Release v5.17

This was first added in 78db8b7950 with the
message "Added patch to fix possible leak of explorer.exe processes and
implement proper desktop refcounting." The message of course suggests that
even then no application was known that actually depended on this.

In practice this seems wrong, also: once all non-system processes other than
explorer have terminated, the only way explorer.exe can remain alive is if a
system process holds a reference to explorer. The only relevant system
processes are services, and services cannot display a GUI [this is enforced
since Vista], so this should never be the case.

CONTRIBUTING.md

@@ -1,30 +0,0 @@
-Contributing to Wine Staging
-----------------------------
-
-First of all, thank you for taking the time to contribute to this project.
-
-### Reporting bugs
-
-Since WineConf 2015 Wine Staging is an official part of WineHQ, which means you
-can report problems directly at [bugs.winehq.org](https://bugs.winehq.org/).
-Most of the time bugs found in Wine Staging also turn out to be present in the
-development branch, so its recommended to open your bug in the "Wine" product,
-unless you are sure its really "Wine Staging" specific. For bugs related to our
-binary packages, please open a bug report in the "Packaging" product.
-
-### Submitting patches
-
-**IMPORTANT:** Please use [dev.wine-staging.com](https://dev.wine-staging.com/patches)
-for patch submissions, we currently do not accept Pull requests on GitHub.
-
-Wine Staging mainly concentrates on experimental features and patches which are
-difficult to get into the development branch. If you have a very simple bug fix
-including tests, there is usually no need to send it to Wine Staging. You can
-directly contribute it to the
-[development branch](http://wiki.winehq.org/SubmittingPatches). However, if you
-already tried that without success, or are working on such a complex area that
-you do not really think its ready for inclusion, you might want to submit it to
-our Staging tree. Please open a patch submission request on
-[dev.wine-staging.com](https://dev.wine-staging.com/patches) including the patch.
-More information is also available in our
-[Wiki](https://wiki.winehq.org/Wine-Staging_Patches).

LICENSE.md

@@ -8,7 +8,8 @@ are part of **Wine Staging** and are licensed under the terms of the
 
 ```
 Copyright (C) 2014-2017 the Wine Staging project authors.
-Copyright (C) 2018 Alistair Leslie-Hughes
+Copyright (C) 2018 Alistair Leslie-Hughes, Zebediah Figura
+Copyright (C) 2019-2020 Alistair Leslie-Hughes, Zebediah Figura, Paul Gofman
 
 Wine Staging is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public

README.md

@@ -6,15 +6,14 @@ features, which have not been integrated into the development branch yet. The
 idea of Wine Staging is to provide experimental features faster to end users and
 to give developers the possibility to discuss and improve their patches before
 they are integrated into the main branch. More information about Wine Staging
-can also be found on our website [wine-staging.com](http://wine-staging.com).
+can also be found [on the WineHQ wiki](https://wiki.winehq.org/Wine-Staging).
 
 Installation
 ------------
 
 Ready-to-use packages for Wine Staging are available for a variety of Linux
-distributions and for Mac OS X. Just follow the
-[installation instructions](https://wine-staging.com/installation.html)
-for your operating system.
+distributions and for Mac OS X. Just follow the [installation
+instructions](https://wiki.winehq.org/Download) for your operating system.
 
 On most distributions the `wine-staging` package is installed to
 `/opt/wine-staging`, such that multiple Wine versions can be installed in
@@ -78,5 +77,34 @@ in our [Wiki](https://wiki.winehq.org/Wine-Staging).
 Contributing
 ------------
 
-Please see CONTRIBUTING.md for more information about contributing to Wine
-Staging.
+For information on contributing to Wine-Staging, please see
+<https://wiki.winehq.org/Wine-Staging_Contributing>. Note that GitHub pull
+requests are strongly dispreferred, especially for patches.
+
+Donations
+---------
+
+wine-staging is a large set of experimental patches which provide various
+improvements to WINE, but are not quite suitable for upstreaming. This set of
+patches has been continuously managed for many years by a small group of
+volunteers. The way this works is that we often review patches attached to
+various bug reports found at https://bugs.winehq.org/ which may fix bugs, but
+may not be quite suitable to be upstreamed due to needing some cleanup or more
+proper implementation. In the event that this happens, we add the patches to
+wine-staging instead, and keep them updated and maintained as well as attempt to
+clean them up to be upstreamed. We also both write and verify patches which fix
+various bugs that may not have patches, and in turn allow them run better using
+WINE. This includes testing on various hardware, games, and applications.
+
+Any expenses for applications, games, or hardware which we do not own comes out
+of pocket. In order to alleviate these expenses, we are now accepting donations.
+This in turn allows us to continue to perform testing, provide fixes, and get
+them upstreamed, ultimately aiming to provide a better experience for all WINE
+users. All of our work is provided publicly for free and can be found at
+<https://github.com/wine-staging/wine-staging>. We do not expect to be paid for
+any of the work provided, nor will donators receive any special benefits or
+compensation.
