_API_NUMBER_TO_API_ID(ReceiveMsg->ApiNumber) - ServerDll->ApiBase;
73
74 /* Make sure that the ID is within limits, and the entry exists */
75 if ((ApiId >= ServerDll->HighestApiSupported) ||
76 ((ServerDll->ValidTable) && !(ServerDll->ValidTable[ApiId])))
77 {
78 /* We are beyond the Maximum API ID, or it doesn't exist */
79 DPRINT1("CSRSS: %lx (%s) is invalid ApiTableIndex for %Z or is an "
80 "invalid API to call from the server.\n",
81 ServerDll->ValidTable[ApiId],
82 ((ServerDll->NameTable) && (ServerDll->NameTable[ApiId])) ?
83 ServerDll->NameTable[ApiId] : "*** UNKNOWN ***", &ServerDll->Name);
84 DbgBreakPoint();
85 ReplyMsg->Status = (ULONG)STATUS_ILLEGAL_FUNCTION;
86 return STATUS_ILLEGAL_FUNCTION;
87 }
88 }
89
90 if (CsrDebug & 2)
91 {
92 DPRINT1("CSRSS: %s Api Request received from server process\n",
93 ServerDll->NameTable[ApiId]);
94 }
95
96 /* Validation complete, start SEH */
97 _SEH2_TRY
98 {
99 /* Call the API, get the reply code and return the result */
100 ReplyMsg->Status = ServerDll->DispatchTable[ApiId](ReceiveMsg, &ReplyCode);
101 }
102 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
103 {
104 /* If we got an exception, return access violation */
105 ReplyMsg->Status = STATUS_ACCESS_VIOLATION;
106 }
107 _SEH2_END;
108
109 /* Return success */
110 return STATUS_SUCCESS;
111 }
112
113 /*++
114 * @name CsrApiHandleConnectionRequest
115 *
116 * The CsrApiHandleConnectionRequest routine handles and accepts a new
117 * connection request to the CSR API LPC Port.
118 *
119 * @param ApiMessage
120 * Pointer to the incoming CSR API Message which contains the
121 * connection request.
122 *
123 * @return STATUS_SUCCESS in case of success, or status code which caused
124 * the routine to error.
125 *
126 * @remarks This routine is responsible for attaching the Shared Section to
127 * new clients connecting to CSR.
128 *
129 *--*/
130 NTSTATUS
131 NTAPI
132 CsrApiHandleConnectionRequest(IN PCSR_API_MESSAGE ApiMessage)
133 {
134 PCSR_THREAD CsrThread = NULL;
135 PCSR_PROCESS CsrProcess = NULL;
136 NTSTATUS Status = STATUS_SUCCESS;
137 PCSR_CONNECTION_INFO ConnectInfo = &ApiMessage->ConnectionInfo;
138 BOOLEAN AllowConnection = FALSE;
139 REMOTE_PORT_VIEW RemotePortView;
140 HANDLE ServerPort;
141
142 /* Acquire the Process Lock */
143 CsrAcquireProcessLock();
144
145 /* Lookup the CSR Thread */
146 CsrThread = CsrLocateThreadByClientId(NULL, &ApiMessage->Header.ClientId);
147
148 /* Check if we have a thread */
149 if (CsrThread)
150 {
151 /* Get the Process */
152 CsrProcess = CsrThread->Process;
153
154 /* Make sure we have a Process as well */
155 if (CsrProcess)
156 {
157 /* Reference the Process */
158 CsrLockedReferenceProcess(CsrThread->Process);
159
160 /* Release the lock */
161 CsrReleaseProcessLock();
162
163 /* Duplicate the Object Directory */
164 Status = NtDuplicateObject(NtCurrentProcess(),
165 CsrObjectDirectory,
166 CsrProcess->ProcessHandle,
167 &ConnectInfo->ObjectDirectory,
168 0,
169 0,
170 DUPLICATE_SAME_ACCESS |
171 DUPLICATE_SAME_ATTRIBUTES);
172
173 /* Acquire the lock */
174 CsrAcquireProcessLock();
175
176 /* Check for success */
177 if (NT_SUCCESS(Status))
178 {
179 /* Attach the Shared Section */
180 Status = CsrSrvAttachSharedSection(CsrProcess, ConnectInfo);
181
182 /* Check how this went */
183 if (NT_SUCCESS(Status)) AllowConnection = TRUE;
184 }
185
186 /* Dereference the project */
187 CsrLockedDereferenceProcess(CsrProcess);
188 }
189 }
190
191 /* Release the lock */
192 CsrReleaseProcessLock();
193
194 /* Setup the Port View Structure */
195 RemotePortView.Length = sizeof(REMOTE_PORT_VIEW);
196 RemotePortView.ViewSize = 0;
197 RemotePortView.ViewBase = NULL;
198
199 /* Save the Process ID */
200 ConnectInfo->ProcessId = NtCurrentTeb()->ClientId.UniqueProcess;
201
202 /* Accept the Connection */
203 Status = NtAcceptConnectPort(&ServerPort,
204 AllowConnection ? UlongToPtr(CsrProcess->SequenceNumber) : 0,
205 &ApiMessage->Header,
206 AllowConnection,
207 NULL,
208 &RemotePortView);
209 if (!NT_SUCCESS(Status))
210 {
211 DPRINT1("CSRSS: NtAcceptConnectPort - failed. Status == %X\n", Status);
212 }
213 else if (AllowConnection)
214 {
215 if (CsrDebug & 2)
216 {
217 DPRINT1("CSRSS: ClientId: %lx.%lx has ClientView: Base=%p, Size=%lx\n",
218 ApiMessage->Header.ClientId.UniqueProcess,
219 ApiMessage->Header.ClientId.UniqueThread,
220 RemotePortView.ViewBase,
221 RemotePortView.ViewSize);
222 }
223
224 /* Set some Port Data in the Process */
225 CsrProcess->ClientPort = ServerPort;
226 CsrProcess->ClientViewBase = (ULONG_PTR)RemotePortView.ViewBase;
227 CsrProcess->ClientViewBounds = (ULONG_PTR)((ULONG_PTR)RemotePortView.ViewBase +
228 (ULONG_PTR)RemotePortView.ViewSize);
229
230 /* Complete the connection */
231 Status = NtCompleteConnectPort(ServerPort);
232 if (!NT_SUCCESS(Status))
233 {
234 DPRINT1("CSRSS: NtCompleteConnectPort - failed. Status == %X\n", Status);
235 }
236 }
237 else
238 {
239 DPRINT1("CSRSS: Rejecting Connection Request from ClientId: %lx.%lx\n",
240 ApiMessage->Header.ClientId.UniqueProcess,
241 ApiMessage->Header.ClientId.UniqueThread);
242 }
243
244 /* Return status to caller */
245 return Status;
246 }
247
248 /*++
249 * @name CsrpCheckRequestThreads
250 *
251 * The CsrpCheckRequestThreads routine checks if there are no more threads
252 * to handle CSR API Requests, and creates a new thread if possible, to
253 * avoid starvation.
