wine/wine-staging
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-staging.git synced 2025-09-12 18:50:20 -07:00
Code Issues Packages Projects Releases Wiki Activity

Rebase against 2346a4012aed5a150cd971ca1e929528722a4d12.

Browse Source
This commit is contained in:
Zebediah Figura
2018-08-31 19:16:27 -05:00
parent 90c47aa854
commit 94f314ccaa
6 changed files with 37 additions and 425 deletions
Download Patch File Download Diff File Expand all files Collapse all files

96
patches/ntoskrnl.exe-Fix_Relocation/0001-ntoskrnl.exe-Avoid-invalid-memory-access-when-reloca.patch Normal file
View File

@@ -0,0 +1,96 @@
From 77f6fbe85432f4bc61b1b9b27a0992a1f6269344 Mon Sep 17 00:00:00 2001
From: Sebastian Lackner <sebastian@fds-team.de>
Date: Mon, 10 Nov 2014 04:05:38 +0100
Subject: ntoskrnl.exe: Avoid invalid memory access when relocation block
addresses memory outside of the current page.
---
dlls/ntoskrnl.exe/ntoskrnl.c | 49 ++++++++++++++++++++++++++++++++++++++------
1 file changed, 43 insertions(+), 6 deletions(-)
diff --git a/dlls/ntoskrnl.exe/ntoskrnl.c b/dlls/ntoskrnl.exe/ntoskrnl.c
index 577f5b3..8649863 100644
--- a/dlls/ntoskrnl.exe/ntoskrnl.c
+++ b/dlls/ntoskrnl.exe/ntoskrnl.c
@@ -3208,6 +3208,39 @@ static LDR_MODULE *find_ldr_module( HMODULE module )
return ldr;
}
+/* change permissions of a specific memory range, save original permissions */
+static void virtual_protect_save( void *addr, SIZE_T size, ULONG new_prot, ULONG *old_prot )
+{
+ SYSTEM_BASIC_INFORMATION info;
+ UINT i = 0;
+
+ NtQuerySystemInformation( SystemBasicInformation, &info, sizeof(info), NULL );
+ while (size)
+ {
+ SIZE_T block_size = min( size, info.PageSize - ((UINT_PTR)addr & (info.PageSize - 1)) );
+ VirtualProtect( addr, block_size, new_prot, &old_prot[i++] );
+ addr = (void *)((char *)addr + block_size);
+ size -= block_size;
+ }
+}
+
+/* restore permissions for a specific memory range */
+static void virtual_protect_load( void *addr, SIZE_T size, ULONG *old_prot )
+{
+ SYSTEM_BASIC_INFORMATION info;
+ DWORD dummy;
+ UINT i = 0;
+
+ NtQuerySystemInformation( SystemBasicInformation, &info, sizeof(info), NULL );
+ while (size)
+ {
+ SIZE_T block_size = min( size, info.PageSize - ((UINT_PTR)addr & (info.PageSize - 1)) );
+ VirtualProtect( addr, block_size, old_prot[i++], &dummy );
+ addr = (void *)((char *)addr + block_size);
+ size -= block_size;
+ }
+}
+
/* load the driver module file */
static HMODULE load_driver_module( const WCHAR *name )
{
@@ -3231,7 +3264,7 @@ static HMODULE load_driver_module( const WCHAR *name )
if (nt->OptionalHeader.SectionAlignment < info.PageSize ||
!(nt->FileHeader.Characteristics & IMAGE_FILE_DLL))
{
- DWORD old;
+ DWORD old_prot[3];
IMAGE_BASE_RELOCATION *rel, *end;
if ((rel = RtlImageDirectoryEntryToData( module, TRUE, IMAGE_DIRECTORY_ENTRY_BASERELOC, &size )))
@@ -3239,20 +3272,24 @@ static HMODULE load_driver_module( const WCHAR *name )
WINE_TRACE( "%s: relocating from %p to %p\n",
wine_dbgstr_w(name), (char *)module - delta, module );
end = (IMAGE_BASE_RELOCATION *)((char *)rel + size);
- while (rel < end && rel->SizeOfBlock)
+ while (rel < end - 1 && rel->SizeOfBlock)
{
void *page = (char *)module + rel->VirtualAddress;
- VirtualProtect( page, info.PageSize, PAGE_EXECUTE_READWRITE, &old );
+ /* LdrProcessRelocationBlock can access the memory range from page - (page + 0xfff + 8), so
+ * changing permissions of a single page is not sufficient. We assume here that the minimum
+ * page size is 0x1000, so we have to save/restore two or three pages, depending on the
+ * virtual address. */
+ virtual_protect_save( page, 0xfff + 8, PAGE_EXECUTE_READWRITE, old_prot );
rel = LdrProcessRelocationBlock( page, (rel->SizeOfBlock - sizeof(*rel)) / sizeof(USHORT),
(USHORT *)(rel + 1), delta );
- if (old != PAGE_EXECUTE_READWRITE) VirtualProtect( page, info.PageSize, old, &old );
+ virtual_protect_load( page, 0xfff + 8, old_prot );
if (!rel) goto error;
}
/* make sure we don't try again */
size = FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + nt->FileHeader.SizeOfOptionalHeader;
- VirtualProtect( nt, size, PAGE_READWRITE, &old );
+ VirtualProtect( nt, size, PAGE_READWRITE, &old_prot[0] );
nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress = 0;
- VirtualProtect( nt, size, old, &old );
+ VirtualProtect( nt, size, old_prot[0], &old_prot[0] );
}
}
--
2.7.4

1
patches/ntoskrnl.exe-Fix_Relocation/definition Normal file
View File

@@ -0,0 +1 @@
Fixes: [28254] Fix crash of winedevice when relocation entry crosses page boundary