+
+Donations are recieved through Patreon. Anyone interested may donate here:
+
+https://www.patreon.com/winestaging

patches/Compiler_Warnings/0031-include-Check-element-type-in-CONTAINING_RECORD-and-.patch

@@ -1,4 +1,4 @@
-From 494fc3abe1eddabcf7cede677ee907284e89eea8 Mon Sep 17 00:00:00 2001
+From a349cc8bdcc3a083ea507dbbdeba9053e3a338e4 Mon Sep 17 00:00:00 2001
 From: Sebastian Lackner <sebastian@fds-team.de>
 Date: Tue, 22 Mar 2016 23:08:30 +0100
 Subject: [PATCH] include: Check element type in CONTAINING_RECORD and similar
@@ -11,7 +11,7 @@ Subject: [PATCH] include: Check element type in CONTAINING_RECORD and similar
  3 files changed, 24 insertions(+), 6 deletions(-)
 
 diff --git a/include/wine/list.h b/include/wine/list.h
-index b4d681fe..287ad394 100644
+index b4d681fe0f3..287ad394fae 100644
 --- a/include/wine/list.h
 +++ b/include/wine/list.h
 @@ -228,7 +228,13 @@ static inline void list_move_head( struct list *dst, struct list *src )
@@ -31,7 +31,7 @@ index b4d681fe..287ad394 100644
  
  #endif  /* __WINE_SERVER_LIST_H */
 diff --git a/include/wine/rbtree.h b/include/wine/rbtree.h
-index dc50b5e7..8130deb5 100644
+index 8aae29c8c10..330b3e8fbc9 100644
 --- a/include/wine/rbtree.h
 +++ b/include/wine/rbtree.h
 @@ -23,8 +23,14 @@
@@ -52,10 +52,10 @@ index dc50b5e7..8130deb5 100644
  struct wine_rb_entry
  {
 diff --git a/include/winnt.h b/include/winnt.h
-index 2b489382..a156efc4 100644
+index 46e17c546a7..d5c65d2017b 100644
 --- a/include/winnt.h
 +++ b/include/winnt.h
-@@ -760,8 +760,14 @@ typedef struct _MEMORY_BASIC_INFORMATION
+@@ -793,8 +793,14 @@ typedef struct _MEMORY_BASIC_INFORMATION
  #define RTL_FIELD_SIZE(type, field) (sizeof(((type *)0)->field))
  #define RTL_SIZEOF_THROUGH_FIELD(type, field) (FIELD_OFFSET(type, field) + RTL_FIELD_SIZE(type, field))
  
@@ -70,8 +70,8 @@ index 2b489382..a156efc4 100644
 +   ((type *)((PCHAR)(address) - offsetof(type, field)))
 +#endif
  
+ #define ARRAYSIZE(x) (sizeof(x) / sizeof((x)[0]))
  #ifdef __WINESRC__
- # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
 -- 
-2.20.1
+2.26.2
 

patches/Staging/0001-kernel32-Add-winediag-message-to-show-warning-that-t.patch

@@ -1,41 +1,60 @@
-From 9e585de1f2f28e1ef18c1edca875779c491375cb Mon Sep 17 00:00:00 2001
+From 700513f28e4844cbfc40b3ebf1b77cf121b71e71 Mon Sep 17 00:00:00 2001
 From: Sebastian Lackner <sebastian@fds-team.de>
 Date: Thu, 2 Oct 2014 19:44:31 +0200
-Subject: [PATCH] kernel32: Add winediag message to show warning, that this
- isn't vanilla wine.
+Subject: [PATCH] ntdll: Print a warning message specifying the wine-staging
+ branch name and version.
 
 ---
- dlls/kernel32/process.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
+ dlls/ntdll/loader.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
 
-diff --git a/dlls/kernel32/process.c b/dlls/kernel32/process.c
-index 36ed82bff8c..b8a677c5485 100644
---- a/dlls/kernel32/process.c
-+++ b/dlls/kernel32/process.c
-@@ -65,6 +65,7 @@
- 
- WINE_DEFAULT_DEBUG_CHANNEL(process);
- WINE_DECLARE_DEBUG_CHANNEL(relay);
+diff --git a/dlls/ntdll/loader.c b/dlls/ntdll/loader.c
+index 587c87bbfc0..05b40326d82 100644
+--- a/dlls/ntdll/loader.c
++++ b/dlls/ntdll/loader.c
+@@ -44,6 +44,7 @@ WINE_DECLARE_DEBUG_CHANNEL(relay);
+ WINE_DECLARE_DEBUG_CHANNEL(snoop);
+ WINE_DECLARE_DEBUG_CHANNEL(loaddll);
+ WINE_DECLARE_DEBUG_CHANNEL(imports);
 +WINE_DECLARE_DEBUG_CHANNEL(winediag);
  
- typedef struct
+ #ifdef _WIN64
+ #define DEFAULT_SECURITY_COOKIE_64  (((ULONGLONG)0x00002b99 << 32) | 0x2ddfa232)
+@@ -3487,6 +3488,7 @@ static void process_breakpoint(void)
+     __ENDTRY
+ }
+ 
++extern const char * CDECL wine_get_version(void);
+ 
+ /******************************************************************
+  *		LdrInitializeThunk (NTDLL.@)
+@@ -3497,6 +3499,9 @@ static void process_breakpoint(void)
+ void WINAPI LdrInitializeThunk( CONTEXT *context, ULONG_PTR unknown2, ULONG_PTR unknown3, ULONG_PTR unknown4 )
  {
-@@ -997,6 +998,15 @@ void WINAPI start_process( LPTHREAD_START_ROUTINE entry, PEB *peb )
+     static const unsigned int fls_slot_count = 8 * sizeof(NtCurrentTeb()->Peb->FlsBitmapBits);