254 *
255 * @param None.
256 *
257 * @return STATUS_SUCCESS in case of success, STATUS_UNSUCCESSFUL
258 * if a new thread couldn't be created.
259 *
260 * @remarks None.
261 *
262 *--*/
263 NTSTATUS
264 NTAPI
265 CsrpCheckRequestThreads(VOID)
266 {
267 HANDLE hThread;
268 CLIENT_ID ClientId;
269 NTSTATUS Status;
270
271 /* Decrease the count, and see if we're out */
272 if (!(_InterlockedDecrement(&CsrpStaticThreadCount)))
273 {
274 /* Check if we've still got space for a Dynamic Thread */
275 if (CsrpDynamicThreadTotal < CsrMaxApiRequestThreads)
276 {
277 /* Create a new dynamic thread */
278 Status = RtlCreateUserThread(NtCurrentProcess(),
279 NULL,
280 TRUE,
281 0,
282 0,
283 0,
284 (PVOID)CsrApiRequestThread,
285 NULL,
286 &hThread,
287 &ClientId);
288 /* Check success */
289 if (NT_SUCCESS(Status))
290 {
291 /* Increase the thread counts */
292 _InterlockedIncrement(&CsrpStaticThreadCount);
293 _InterlockedIncrement(&CsrpDynamicThreadTotal);
294
295 /* Add a new server thread */
296 if (CsrAddStaticServerThread(hThread,
297 &ClientId,
298 CsrThreadIsServerThread))
299 {
300 /* Activate it */
301 NtResumeThread(hThread, NULL);
302 }
303 else
304 {
305 /* Failed to create a new static thread */
306 _InterlockedDecrement(&CsrpStaticThreadCount);
307 _InterlockedDecrement(&CsrpDynamicThreadTotal);
308
309 /* Terminate it */
310 DPRINT1("Failing\n");
311 NtTerminateThread(hThread, 0);
312 NtClose(hThread);
313
314 /* Return */
315 return STATUS_UNSUCCESSFUL;
316 }
317 }
318 }
319 }
320
321 /* Success */
322 return STATUS_SUCCESS;
323 }
324
325 /*++
326 * @name CsrApiRequestThread
327 *
328 * The CsrApiRequestThread routine handles incoming messages or connection
329 * requests on the CSR API LPC Port.
330 *
331 * @param Parameter
332 * System-default user-defined parameter. Unused.
333 *
334 * @return The thread exit code, if the thread is terminated.
335 *
336 * @remarks Before listening on the port, the routine will first attempt
337 * to connect to the user subsystem.
338 *
339 *--*/
340 NTSTATUS
341 NTAPI
342 CsrApiRequestThread(IN PVOID Parameter)
343 {
344 PTEB Teb = NtCurrentTeb();
345 LARGE_INTEGER TimeOut;
346 PCSR_THREAD CurrentThread, CsrThread;
347 NTSTATUS Status;
348 CSR_REPLY_CODE ReplyCode;
349 PCSR_API_MESSAGE ReplyMsg;
350 CSR_API_MESSAGE ReceiveMsg;
351 PCSR_PROCESS CsrProcess;
352 PHARDERROR_MSG HardErrorMsg;
353 PVOID PortContext;
354 PCSR_SERVER_DLL ServerDll;
355 PCLIENT_DIED_MSG ClientDiedMsg;
356 PDBGKM_MSG DebugMessage;
357 ULONG ServerId, ApiId, MessageType, i;
358 HANDLE ReplyPort;
359
360 /* Setup LPC loop port and message */
361 ReplyMsg = NULL;
362 ReplyPort = CsrApiPort;
363
364 /* Connect to user32 */
365 while (!CsrConnectToUser())
366 {
367 /* Set up the timeout for the connect (30 seconds) */
368 TimeOut.QuadPart = -30 * 1000 * 1000 * 10;
369
370 /* Keep trying until we get a response */
371 Teb->Win32ClientInfo[0] = 0;
372 NtDelayExecution(FALSE, &TimeOut);
373 }
374
375 /* Get our thread */
376 CurrentThread = Teb->CsrClientThread;
377
378 /* If we got an event... */
379 if (Parameter)
380 {
381 /* Set it, to let stuff waiting on us load */
382 Status = NtSetEvent((HANDLE)Parameter, NULL);
383 ASSERT(NT_SUCCESS(Status));
384
385 /* Increase the Thread Counts */
386 _InterlockedIncrement(&CsrpStaticThreadCount);
387 _InterlockedIncrement(&CsrpDynamicThreadTotal);
388 }
389
390 /* Now start the loop */
391 while (TRUE)
392 {
393 /* Make sure the real CID is set */
394 Teb->RealClientId = Teb->ClientId;
395
396 /* Debug check */
397 if (Teb->CountOfOwnedCriticalSections)
398 {
399 DPRINT1("CSRSRV: FATAL ERROR. CsrThread is Idle while holding %lu critical sections\n",
400 Teb->CountOfOwnedCriticalSections);
401 DPRINT1("CSRSRV: Last Receive Message %lx ReplyMessage %lx\n",
402 &ReceiveMsg, ReplyMsg);
403 DbgBreakPoint();
404 }
405
406 /* Wait for a message to come through */
407 Status = NtReplyWaitReceivePort(ReplyPort,
408 &PortContext,
409 &ReplyMsg->Header,
410 &ReceiveMsg.Header);
411
412 /* Check if we didn't get success */
413 if (Status != STATUS_SUCCESS)
414 {
415 /* Was it a failure or another success code? */
416 if (!NT_SUCCESS(Status))
417 {
418 /* Check for specific status cases */
419 if ((Status != STATUS_INVALID_CID) &&
420 (Status != STATUS_UNSUCCESSFUL) &&
421 ((Status == STATUS_INVALID_HANDLE) || (ReplyPort == CsrApiPort)))
422 {
423 /* Notify the debugger */
424 DPRINT1("CSRSS: ReceivePort failed - Status == %X\n", Status);
425 DPRINT1("CSRSS: ReplyPortHandle %lx CsrApiPort %lx\n", ReplyPort, CsrApiPort);
426 }
427
428 /* We failed big time, so start out fresh */
429 ReplyMsg = NULL;
430 ReplyPort = CsrApiPort;
431 continue;
432 }
433 else
434 {
435 /* A bizare "success" code, just try again */
436 DPRINT1("NtReplyWaitReceivePort returned \"success\" status 0x%x\n", Status);
437 continue;
438 }
439 }
440
441 /* Use whatever Client ID we got */
442 Teb->RealClientId = ReceiveMsg.Header.ClientId;
443
444 /* Get the Message Type */
445 MessageType = ReceiveMsg.Header.u2.s2.Type;
446
447 /* Handle connection requests */