++    OBJECT_ATTRIBUTES staging_event_attr;
++    UNICODE_STRING staging_event_string;
++    HANDLE staging_event;
+     static int attach_done;
+     int i;
+     NTSTATUS status;
+@@ -3515,6 +3520,16 @@ void WINAPI LdrInitializeThunk( CONTEXT *context, ULONG_PTR unknown2, ULONG_PTR
+     entry = (void **)&context->u.s.X0;
+ #endif
  
-     __TRY
-     {
-+        if (CreateEventA(0, 0, 0, "__winestaging_warn_event") && GetLastError() != ERROR_ALREADY_EXISTS)
-+        {
-+            FIXME_(winediag)("Wine Staging %s is a testing version containing experimental patches.\n", wine_get_version());
-+            FIXME_(winediag)("Please mention your exact version when filing bug reports on winehq.org.\n");
-+        }
-+        else
-+            WARN_(winediag)("Wine Staging %s is a testing version containing experimental patches.\n", wine_get_version());
++    RtlInitUnicodeString( &staging_event_string, L"\\__wine_staging_warn_event" );
++    InitializeObjectAttributes( &staging_event_attr, &staging_event_string, OBJ_OPENIF, NULL, NULL );
++    if (NtCreateEvent( &staging_event, EVENT_ALL_ACCESS, &staging_event_attr, NotificationEvent, FALSE ) == STATUS_SUCCESS)
++    {
++        FIXME_(winediag)("wine-staging %s is a testing version containing experimental patches.\n", wine_get_version());
++        FIXME_(winediag)("Please mention your exact version when filing bug reports on winehq.org.\n");
++    }
++    else
++        WARN_(winediag)("wine-staging %s is a testing version containing experimental patches.\n", wine_get_version());
 +
-+
-         if (!CheckRemoteDebuggerPresent( GetCurrentProcess(), &being_debugged ))
-             being_debugged = FALSE;
+     if (process_detaching) NtTerminateThread( GetCurrentThread(), 0 );
  
+     RtlEnterCriticalSection( &loader_section );
 -- 
-2.23.0
+2.28.0
 

patches/Staging/0002-winelib-Append-Staging-at-the-end-of-the-version-s.patch

@@ -1,25 +1,25 @@
-From 05ca39b029f8f710ca53aeafc36384fd39fd6b89 Mon Sep 17 00:00:00 2001
+From b1bbc311c1e2dec72e04be9c668b6072d11b04fb Mon Sep 17 00:00:00 2001
 From: Sebastian Lackner <sebastian@fds-team.de>
 Date: Thu, 2 Oct 2014 19:53:46 +0200
 Subject: [PATCH] winelib: Append '(Staging)' at the end of the version string.
 
 ---
- libs/wine/Makefile.in | 2 +-
+ dlls/ntdll/Makefile.in | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/libs/wine/Makefile.in b/libs/wine/Makefile.in
-index 4833eb5..3cfa4f4 100644
---- a/libs/wine/Makefile.in
-+++ b/libs/wine/Makefile.in
-@@ -31,7 +31,7 @@ libwine_LDFLAGS = $(LIBWINE_LDFLAGS)
- libwine_DEPS = $(LIBWINE_DEPENDS)
+diff --git a/dlls/ntdll/Makefile.in b/dlls/ntdll/Makefile.in
+index a553536d4c7..71e3df13b66 100644
+--- a/dlls/ntdll/Makefile.in
++++ b/dlls/ntdll/Makefile.in
+@@ -81,7 +81,7 @@ unix_loader_EXTRADEFS = \
+ 	-DBIN_TO_DATADIR=\"`${MAKEDEP} -R ${bindir} ${datadir}/wine`\"
  
- version.c: dummy
+ unix/version.c: dummy
 -	version=`(GIT_DIR=$(top_srcdir)/.git git describe HEAD 2>/dev/null || echo "wine-$(PACKAGE_VERSION)") | sed -n -e '$$s/\(.*\)/const char wine_build[] = "\1";/p'` && (echo $$version | cmp -s - $@) || echo $$version >$@ || (rm -f $@ && exit 1)
-+	version=`(GIT_DIR=$(top_srcdir)/.git git describe HEAD 2>/dev/null || echo "wine-$(PACKAGE_VERSION)") | sed -n -e '$$s/\(.*\)/const char wine_build[] = "\1  (Staging)";/p'` && (echo $$version | cmp -s - $@) || echo $$version >$@ || (rm -f $@ && exit 1)
++	version=`(GIT_DIR=$(top_srcdir)/.git git describe HEAD 2>/dev/null || echo "wine-$(PACKAGE_VERSION)") | sed -n -e '$$s/\(.*\)/const char wine_build[] = "\1 (Staging)";/p'` && (echo $$version | cmp -s - $@) || echo $$version >$@ || (rm -f $@ && exit 1)
  
  dummy:
  .PHONY: dummy
 -- 
-1.9.1
+2.28.0
 

patches/Staging/0003-loader-Add-commandline-option-patches-to-show-the-pa.patch

@@ -1,150 +0,0 @@
-From fa73044dd60bae90b9a5ec850205a07579d4db17 Mon Sep 17 00:00:00 2001
-From: Sebastian Lackner <sebastian@fds-team.de>
-Date: Thu, 29 May 2014 23:43:45 +0200
-Subject: [PATCH] loader: Add commandline option --patches to show the patch
- list.
-
----
- dlls/ntdll/misc.c      |  8 ++++++++
- dlls/ntdll/ntdll.spec  |  1 +
- include/wine/library.h |  1 +
- libs/wine/config.c     |  6 ++++++
- libs/wine/wine.map     |  1 +
- loader/main.c          | 42 +++++++++++++++++++++++++++++++++++++++++-
- 6 files changed, 58 insertions(+), 1 deletion(-)
-
-diff --git a/dlls/ntdll/misc.c b/dlls/ntdll/misc.c
-index bb75d9c..21e2db6 100644
---- a/dlls/ntdll/misc.c
-+++ b/dlls/ntdll/misc.c
-@@ -61,6 +61,14 @@ const char * CDECL NTDLL_wine_get_version(void)
- }
- 
- /*********************************************************************
-+ *                  wine_get_patches   (NTDLL.@)
-+ */
-+const void * CDECL NTDLL_wine_get_patches(void)
-+{
-+    return wine_get_patches();
-+}
-+
-+/*********************************************************************
-  *                  wine_get_build_id   (NTDLL.@)
-  */
- const char * CDECL NTDLL_wine_get_build_id(void)
-diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
-index 292b0f6..fb45a94 100644
---- a/dlls/ntdll/ntdll.spec
-+++ b/dlls/ntdll/ntdll.spec
-@@ -1516,6 +1516,7 @@
- 
- # Version
- @ cdecl wine_get_version() NTDLL_wine_get_version
-+@ cdecl wine_get_patches() NTDLL_wine_get_patches
- @ cdecl wine_get_build_id() NTDLL_wine_get_build_id
- @ cdecl wine_get_host_version(ptr ptr) NTDLL_wine_get_host_version
- 
-diff --git a/include/wine/library.h b/include/wine/library.h
-index 242bb69..fae73fe 100644
---- a/include/wine/library.h
-+++ b/include/wine/library.h
-@@ -43,6 +43,7 @@ extern const char *wine_get_data_dir(void);
- extern const char *wine_get_server_dir(void);
- extern const char *wine_get_user_name(void);
- extern const char *wine_get_version(void);
-+extern const void *wine_get_patches(void);
- extern const char *wine_get_build_id(void);
- extern void wine_init_argv0_path( const char *argv0 );
- extern void wine_exec_wine_binary( const char *name, char **argv, const char *env_var );
-diff --git a/libs/wine/config.c b/libs/wine/config.c
-index 3c9110b..5da6263 100644
---- a/libs/wine/config.c
-+++ b/libs/wine/config.c
-@@ -522,6 +522,12 @@ const char *wine_get_version(void)
-     return PACKAGE_VERSION;
- }
- 
-+/* return the applied non-standard patches */
-+const void *wine_get_patches(void)
-+{
-+    return NULL;
-+}
-+
- /* return the build id string */
- const char *wine_get_build_id(void)
- {
-diff --git a/libs/wine/wine.map b/libs/wine/wine.map
-index 2159fac..7cb2918 100644
---- a/libs/wine/wine.map
-+++ b/libs/wine/wine.map
-@@ -90,6 +90,7 @@ WINE_1.0
-     wine_get_ss;
-     wine_get_user_name;
-     wine_get_version;
-+    wine_get_patches;
-     wine_init;
-     wine_init_argv0_path;
-     wine_is_dbcs_leadbyte;
-diff --git a/loader/main.c b/loader/main.c
-index f197cf8..f662912 100644
---- a/loader/main.c
-+++ b/loader/main.c
-@@ -54,7 +54,8 @@ static void check_command_line( int argc, char *argv[] )
-     static const char usage[] =
-         "Usage: wine PROGRAM [ARGUMENTS...]   Run the specified program\n"
-         "       wine --help                   Display this help and exit\n"
--        "       wine --version                Output version information and exit";
-+        "       wine --version                Output version information and exit\n"
-+        "       wine --patches                Output patch information and exit";
- 
-     if (argc <= 1)
-     {
-@@ -71,6 +72,45 @@ static void check_command_line( int argc, char *argv[] )
-         printf( "%s\n", wine_get_build_id() );
-         exit(0);
-     }
-+    if (!strcmp( argv[1], "--patches" ))
-+    {
-+        const struct
-+        {
-+            const char *author;
-+            const char *subject;
-+            int revision;
-+        }
-+        *next, *cur = wine_get_patches();
-+
-+        if (!cur)
-+        {
-+            fprintf( stderr, "Patchlist not available.\n" );
-+            exit(1);
-+        }
-+
-+        while (cur->author)
-+        {
-+            next = cur + 1;
-+            while (next->author)
-+            {
-+                if (strcmp( cur->author, next->author )) break;
-+                next++;
-+            }
-+
-+            printf( "%s (%d):\n", cur->author, (int)(next - cur) );
-+            while (cur < next)
-+            {
-+                printf( "      %s", cur->subject );
-+                if (cur->revision != 1)
-+                    printf( " [rev %d]", cur->revision );
-+                printf( "\n" );
-+                cur++;
-+            }
-+            printf( "\n" );
-+        }
-+
-+        exit(0);
-+    }
- }
- 
- 
--- 
-1.9.1
-

patches/Staging/0004-loader-Add-commandline-option-check-libs.patch

@@ -1,313 +0,0 @@
-From 9618572cf2eace39198fb83b747a70d1865015e3 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
-Date: Wed, 28 May 2014 19:50:51 +0200
-Subject: [PATCH] loader: Add commandline option --check-libs.