448 if (MessageType == LPC_CONNECTION_REQUEST)
449 {
450 /* Handle the Connection Request */
451 CsrApiHandleConnectionRequest(&ReceiveMsg);
452
453 ReplyMsg = NULL;
454 ReplyPort = CsrApiPort;
455 continue;
456 }
457
458 /* It's some other kind of request. Get the lock for the lookup */
459 CsrAcquireProcessLock();
460
461 /* Now do the lookup to get the CSR_THREAD */
462 CsrThread = CsrLocateThreadByClientId(&CsrProcess,
463 &ReceiveMsg.Header.ClientId);
464
465 /* Did we find a thread? */
466 if (!CsrThread)
467 {
468 /* This wasn't a CSR Thread, release lock */
469 CsrReleaseProcessLock();
470
471 /* If this was an exception, handle it */
472 if (MessageType == LPC_EXCEPTION)
473 {
474 ReplyMsg = &ReceiveMsg;
475 ReplyPort = CsrApiPort;
476 ReplyMsg->Status = DBG_CONTINUE;
477 }
478 else if (MessageType == LPC_PORT_CLOSED ||
479 MessageType == LPC_CLIENT_DIED)
480 {
481 /* The Client or Port are gone, loop again */
482 ReplyMsg = NULL;
483 ReplyPort = CsrApiPort;
484 }
485 else if (MessageType == LPC_ERROR_EVENT)
486 {
487 /* If it's a hard error, handle this too */
488 HardErrorMsg = (PHARDERROR_MSG)&ReceiveMsg;
489
490 /* Default it to unhandled */
491 HardErrorMsg->Response = ResponseNotHandled;
492
493 /* Check if there are free api threads */
494 CsrpCheckRequestThreads();
495 if (CsrpStaticThreadCount)
496 {
497 /* Loop every Server DLL */
498 for (i = 0; i < CSR_SERVER_DLL_MAX; i++)
499 {
500 /* Get the Server DLL */
501 ServerDll = CsrLoadedServerDll[i];
502
503 /* Check if it's valid and if it has a Hard Error Callback */
504 if ((ServerDll) && (ServerDll->HardErrorCallback))
505 {
506 /* Call it */
507 ServerDll->HardErrorCallback(NULL /* == CsrThread */, HardErrorMsg);
508
509 /* If it's handled, get out of here */
510 if (HardErrorMsg->Response != ResponseNotHandled) break;
511 }
512 }
513 }
514
515 /* Increase the thread count */
516 _InterlockedIncrement(&CsrpStaticThreadCount);
517
518 /* If the response was 0xFFFFFFFF, we'll ignore it */
519 if (HardErrorMsg->Response == 0xFFFFFFFF)
520 {
521 ReplyMsg = NULL;
522 ReplyPort = CsrApiPort;
523 }
524 else
525 {
526 ReplyMsg = &ReceiveMsg;
527 ReplyPort = CsrApiPort;
528 }
529 }
530 else if (MessageType == LPC_REQUEST)
531 {
532 /* This is an API Message coming from a non-CSR Thread */
533 ReplyMsg = &ReceiveMsg;
534 ReplyPort = CsrApiPort;
535 ReplyMsg->Status = STATUS_ILLEGAL_FUNCTION;
536 }
537 else if (MessageType == LPC_DATAGRAM)
538 {
539 /* This is an API call, get the Server ID */
540 ServerId = CSR_API_NUMBER_TO_SERVER_ID(ReceiveMsg.ApiNumber);
541
542 /* Make sure that the ID is within limits, and the Server DLL loaded */
543 ServerDll = NULL;
544 if ((ServerId >= CSR_SERVER_DLL_MAX) ||
545 (!(ServerDll = CsrLoadedServerDll[ServerId])))
546 {
547 /* We are beyond the Maximum Server ID */
548 DPRINT1("CSRSS: %lx is invalid ServerDllIndex (%08x)\n",
549 ServerId, ServerDll);
550 DbgBreakPoint();
551
552 ReplyMsg = NULL;
553 ReplyPort = CsrApiPort;
554 continue;
555 }
556
557 /* Get the API ID, normalized with our Base ID */
558 ApiId = CSR_API_NUMBER_TO_API_ID(ReceiveMsg.ApiNumber) - ServerDll->ApiBase;
559
560 /* Make sure that the ID is within limits, and the entry exists */
561 if (ApiId >= ServerDll->HighestApiSupported)
562 {
563 /* We are beyond the Maximum API ID, or it doesn't exist */
564 DPRINT1("CSRSS: %lx is invalid ApiTableIndex for %Z\n",
565 CSR_API_NUMBER_TO_API_ID(ReceiveMsg.ApiNumber),
566 &ServerDll->Name);
567
568 ReplyPort = CsrApiPort;
569 ReplyMsg = NULL;
570 continue;
571 }
572
573 if (CsrDebug & 2)
574 {
575 DPRINT1("[%02x] CSRSS: [%02x,%02x] - %s Api called from %08x\n",
576 Teb->ClientId.UniqueThread,
577 ReceiveMsg.Header.ClientId.UniqueProcess,
578 ReceiveMsg.Header.ClientId.UniqueThread,
579 ServerDll->NameTable[ApiId],
580 NULL);
581 }
582
583 /* Assume success */
584 ReceiveMsg.Status = STATUS_SUCCESS;
585
586 /* Validation complete, start SEH */
587 _SEH2_TRY
588 {
589 /* Make sure we have enough threads */
590 CsrpCheckRequestThreads();
591
592 /* Call the API and get the reply code */
593 ReplyMsg = NULL;
594 ReplyPort = CsrApiPort;
595 ServerDll->DispatchTable[ApiId](&ReceiveMsg, &ReplyCode);
596
597 /* Increase the static thread count */
598 _InterlockedIncrement(&CsrpStaticThreadCount);
599 }
600 _SEH2_EXCEPT(CsrUnhandledExceptionFilter(_SEH2_GetExceptionInformation()))
601 {
602 ReplyMsg = NULL;
603 ReplyPort = CsrApiPort;
604 }
605 _SEH2_END;
606 }
607 else
608 {
609 /* Some other ignored message type */
610 ReplyMsg = NULL;
611 ReplyPort = CsrApiPort;
612 }
613
614 /* Keep going */
615 continue;
616 }
617
618 /* We have a valid thread, was this an LPC Request? */
619 if (MessageType != LPC_REQUEST)
620 {
621 /* It's not an API, check if the client died */
622 if (MessageType == LPC_CLIENT_DIED)
623 {
624 /* Get the information and check if it matches our thread */
625 ClientDiedMsg = (PCLIENT_DIED_MSG)&ReceiveMsg;
626 if (ClientDiedMsg->CreateTime.QuadPart == CsrThread->CreateTime.QuadPart)
627 {
628 /* Now we reply to the dying client */