-
----
- include/wine/library.h |   2 +
- libs/wine/config.c     | 124 +++++++++++++++++++++++++++++++++++++++++++++++++
- libs/wine/loader.c     |  36 ++++++++++++++
- libs/wine/wine.map     |   2 +
- loader/main.c          |  50 +++++++++++++++++++-
- 5 files changed, 213 insertions(+), 1 deletion(-)
-
-diff --git a/include/wine/library.h b/include/wine/library.h
-index fae73fe..7395a11 100644
---- a/include/wine/library.h
-+++ b/include/wine/library.h
-@@ -40,6 +40,7 @@ extern "C" {
- extern const char *wine_get_build_dir(void);
- extern const char *wine_get_config_dir(void);
- extern const char *wine_get_data_dir(void);
-+extern const char **wine_get_libs(void);
- extern const char *wine_get_server_dir(void);
- extern const char *wine_get_user_name(void);
- extern const char *wine_get_version(void);
-@@ -52,6 +53,7 @@ extern void wine_exec_wine_binary( const char *name, char **argv, const char *en
- 
- typedef void (*load_dll_callback_t)( void *, const char * );
- 
-+extern int wine_dladdr( void *addr, void *info, char *error, size_t errorsize );
- extern void *wine_dlopen( const char *filename, int flag, char *error, size_t errorsize );
- extern void *wine_dlsym( void *handle, const char *symbol, char *error, size_t errorsize );
- extern int wine_dlclose( void *handle, char *error, size_t errorsize );
-diff --git a/libs/wine/config.c b/libs/wine/config.c
-index 5da6263..6cedfb7 100644
---- a/libs/wine/config.c
-+++ b/libs/wine/config.c
-@@ -488,6 +488,130 @@ const char *wine_get_build_dir(void)
-     return build_dir;
- }
- 
-+const char *wine_libs[] = {
-+#ifdef SONAME_LIBCAIRO
-+    SONAME_LIBCAIRO,
-+#endif
-+#ifdef SONAME_LIBCAPI20
-+    SONAME_LIBCAPI20,
-+#endif
-+#ifdef SONAME_LIBCUPS
-+    SONAME_LIBCUPS,
-+#endif
-+#ifdef SONAME_LIBCURSES
-+    SONAME_LIBCURSES,
-+#endif
-+#ifdef SONAME_LIBDBUS_1
-+    SONAME_LIBDBUS_1,
-+#endif
-+#ifdef SONAME_LIBFONTCONFIG
-+    SONAME_LIBFONTCONFIG,
-+#endif
-+#ifdef SONAME_LIBFREETYPE
-+    SONAME_LIBFREETYPE,
-+#endif
-+#ifdef SONAME_LIBGL
-+    SONAME_LIBGL,
-+#endif
-+#ifdef SONAME_LIBGNUTLS
-+    SONAME_LIBGNUTLS,
-+#endif
-+#ifdef SONAME_LIBGOBJECT_2_0
-+    SONAME_LIBGOBJECT_2_0,
-+#endif
-+#ifdef SONAME_LIBGSM
-+    SONAME_LIBGSM,
-+#endif
-+#ifdef SONAME_LIBGTK_3
-+    SONAME_LIBGTK_3,
-+#endif
-+#ifdef SONAME_LIBHAL
-+    SONAME_LIBHAL,
-+#endif
-+#ifdef SONAME_LIBJPEG
-+    SONAME_LIBJPEG,
-+#endif
-+#ifdef SONAME_LIBNCURSES
-+    SONAME_LIBNCURSES,
-+#endif
-+#ifdef SONAME_LIBNETAPI
-+    SONAME_LIBNETAPI,
-+#endif
-+#ifdef SONAME_LIBODBC
-+    SONAME_LIBODBC,
-+#endif
-+#ifdef SONAME_LIBOSMESA
-+    SONAME_LIBOSMESA,
-+#endif
-+#ifdef SONAME_LIBPCAP
-+    SONAME_LIBPCAP,
-+#endif
-+#ifdef SONAME_LIBPNG
-+    SONAME_LIBPNG,
-+#endif
-+#ifdef SONAME_LIBSANE
-+    SONAME_LIBSANE,
-+#endif
-+#ifdef SONAME_LIBTIFF
-+    SONAME_LIBTIFF,
-+#endif
-+#ifdef SONAME_LIBTXC_DXTN
-+    SONAME_LIBTXC_DXTN,
-+#endif
-+#ifdef SONAME_LIBV4L1
-+    SONAME_LIBV4L1,
-+#endif
-+#ifdef SONAME_LIBVA
-+    SONAME_LIBVA,
-+#endif
-+#ifdef SONAME_LIBVA_DRM
-+    SONAME_LIBVA_DRM,
-+#endif
-+#ifdef SONAME_LIBVA_X11
-+    SONAME_LIBVA_X11,
-+#endif
-+#ifdef SONAME_LIBX11
-+    SONAME_LIBX11,
-+#endif
-+#ifdef SONAME_LIBX11_XCB
-+    SONAME_LIBX11_XCB,
-+#endif
-+#ifdef SONAME_LIBXCOMPOSITE
-+    SONAME_LIBXCOMPOSITE,
-+#endif
-+#ifdef SONAME_LIBXCURSOR
-+    SONAME_LIBXCURSOR,
-+#endif
-+#ifdef SONAME_LIBXEXT
-+    SONAME_LIBXEXT,
-+#endif
-+#ifdef SONAME_LIBXI
-+    SONAME_LIBXI,
-+#endif
-+#ifdef SONAME_LIBXINERAMA
-+    SONAME_LIBXINERAMA,
-+#endif
-+#ifdef SONAME_LIBXRANDR
-+    SONAME_LIBXRANDR,
-+#endif
-+#ifdef SONAME_LIBXRENDER
-+    SONAME_LIBXRENDER,
-+#endif
-+#ifdef SONAME_LIBXSLT
-+    SONAME_LIBXSLT,
-+#endif
-+#ifdef SONAME_LIBXXF86VM
-+    SONAME_LIBXXF86VM,
-+#endif
-+    NULL
-+};
-+
-+/* return the list of shared libs used by wine */
-+const char **wine_get_libs(void)
-+{
-+    return &wine_libs[0];
-+}
-+
- /* return the full name of the server directory (the one containing the socket) */
- const char *wine_get_server_dir(void)
- {
-diff --git a/libs/wine/loader.c b/libs/wine/loader.c
-index 649aa22..367dde3 100644
---- a/libs/wine/loader.c
-+++ b/libs/wine/loader.c
-@@ -1064,6 +1064,42 @@ void *wine_dlopen( const char *filename, int flag, char *error, size_t errorsize
- }
- 
- /***********************************************************************
-+ *      wine_dladdr
-+ */
-+int wine_dladdr( void *addr, void *info, char *error, size_t errorsize )
-+{
-+#ifdef HAVE_DLADDR
-+    int ret;
-+    const char *s;
-+    dlerror(); dlerror();
-+    ret = dladdr( addr, (Dl_info *)info );
-+    s = dlerror();
-+    if (error && errorsize)
-+    {
-+        if (s)
-+        {
-+            size_t len = strlen(s);
-+            if (len >= errorsize) len = errorsize - 1;
-+            memcpy( error, s, len );
-+            error[len] = 0;
-+        }
-+        else error[0] = 0;
-+    }
-+    dlerror();
-+    return ret;
-+#else
-+    if (error)
-+    {
-+        static const char msg[] = "dladdr interface not detected by configure";
-+        size_t len = min( errorsize, sizeof(msg) );
-+        memcpy( error, msg, len );
-+        error[len - 1] = 0;
-+    }
-+    return 0;
-+#endif
-+}
-+
-+/***********************************************************************
-  *		wine_dlsym
-  */
- void *wine_dlsym( void *handle, const char *symbol, char *error, size_t errorsize )
-diff --git a/libs/wine/wine.map b/libs/wine/wine.map
-index 7cb2918..72ffed8 100644
---- a/libs/wine/wine.map
-+++ b/libs/wine/wine.map
-@@ -65,6 +65,7 @@ WINE_1.0
-     wine_dbg_sprintf;
-     wine_dbgstr_an;
-     wine_dbgstr_wn;
-+    wine_dladdr;
-     wine_dlclose;
-     wine_dll_enum_load_path;
-     wine_dll_get_owner;
-@@ -85,6 +86,7 @@ WINE_1.0
-     wine_get_es;
-     wine_get_fs;
-     wine_get_gs;
-+    wine_get_libs;
-     wine_get_server_dir;
-     wine_get_sortkey;
-     wine_get_ss;
-diff --git a/loader/main.c b/loader/main.c
-index f662912..a2dc40c 100644
---- a/loader/main.c
-+++ b/loader/main.c
-@@ -36,6 +36,12 @@
- #ifdef HAVE_UNISTD_H
- # include <unistd.h>
- #endif
-+#ifdef HAVE_DLADDR
-+# include <dlfcn.h>
-+#endif
-+#ifdef HAVE_LINK_H
-+# include <link.h>
-+#endif
- #include <pthread.h>
- 
- #include "wine/library.h"
-@@ -55,7 +61,8 @@ static void check_command_line( int argc, char *argv[] )
-         "Usage: wine PROGRAM [ARGUMENTS...]   Run the specified program\n"
-         "       wine --help                   Display this help and exit\n"
-         "       wine --version                Output version information and exit\n"
--        "       wine --patches                Output patch information and exit";
-+        "       wine --patches                Output patch information and exit\n"
-+        "       wine --check-libs             Checks if shared libs are installed";
- 
-     if (argc <= 1)
-     {
-@@ -111,6 +118,47 @@ static void check_command_line( int argc, char *argv[] )
- 
-         exit(0);
-     }
-+    if (!strcmp( argv[1], "--check-libs" ))
-+    {
-+        void* lib_handle;
-+        int ret = 0;
-+        const char **wine_libs = wine_get_libs();
-+
-+        for(; *wine_libs; wine_libs++)
-+        {
-+            lib_handle = wine_dlopen( *wine_libs, RTLD_NOW, NULL, 0 );
-+            if (lib_handle)
-+            {
-+            #ifdef HAVE_DLADDR
-+                Dl_info libinfo;
-+                void* symbol;
-+
-+            #ifdef HAVE_LINK_H
-+                struct link_map *lm = (struct link_map *)lib_handle;
-+                symbol = (void *)lm->l_addr;
-+            #else
-+                symbol = wine_dlsym( lib_handle, "_init", NULL, 0 );
-+            #endif
-+                if (symbol && wine_dladdr( symbol, &libinfo, NULL, 0 ))
-+                {
-+                    printf( "%s: %s\n", *wine_libs, libinfo.dli_fname );
-+                }
-+                else
-+            #endif
-+                {
-+                    printf( "%s: found\n", *wine_libs );
-+                }
-+                wine_dlclose( lib_handle, NULL, 0 );
-+            }
-+            else
-+            {
-+                printf( "%s: missing\n", *wine_libs );
-+                ret = 1;
-+            }
-+        }
-+
-+        exit(ret);
-+    }
- }
- 
- 
--- 
-1.9.1
-

patches/Staging/0005-loader-Print-library-paths-for-check-libs-on-Mac-OS-.patch

@@ -1,60 +0,0 @@
-From 07ca5e888c3265c57c88ef1758e6c47fbea4fb07 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
-Date: Sat, 27 Jun 2015 19:28:51 +0200
-Subject: loader: Print library paths for --check-libs on Mac OS X.