629 ReplyPort = CsrThread->Process->ClientPort;
630
631 /* Reference the thread */
632 CsrLockedReferenceThread(CsrThread);
633
634 /* Destroy the thread in the API Message */
635 CsrDestroyThread(&ReceiveMsg.Header.ClientId);
636
637 /* Check if the thread was actually ourselves */
638 if (CsrProcess->ThreadCount == 1)
639 {
640 /* Kill the process manually here */
641 CsrDestroyProcess(&CsrThread->ClientId, 0);
642 }
643
644 /* Remove our extra reference */
645 CsrLockedDereferenceThread(CsrThread);
646 }
647
648 /* Release the lock and keep looping */
649 CsrReleaseProcessLock();
650
651 ReplyMsg = NULL;
652 ReplyPort = CsrApiPort;
653 continue;
654 }
655
656 /* Reference the thread and release the lock */
657 CsrLockedReferenceThread(CsrThread);
658 CsrReleaseProcessLock();
659
660 /* Check if this was an exception */
661 if (MessageType == LPC_EXCEPTION)
662 {
663 /* Kill the process */
664 NtTerminateProcess(CsrProcess->ProcessHandle, STATUS_ABANDONED);
665
666 /* Destroy it from CSR */
667 CsrDestroyProcess(&ReceiveMsg.Header.ClientId, STATUS_ABANDONED);
668
669 /* Return a Debug Message */
670 DebugMessage = (PDBGKM_MSG)&ReceiveMsg;
671 DebugMessage->ReturnedStatus = DBG_CONTINUE;
672 ReplyMsg = &ReceiveMsg;
673 ReplyPort = CsrApiPort;
674
675 /* Remove our extra reference */
676 CsrDereferenceThread(CsrThread);
677 }
678 else if (MessageType == LPC_ERROR_EVENT)
679 {
680 /* If it's a hard error, handle this too */
681 HardErrorMsg = (PHARDERROR_MSG)&ReceiveMsg;
682
683 /* Default it to unhandled */
684 HardErrorMsg->Response = ResponseNotHandled;
685
686 /* Check if there are free api threads */
687 CsrpCheckRequestThreads();
688 if (CsrpStaticThreadCount)
689 {
690 /* Loop every Server DLL */
691 for (i = 0; i < CSR_SERVER_DLL_MAX; i++)
692 {
693 /* Get the Server DLL */
694 ServerDll = CsrLoadedServerDll[i];
695
696 /* Check if it's valid and if it has a Hard Error Callback */
697 if ((ServerDll) && (ServerDll->HardErrorCallback))
698 {
699 /* Call it */
700 ServerDll->HardErrorCallback(CsrThread, HardErrorMsg);
701
702 /* If it's handled, get out of here */
703 if (HardErrorMsg->Response != ResponseNotHandled) break;
704 }
705 }
706 }
707
708 /* Increase the thread count */
709 _InterlockedIncrement(&CsrpStaticThreadCount);
710
711 /* If the response was 0xFFFFFFFF, we'll ignore it */
712 if (HardErrorMsg->Response == 0xFFFFFFFF)
713 {
714 ReplyMsg = NULL;
715 ReplyPort = CsrApiPort;
716 }
717 else
718 {
719 CsrDereferenceThread(CsrThread);
720 ReplyMsg = &ReceiveMsg;
721 ReplyPort = CsrApiPort;
722 }
723 }
724 else
725 {
726 /* Something else */
727 CsrDereferenceThread(CsrThread);
728 ReplyMsg = NULL;
729 }
730
731 /* Keep looping */
732 continue;
733 }
734
735 /* We got an API Request */
736 CsrLockedReferenceThread(CsrThread);
737 CsrReleaseProcessLock();
738
739 /* This is an API call, get the Server ID */
740 ServerId = CSR_API_NUMBER_TO_SERVER_ID(ReceiveMsg.ApiNumber);
741
742 /* Make sure that the ID is within limits, and the Server DLL loaded */
743 ServerDll = NULL;
744 if ((ServerId >= CSR_SERVER_DLL_MAX) ||
745 (!(ServerDll = CsrLoadedServerDll[ServerId])))
746 {
747 /* We are beyond the Maximum Server ID */
748 DPRINT1("CSRSS: %lx is invalid ServerDllIndex (%08x)\n",
749 ServerId, ServerDll);
750 DbgBreakPoint();
751
752 ReplyPort = CsrApiPort;
753 ReplyMsg = &ReceiveMsg;
754 ReplyMsg->Status = STATUS_ILLEGAL_FUNCTION;
755 CsrDereferenceThread(CsrThread);
756 continue;
757 }
758
759 /* Get the API ID, normalized with our Base ID */
760 ApiId = CSR_API_NUMBER_TO_API_ID(ReceiveMsg.ApiNumber) - ServerDll->ApiBase;
761
762 /* Make sure that the ID is within limits, and the entry exists */
763 if (ApiId >= ServerDll->HighestApiSupported)
764 {
765 /* We are beyond the Maximum API ID, or it doesn't exist */
766 DPRINT1("CSRSS: %lx is invalid ApiTableIndex for %Z\n",
767 CSR_API_NUMBER_TO_API_ID(ReceiveMsg.ApiNumber),
768 &ServerDll->Name);
769
770 ReplyPort = CsrApiPort;
771 ReplyMsg = &ReceiveMsg;
772 ReplyMsg->Status = STATUS_ILLEGAL_FUNCTION;
773 CsrDereferenceThread(CsrThread);
774 continue;
775 }
776
777 if (CsrDebug & 2)
778 {
779 DPRINT1("[%02x] CSRSS: [%02x,%02x] - %s Api called from %08x, Process %08x - %08x\n",
780 Teb->ClientId.UniqueThread,
781 ReceiveMsg.Header.ClientId.UniqueProcess,
782 ReceiveMsg.Header.ClientId.UniqueThread,
783 ServerDll->NameTable[ApiId],
784 CsrThread,
785 CsrThread->Process,
786 CsrProcess);
787 }
788
789 /* Assume success */
790 ReplyMsg = &ReceiveMsg;
791 ReceiveMsg.Status = STATUS_SUCCESS;
792
793 /* Now we reply to a particular client */
794 ReplyPort = CsrThread->Process->ClientPort;
795
796 /* Check if there's a capture buffer */
797 if (ReceiveMsg.CsrCaptureData)
798 {
799 /* Capture the arguments */
800 if (!CsrCaptureArguments(CsrThread, &ReceiveMsg))
801 {
802 /* Ignore this message if we failed to get the arguments */
803 CsrDereferenceThread(CsrThread);
804 continue;
805 }
806 }
807
808 /* Validation complete, start SEH */
809 _SEH2_TRY
810 {
811 /* Make sure we have enough threads */
812 CsrpCheckRequestThreads();
813
814 Teb->CsrClientThread = CsrThread;
815
816 /* Call the API, get the reply code and return the result */
817 ReplyCode = CsrReplyImmediately;
818 ReplyMsg->Status = ServerDll->DispatchTable[ApiId](&ReceiveMsg, &ReplyCode);
819
820 /* Increase the static thread count */
821 _InterlockedIncrement(&CsrpStaticThreadCount);
822
823 Teb->CsrClientThread = CurrentThread;
824
825 if (ReplyCode == CsrReplyAlreadySent)
826 {
827 if (ReceiveMsg.CsrCaptureData)
828 {
829 CsrReleaseCapturedArguments(&ReceiveMsg);
830 }
831 ReplyMsg = NULL;
832 ReplyPort = CsrApiPort;
833 CsrDereferenceThread(CsrThread);
834 }
835 else if (ReplyCode == CsrReplyDeadClient)
836 {
837 /* Reply to the death message */
838 NtReplyPort(ReplyPort, &ReplyMsg->Header);
839
840 /* Reply back to the API port now */
841 ReplyMsg = NULL;
842 ReplyPort = CsrApiPort;
843
844 CsrDereferenceThread(CsrThread);
845 }
846 else if (ReplyCode == CsrReplyPending)
847 {
848 ReplyMsg = NULL;
849 ReplyPort = CsrApiPort;
850 }
851 else
852 {
853 if (ReceiveMsg.CsrCaptureData)
854 {
855 CsrReleaseCapturedArguments(&ReceiveMsg);
856 }
857 CsrDereferenceThread(CsrThread);
858 }
859 }
860 _SEH2_EXCEPT(CsrUnhandledExceptionFilter(_SEH2_GetExceptionInformation()))
861 {
862 ReplyMsg = NULL;
863 ReplyPort = CsrApiPort;
864 }
865 _SEH2_END;
866 }
867
868 /* We're out of the loop for some reason, terminate! */
869 NtTerminateThread(NtCurrentThread(), Status);
870 return Status;
871 }
872
873 /*++
874 * @name CsrApiPortInitialize
875 *
876 * The CsrApiPortInitialize routine initializes the LPC Port used for
877 * communications with the Client/Server Runtime (CSR) and initializes the
878 * static thread that will handle connection requests and APIs.
879 *
880 * @param None
881 *
882 * @return STATUS_SUCCESS in case of success, STATUS_UNSUCCESSFUL
883 * otherwise.
884 *
885 * @remarks None.
886 *
887 *--*/
888 NTSTATUS
889 NTAPI
890 CsrApiPortInitialize(VOID)
891 {
892 ULONG Size;
893 OBJECT_ATTRIBUTES ObjectAttributes;
894 NTSTATUS Status;
895 HANDLE hRequestEvent, hThread;
896 CLIENT_ID ClientId;
897 PLIST_ENTRY ListHead, NextEntry;
898 PCSR_THREAD ServerThread;
899
900 /* Calculate how much space we'll need for the Port Name */
901 Size = CsrDirectoryName.Length + sizeof(CSR_PORT_NAME) + sizeof(WCHAR);
902
903 /* Create the buffer for it */
904 CsrApiPortName.Buffer = RtlAllocateHeap(CsrHeap, 0, Size);
905 if (!CsrApiPortName.Buffer) return STATUS_NO_MEMORY;
906
907 /* Setup the rest of the empty string */
908 CsrApiPortName.Length = 0;
909 CsrApiPortName.MaximumLength = (USHORT)Size;
910 RtlAppendUnicodeStringToString(&CsrApiPortName, &CsrDirectoryName);
911 RtlAppendUnicodeToString(&CsrApiPortName, UNICODE_PATH_SEP);
912 RtlAppendUnicodeToString(&CsrApiPortName, CSR_PORT_NAME);
913 if (CsrDebug & 1)
914 {
915 DPRINT1("CSRSS: Creating %wZ port and associated threads\n", &CsrApiPortName);
916 DPRINT1("CSRSS: sizeof( CONNECTINFO ) == %ld sizeof( API_MSG ) == %ld\n",
917 sizeof(CSR_CONNECTION_INFO), sizeof(CSR_API_MESSAGE));
918 }
919
920 /* FIXME: Create a Security Descriptor */
921
922 /* Initialize the Attributes */
923 InitializeObjectAttributes(&ObjectAttributes,
924 &CsrApiPortName,
925 0,
926 NULL,
927 NULL /* FIXME: Use the Security Descriptor */);
928
929 /* Create the Port Object */
930 Status = NtCreatePort(&CsrApiPort,
931 &ObjectAttributes,
932 sizeof(CSR_CONNECTION_INFO),
933 sizeof(CSR_API_MESSAGE),
934 16 * PAGE_SIZE);
935 if (NT_SUCCESS(Status))
936 {
937 /* Create the event the Port Thread will use */
938 Status = NtCreateEvent(&hRequestEvent,
939 EVENT_ALL_ACCESS,
940 NULL,
941 SynchronizationEvent,
942 FALSE);
943 if (NT_SUCCESS(Status))
944 {
945 /* Create the Request Thread */
946 Status = RtlCreateUserThread(NtCurrentProcess(),
947 NULL,
948 TRUE,
949 0,
950 0,
951 0,
952 (PVOID)CsrApiRequestThread,
953 (PVOID)hRequestEvent,
954 &hThread,
955 &ClientId);
956 if (NT_SUCCESS(Status))
957 {
958 /* Add this as a static thread to CSRSRV */
959 CsrAddStaticServerThread(hThread, &ClientId, CsrThreadIsServerThread);
960
961 /* Get the Thread List Pointers */
962 ListHead = &CsrRootProcess->ThreadList;
963 NextEntry = ListHead->Flink;
964
965 /* Start looping the list */
966 while (NextEntry != ListHead)
967 {
968 /* Get the Thread */
969 ServerThread = CONTAINING_RECORD(NextEntry, CSR_THREAD, Link);
970
971 /* Start it up */
972 Status = NtResumeThread(ServerThread->ThreadHandle, NULL);
973
974 /* Is this a Server Thread? */
975 if (ServerThread->Flags & CsrThreadIsServerThread)
976 {
977 /* If so, then wait for it to initialize */
978 Status = NtWaitForSingleObject(hRequestEvent, FALSE, NULL);
979 ASSERT(NT_SUCCESS(Status));
980 }
981
982 /* Next thread */
983 NextEntry = NextEntry->Flink;
984 }
985
986 /* We don't need this anymore */
987 NtClose(hRequestEvent);
988 }
989 }
990 }
991
992 /* Return */
993 return Status;
994 }
995
996 /*++
997 * @name CsrConnectToUser
998 * @implemented NT4
999 *
1000 * The CsrConnectToUser connects to the User subsystem.