-
----
- loader/main.c | 30 +++++++++++++++++++++++++++++-
- 1 file changed, 29 insertions(+), 1 deletion(-)
-
-diff --git a/loader/main.c b/loader/main.c
-index a2dc40c51c..1642fb0965 100644
---- a/loader/main.c
-+++ b/loader/main.c
-@@ -50,6 +50,30 @@
- /* the preloader will set this variable */
- const struct wine_preload_info *wine_main_preload_info = NULL;
- 
-+#ifdef __APPLE__
-+#include <mach-o/dyld.h>
-+
-+static const char *get_macho_library_path( const char *libname )
-+{
-+    unsigned int path_len, libname_len = strlen( libname );
-+    uint32_t i, count = _dyld_image_count();
-+
-+    for (i = 0; i < count; i++)
-+    {
-+       const char *path = _dyld_get_image_name( i );
-+        if (!path) continue;
-+
-+        path_len = strlen( path );
-+        if (path_len < libname_len + 1) continue;
-+        if (path[path_len - libname_len - 1] != '/') continue;
-+        if (strcmp( path + path_len - libname_len, libname )) continue;
-+
-+        return path;
-+    }
-+    return NULL;
-+}
-+#endif
-+
- /***********************************************************************
-  *           check_command_line
-  *
-@@ -146,7 +170,11 @@ static void check_command_line( int argc, char *argv[] )
-                 else
-             #endif
-                 {
--                    printf( "%s: found\n", *wine_libs );
-+                    const char *path = NULL;
-+                #ifdef __APPLE__
-+                    path = get_macho_library_path( *wine_libs );
-+                #endif
-+                    printf( "%s: %s\n", *wine_libs, path ? path : "found");
-                 }
-                 wine_dlclose( lib_handle, NULL, 0 );
-             }
--- 
-2.14.1
-

patches/Staging/definition

@@ -0,0 +1 @@
+Depends: ntdll-FLS_Callbacks

patches/advapi32-CreateRestrictedToken/0001-ntdll-Implement-NtFilterToken.patch

@@ -1,29 +1,43 @@
-From 1eb8acd819f9eee8fdf154d0ef43881008265916 Mon Sep 17 00:00:00 2001
+From 1b222275e7faf71ae1e5c94e297004055ec6f82f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Fri, 4 Aug 2017 02:33:14 +0200
-Subject: ntdll: Implement NtFilterToken.
+Subject: [PATCH] ntdll: Implement NtFilterToken.
 
 ---
- dlls/ntdll/nt.c       | 59 ++++++++++++++++++++++++++++++++++++
- dlls/ntdll/ntdll.spec |  2 +-
- include/winnt.h       |  5 +++
- include/winternl.h    |  1 +
- server/process.c      |  2 +-
- server/protocol.def   | 10 ++++++
- server/security.h     |  4 ++-
- server/token.c        | 84 +++++++++++++++++++++++++++++++++++++++++++++++++--
- 8 files changed, 162 insertions(+), 5 deletions(-)
+ dlls/ntdll/ntdll.spec      |  2 +-
+ dlls/ntdll/unix/security.c | 64 +++++++++++++++++++++++++++++
+ include/winnt.h            |  5 +++
+ include/winternl.h         |  1 +
+ server/named_pipe.c        |  2 +-
+ server/process.c           |  2 +-
+ server/protocol.def        | 10 +++++
+ server/security.h          |  4 +-
+ server/token.c             | 84 +++++++++++++++++++++++++++++++++++++-
+ 9 files changed, 168 insertions(+), 6 deletions(-)
 
-diff --git a/dlls/ntdll/nt.c b/dlls/ntdll/nt.c
-index c3f5df3..59a08de 100644
---- a/dlls/ntdll/nt.c
-+++ b/dlls/ntdll/nt.c
-@@ -119,6 +119,65 @@ NTSTATUS WINAPI NtDuplicateToken(
+diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
+index a3bc57716da..f604c8a3c35 100644
+--- a/dlls/ntdll/ntdll.spec
++++ b/dlls/ntdll/ntdll.spec
+@@ -208,7 +208,7 @@
+ # @ stub NtEnumerateSystemEnvironmentValuesEx
+ @ stdcall -syscall NtEnumerateValueKey(long long long ptr long ptr)
+ @ stub NtExtendSection
+-# @ stub NtFilterToken
++@ stdcall -syscall NtFilterToken(long long ptr ptr ptr ptr)
+ @ stdcall -syscall NtFindAtom(ptr long ptr)
+ @ stdcall -syscall NtFlushBuffersFile(long ptr)
+ @ stdcall -syscall NtFlushInstructionCache(long ptr long)
+diff --git a/dlls/ntdll/unix/security.c b/dlls/ntdll/unix/security.c
+index daecc5e0591..d063d43d6d4 100644
+--- a/dlls/ntdll/unix/security.c
++++ b/dlls/ntdll/unix/security.c
+@@ -604,6 +604,70 @@ NTSTATUS WINAPI NtAdjustPrivilegesToken( HANDLE token, BOOLEAN disable, TOKEN_PR
  }
  
- /******************************************************************************
-+ *  NtFilterToken        [NTDLL.@]
-+ *  ZwFilterToken        [NTDLL.@]
+ 
++/***********************************************************************
++ *             NtFilterToken  (NTDLL.@)
 + */
 +NTSTATUS WINAPI NtFilterToken( HANDLE token, ULONG flags, TOKEN_GROUPS *disable_sids,
 +                               TOKEN_PRIVILEGES *privileges, TOKEN_GROUPS *restrict_sids,