1001 *
1002 * @param None
1003 *
1004 * @return A pointer to the CSR Thread
1005 *
1006 * @remarks None.
1007 *
1008 *--*/
1009 PCSR_THREAD
1010 NTAPI
1011 CsrConnectToUser(VOID)
1012 {
1013 #if 0 // This code is OK, however it is ClientThreadSetup which sucks.
1014 NTSTATUS Status;
1015 ANSI_STRING DllName;
1016 UNICODE_STRING TempName;
1017 HANDLE hUser32;
1018 STRING StartupName;
1019 PTEB Teb = NtCurrentTeb();
1020 PCSR_THREAD CsrThread;
1021 BOOLEAN Connected;
1022
1023 /* Check if we didn't already find it */
1024 if (!CsrClientThreadSetup)
1025 {
1026 /* Get the DLL Handle for user32.dll */
1027 RtlInitAnsiString(&DllName, "user32");
1028 RtlAnsiStringToUnicodeString(&TempName, &DllName, TRUE);
1029 Status = LdrGetDllHandle(NULL,
1030 NULL,
1031 &TempName,
1032 &hUser32);
1033 RtlFreeUnicodeString(&TempName);
1034
1035 /* If we got the handle, get the Client Thread Startup Entrypoint */
1036 if (NT_SUCCESS(Status))
1037 {
1038 RtlInitAnsiString(&StartupName,"ClientThreadSetup");
1039 Status = LdrGetProcedureAddress(hUser32,
1040 &StartupName,
1041 0,
1042 (PVOID)&CsrClientThreadSetup);
1043 }
1044 }
1045
1046 /* Connect to user32 */
1047 _SEH2_TRY
1048 {
1049 Connected = CsrClientThreadSetup();
1050 }
1051 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1052 {
1053 Connected = FALSE;
1054 } _SEH2_END;
1055
1056 if (!Connected)
1057 {
1058 DPRINT1("CSRSS: CsrConnectToUser failed\n");
1059 return NULL;
1060 }
1061
1062 /* Save pointer to this thread in TEB */
1063 CsrAcquireProcessLock();
1064 CsrThread = CsrLocateThreadInProcess(NULL, &Teb->ClientId);
1065 CsrReleaseProcessLock();
1066 if (CsrThread) Teb->CsrClientThread = CsrThread;
1067
1068 /* Return it */
1069 return CsrThread;
1070
1071 #else
1072
1073 PTEB Teb = NtCurrentTeb();
1074 PCSR_THREAD CsrThread;
1075
1076 /* Save pointer to this thread in TEB */
1077 CsrThread = CsrLocateThreadInProcess(NULL, &Teb->ClientId);
1078 if (CsrThread) Teb->CsrClientThread = CsrThread;
1079
1080 /* Return it */
1081 return CsrThread;
1082 #endif
1083 }
1084
1085 /*++
1086 * @name CsrQueryApiPort
1087 * @implemented NT4
1088 *
1089 * The CsrQueryApiPort routine returns a handle to the CSR API LPC port.
1090 *
1091 * @param None.
1092 *
1093 * @return A handle to the port.
1094 *
1095 * @remarks None.
1096 *
1097 *--*/
1098 HANDLE
1099 NTAPI
1100 CsrQueryApiPort(VOID)
1101 {
1102 DPRINT("CSRSRV: %s called\n", __FUNCTION__);
1103 return CsrApiPort;
1104 }
1105
1106 /*++
1107 * @name CsrCaptureArguments
1108 * @implemented NT5.1
1109 *
1110 * The CsrCaptureArguments routine validates a CSR Capture Buffer and
1111 * re-captures it into a server CSR Capture Buffer.
1112 *
1113 * @param CsrThread
1114 * Pointer to the CSR Thread performing the validation.
1115 *
1116 * @param ApiMessage
1117 * Pointer to the CSR API Message containing the Capture Buffer
1118 * that needs to be validated.
1119 *
1120 * @return TRUE if validation succeeded, FALSE otherwise.
1121 *
1122 * @remarks None.
1123 *
1124 *--*/
1125 BOOLEAN
1126 NTAPI
1127 CsrCaptureArguments(IN PCSR_THREAD CsrThread,
1128 IN PCSR_API_MESSAGE ApiMessage)
1129 {
1130 PCSR_CAPTURE_BUFFER LocalCaptureBuffer = NULL, RemoteCaptureBuffer = NULL;
1131 SIZE_T BufferDistance;
1132 ULONG Length = 0;
1133 ULONG PointerCount;
1134 PULONG_PTR OffsetPointer;
1135 ULONG_PTR CurrentOffset;
1136
1137 /* Use SEH to make sure this is valid */
1138 _SEH2_TRY
1139 {
1140 /* Get the buffer we got from whoever called NTDLL */
1141 LocalCaptureBuffer = ApiMessage->CsrCaptureData;
1142 Length = LocalCaptureBuffer->Size;
1143
1144 /* Now check if the buffer is inside our mapped section */
1145 if (((ULONG_PTR)LocalCaptureBuffer < CsrThread->Process->ClientViewBase) ||
1146 (((ULONG_PTR)LocalCaptureBuffer + Length) >= CsrThread->Process->ClientViewBounds))
1147 {
1148 /* Return failure */
1149 DPRINT1("*** CSRSS: CaptureBuffer outside of ClientView\n");
1150 ApiMessage->Status = STATUS_INVALID_PARAMETER;
1151 _SEH2_YIELD(return FALSE);
1152 }
1153
1154 /* Check if the Length is valid */
1155 if ((FIELD_OFFSET(CSR_CAPTURE_BUFFER, PointerOffsetsArray) +
1156 (LocalCaptureBuffer->PointerCount * sizeof(PVOID)) > Length) ||
1157 (Length > MAXWORD))
1158 {
1159 /* Return failure */
1160 DPRINT1("*** CSRSS: CaptureBuffer %p has bad length\n", LocalCaptureBuffer);
1161 DbgBreakPoint();
1162 ApiMessage->Status = STATUS_INVALID_PARAMETER;
1163 _SEH2_YIELD(return FALSE);
1164 }
1165 }
1166 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1167 {
1168 /* Return failure */
1169 ApiMessage->Status = STATUS_INVALID_PARAMETER;
1170 _SEH2_YIELD(return FALSE);
1171 } _SEH2_END;
1172
1173 /* We validated the incoming buffer, now allocate the remote one */
1174 RemoteCaptureBuffer = RtlAllocateHeap(CsrHeap, HEAP_ZERO_MEMORY, Length);
1175 if (!RemoteCaptureBuffer)
1176 {
1177 /* We're out of memory */
1178 ApiMessage->Status = STATUS_NO_MEMORY;
1179 return FALSE;
1180 }
1181
1182 /* Copy the client's buffer */
1183 RtlMoveMemory(RemoteCaptureBuffer, LocalCaptureBuffer, Length);
1184
1185 /* Calculate the difference between our buffer and the client's */
1186 BufferDistance = (ULONG_PTR)RemoteCaptureBuffer - (ULONG_PTR)LocalCaptureBuffer;
1187
1188 /*
1189 * All the pointer offsets correspond to pointers which point
1190 * to the remote data buffer instead of the local one.
1191 */
1192 PointerCount = RemoteCaptureBuffer->PointerCount;
1193 OffsetPointer = RemoteCaptureBuffer->PointerOffsetsArray;
1194 while (PointerCount--)
1195 {
1196 CurrentOffset = *OffsetPointer;
1197
1198 if (CurrentOffset != 0)
1199 {
1200 /* Get the pointer corresponding to the offset */
1201 CurrentOffset += (ULONG_PTR)ApiMessage;
1202
1203 /* Validate the bounds of the current pointed pointer */
1204 if ((*(PULONG_PTR)CurrentOffset >= CsrThread->Process->ClientViewBase) &&
1205 (*(PULONG_PTR)CurrentOffset < CsrThread->Process->ClientViewBounds))
1206 {
1207 /* Modify the pointed pointer to take into account its new position */
1208 *(PULONG_PTR)CurrentOffset += BufferDistance;
1209 }
1210 else
1211 {
1212 /* Invalid pointer, fail */
1213 DPRINT1("*** CSRSS: CaptureBuffer MessagePointer outside of ClientView\n");
1214 DbgBreakPoint();
1215 ApiMessage->Status = STATUS_INVALID_PARAMETER;
1216 }
1217 }
1218
1219 ++OffsetPointer;
1220 }
1221
1222 /* Check if we got success */
1223 if (ApiMessage->Status != STATUS_SUCCESS)
1224 {
1225 /* Failure. Free the buffer and return */
1226 RtlFreeHeap(CsrHeap, 0, RemoteCaptureBuffer);
1227 return FALSE;
1228 }
1229 else
1230 {
1231 /* Success, save the previous buffer and use the remote capture buffer */
1232 RemoteCaptureBuffer->PreviousCaptureBuffer = LocalCaptureBuffer;
1233 ApiMessage->CsrCaptureData = RemoteCaptureBuffer;
1234 }
1235
1236 /* Success */
1237 return TRUE;
1238 }
1239
1240 /*++
1241 * @name CsrReleaseCapturedArguments
1242 * @implemented NT5.1
1243 *
1244 * The CsrReleaseCapturedArguments routine releases a Capture Buffer
1245 * that was previously captured with CsrCaptureArguments.
1246 *
1247 * @param ApiMessage
1248 * Pointer to the CSR API Message containing the Capture Buffer
1249 * that needs to be released.
1250 *
1251 * @return None.
1252 *
1253 * @remarks None.
1254 *
1255 *--*/
1256 VOID
1257 NTAPI
1258 CsrReleaseCapturedArguments(IN PCSR_API_MESSAGE ApiMessage)
1259 {
1260 PCSR_CAPTURE_BUFFER RemoteCaptureBuffer, LocalCaptureBuffer;
1261 SIZE_T BufferDistance;
1262 ULONG PointerCount;
1263 PULONG_PTR OffsetPointer;
1264 ULONG_PTR CurrentOffset;
1265
1266 /* Get the remote capture buffer */
1267 RemoteCaptureBuffer = ApiMessage->CsrCaptureData;
1268
1269 /* Do not continue if there is no captured buffer */
1270 if (!RemoteCaptureBuffer) return;
1271
1272 /* If there is one, get the corresponding local capture buffer */
1273 LocalCaptureBuffer = RemoteCaptureBuffer->PreviousCaptureBuffer;
1274
1275 /* Free the previous one and use again the local capture buffer */
1276 RemoteCaptureBuffer->PreviousCaptureBuffer = NULL;
1277 ApiMessage->CsrCaptureData = LocalCaptureBuffer;
1278
1279 /* Calculate the difference between our buffer and the client's */
1280 BufferDistance = (ULONG_PTR)RemoteCaptureBuffer - (ULONG_PTR)LocalCaptureBuffer;
1281
1282 /*
1283 * All the pointer offsets correspond to pointers which point
1284 * to the local data buffer instead of the remote one (revert
1285 * the logic of CsrCaptureArguments).
1286 */
1287 PointerCount = RemoteCaptureBuffer->PointerCount;
1288 OffsetPointer = RemoteCaptureBuffer->PointerOffsetsArray;
1289 while (PointerCount--)
1290 {
1291 CurrentOffset = *OffsetPointer;
1292
1293 if (CurrentOffset != 0)
1294 {
1295 /* Get the pointer corresponding to the offset */
1296 CurrentOffset += (ULONG_PTR)ApiMessage;
1297
1298 /* Modify the pointed pointer to take into account its new position */
1299 *(PULONG_PTR)CurrentOffset -= BufferDistance;
1300 }
1301
1302 ++OffsetPointer;
1303 }
1304
1305 /* Copy the data back */
1306 RtlMoveMemory(LocalCaptureBuffer, RemoteCaptureBuffer, RemoteCaptureBuffer->Size);
1307
1308 /* Free our allocated buffer */
1309 RtlFreeHeap(CsrHeap, 0, RemoteCaptureBuffer);
1310 }
1311
1312
1313 /*++
1314 * @name CsrValidateMessageBuffer
1315 * @implemented NT5.1
1316 *
1317 * The CsrValidateMessageBuffer routine validates a captured message buffer
1318 * present in the CSR Api Message
1319 *
1320 * @param ApiMessage
1321 * Pointer to the CSR API Message containing the CSR Capture Buffer.
1322 *
1323 * @param Buffer
1324 * Pointer to the message buffer to validate.
1325 *
1326 * @param ElementCount
1327 * Number of elements contained in the message buffer.
1328 *
1329 * @param ElementSize
1330 * Size of each element.
1331 *
1332 * @return TRUE if validation succeeded, FALSE otherwise.
1333 *
1334 * @remarks None.
1335 *
1336 *--*/
1337 BOOLEAN
1338 NTAPI
1339 CsrValidateMessageBuffer(IN PCSR_API_MESSAGE ApiMessage,
1340 IN PVOID *Buffer,
1341 IN ULONG ElementCount,
1342 IN ULONG ElementSize)
1343 {
1344 PCSR_CAPTURE_BUFFER CaptureBuffer = ApiMessage->CsrCaptureData;
1345 SIZE_T BufferDistance = (ULONG_PTR)Buffer - (ULONG_PTR)ApiMessage;
1346 ULONG PointerCount;
1347 PULONG_PTR OffsetPointer;
1348
1349 /*
1350 * Check whether we have a valid buffer pointer, elements
1351 * of non-trivial size and that we don't overflow.
1352 */
1353 if (!Buffer || ElementSize == 0 ||
1354 (ULONGLONG)ElementCount * ElementSize > (ULONGLONG)0xFFFFFFFF)
1355 {
1356 return FALSE;
1357 }
1358
1359 /* Check if didn't get a buffer and there aren't any arguments to check */
1360 // if (!*Buffer && (ElementCount * ElementSize == 0))
1361 if (!*Buffer && ElementCount == 0) // Here ElementSize != 0 therefore only ElementCount can be == 0
1362 return TRUE;
1363
1364 /* Check if we have no capture buffer */
1365 if (!CaptureBuffer)
1366 {
1367 /*
1368 * In this case, check only the Process ID
1369 * and if there is a match, we succeed.
1370 */
1371 if (NtCurrentTeb()->ClientId.UniqueProcess ==
1372 ApiMessage->Header.ClientId.UniqueProcess)
1373 {
1374 return TRUE;
1375 }
1376 }
1377 else
1378 {
1379 /* Make sure that there is still space left in the buffer */
1380 if ((CaptureBuffer->Size - (ULONG_PTR)*Buffer + (ULONG_PTR)CaptureBuffer) >=
1381 (ElementCount * ElementSize))
1382 {
1383 /* Perform the validation test */
1384 PointerCount = CaptureBuffer->PointerCount;
1385 OffsetPointer = CaptureBuffer->PointerOffsetsArray;
1386 while (PointerCount--)
1387 {
1388 /*
1389 * The pointer offset must be equal to the delta between
1390 * the addresses of the buffer and of the API message.
1391 */
1392 if (*OffsetPointer == BufferDistance)
1393 {
1394 return TRUE;
1395 }
1396 ++OffsetPointer;
1397 }
1398 }
1399 }
1400
1401 /* Failure */
1402 DPRINT1("CSRSRV: Bad message buffer %p\n", ApiMessage);
1403 DbgBreakPoint();
1404 return FALSE;
1405 }
1406
1407 /*** This is what we have in consrv/server.c ***
1408
1409 /\* Ensure that a captured buffer is safe to access *\/
1410 BOOL FASTCALL
1411 Win32CsrValidateBuffer(PCSR_PROCESS ProcessData, PVOID Buffer,
1412 SIZE_T NumElements, SIZE_T ElementSize)
1413 {
1414 /\* Check that the following conditions are true:
1415 * 1. The start of the buffer is somewhere within the process's
1416 * shared memory section view.
1417 * 2. The remaining space in the view is at least as large as the buffer.
1418 * (NB: Please don't try to "optimize" this by using multiplication
1419 * instead of division; remember that 2147483648 * 2 = 0.)
1420 * 3. The buffer is DWORD-aligned.
1421 *\/
1422 ULONG_PTR Offset = (BYTE *)Buffer - (BYTE *)ProcessData->ClientViewBase;
1423 if (Offset >= ProcessData->ClientViewBounds
1424 || NumElements > (ProcessData->ClientViewBounds - Offset) / ElementSize
1425 || (Offset & (sizeof(DWORD) - 1)) != 0)
1426 {
1427 DPRINT1("Invalid buffer %p(%u*%u); section view is %p(%u)\n",
1428 Buffer, NumElements, ElementSize,
1429 ProcessData->ClientViewBase, ProcessData->ClientViewBounds);
1430 return FALSE;
1431 }
1432 return TRUE;
1433 }
1434
1435 ***********************************************/
1436
1437 /*++
1438 * @name CsrValidateMessageString
1439 * @implemented NT5.1
1440 *
1441 * The CsrValidateMessageString validates a captured Wide-Character String
1442 * present in a CSR API Message.
1443 *
1444 * @param ApiMessage
1445 * Pointer to the CSR API Message containing the CSR Capture Buffer.
1446 *
1447 * @param MessageString
1448 * Pointer to the buffer containing the string to validate.
1449 *
1450 * @return TRUE if validation succeeded, FALSE otherwise.
1451 *
1452 * @remarks None.
1453 *
1454 *--*/
1455 BOOLEAN
1456 NTAPI
1457 CsrValidateMessageString(IN PCSR_API_MESSAGE ApiMessage,
1458 IN LPWSTR *MessageString)
1459 {
1460 if (MessageString)
1461 {
1462 return CsrValidateMessageBuffer(ApiMessage,
1463 (PVOID*)MessageString,
1464 wcslen(*MessageString) + 1,
1465 sizeof(WCHAR));
1466 }
1467 else
1468 {
1469 return FALSE;
1470 }
1471 }
1472
1473 /* EOF */
A free Windows-compatible Operating System