@@ -52,14 +66,18 @@ index c3f5df3..59a08de 100644
 +        BYTE *tmp;
 +
 +        for (i = 0; i < disable_sids->GroupCount; i++)
-+            sids_len += RtlLengthSid( disable_sids->Groups[i].Sid );
++        {
++            SID *sid = disable_sids->Groups[i].Sid;
++            sids_len += offsetof( SID, SubAuthority[sid->SubAuthorityCount] );
++        }
 +
-+        sids = RtlAllocateHeap( GetProcessHeap(), 0, sids_len );
++        sids = malloc( sids_len );
 +        if (!sids) return STATUS_NO_MEMORY;
 +
 +        for (i = 0, tmp = (BYTE *)sids; i < disable_sids->GroupCount; i++, tmp += len)
 +        {
-+            len = RtlLengthSid( disable_sids->Groups[i].Sid );
++            SID *sid = disable_sids->Groups[i].Sid;
++            len = offsetof( SID, SubAuthority[sid->SubAuthorityCount] );
 +            memcpy( tmp, disable_sids->Groups[i].Sid, len );
 +        }
 +    }
@@ -76,32 +94,20 @@ index c3f5df3..59a08de 100644
 +    }
 +    SERVER_END_REQ;
 +
-+    RtlFreeHeap( GetProcessHeap(), 0, sids );
++    free( sids );
 +    return status;
 +}
 +
-+/******************************************************************************
-  *  NtOpenProcessToken		[NTDLL.@]
-  *  ZwOpenProcessToken		[NTDLL.@]
++
++
+ /***********************************************************************
+  *             NtPrivilegeCheck  (NTDLL.@)
   */
-diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
-index c260b0d..3c5e69c 100644
---- a/dlls/ntdll/ntdll.spec
-+++ b/dlls/ntdll/ntdll.spec
-@@ -176,7 +176,7 @@
- # @ stub NtEnumerateSystemEnvironmentValuesEx
- @ stdcall NtEnumerateValueKey(long long long ptr long ptr)
- @ stub NtExtendSection
--# @ stub NtFilterToken
-+@ stdcall NtFilterToken(long long ptr ptr ptr ptr)
- @ stdcall NtFindAtom(ptr long ptr)
- @ stdcall NtFlushBuffersFile(long ptr)
- @ stdcall NtFlushInstructionCache(long ptr long)
 diff --git a/include/winnt.h b/include/winnt.h
-index 16d96d8..4e238f9 100644
+index e1cf78420a6..da17fe3e330 100644
 --- a/include/winnt.h
 +++ b/include/winnt.h
-@@ -3904,6 +3904,11 @@ typedef enum _TOKEN_INFORMATION_CLASS {
+@@ -4221,6 +4221,11 @@ typedef enum _TOKEN_INFORMATION_CLASS {
  					TOKEN_ADJUST_SESSIONID | \
  					TOKEN_ADJUST_DEFAULT )
  
@@ -114,10 +120,10 @@ index 16d96d8..4e238f9 100644
  #define _SECURITY_DEFINED
  
 diff --git a/include/winternl.h b/include/winternl.h
-index c84e6d7..288f93e 100644
+index b3fbb90feff..4687a410ca4 100644
 --- a/include/winternl.h
 +++ b/include/winternl.h
-@@ -2303,6 +2303,7 @@ NTSYSAPI NTSTATUS  WINAPI NtDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES
+@@ -2749,6 +2749,7 @@ NTSYSAPI NTSTATUS  WINAPI NtDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES
  NTSYSAPI NTSTATUS  WINAPI NtEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
  NTSYSAPI NTSTATUS  WINAPI NtEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
  NTSYSAPI NTSTATUS  WINAPI NtExtendSection(HANDLE,PLARGE_INTEGER);
@@ -125,11 +131,24 @@ index c84e6d7..288f93e 100644
  NTSYSAPI NTSTATUS  WINAPI NtFindAtom(const WCHAR*,ULONG,RTL_ATOM*);
  NTSYSAPI NTSTATUS  WINAPI NtFlushBuffersFile(HANDLE,IO_STATUS_BLOCK*);
  NTSYSAPI NTSTATUS  WINAPI NtFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
+diff --git a/server/named_pipe.c b/server/named_pipe.c
+index b259abb8de4..4cd4d7dc4a8 100644
+--- a/server/named_pipe.c
++++ b/server/named_pipe.c
+@@ -1142,7 +1142,7 @@ static int pipe_server_ioctl( struct fd *fd, ioctl_code_t code, struct async *as
+         if (current->process->token) /* FIXME: use the client token */
+         {
+             struct token *token;
+-            if (!(token = token_duplicate( current->process->token, 0, SecurityImpersonation, NULL )))
++            if (!(token = token_duplicate( current->process->token, 0, SecurityImpersonation, NULL, NULL, 0, NULL, 0 )))
+                 return 0;
+             if (current->token) release_object( current->token );
+             current->token = token;
 diff --git a/server/process.c b/server/process.c
-index f8739d0..71d9d6d 100644
+index 5e587b28cbe..406167e825b 100644
 --- a/server/process.c
 +++ b/server/process.c
-@@ -566,7 +566,7 @@ struct thread *create_process( int fd, struct thread *parent_thread, int inherit
+@@ -577,7 +577,7 @@ struct process *create_process( int fd, struct process *parent, int inherit_all,
                                         : alloc_handle_table( process, 0 );
          /* Note: for security reasons, starting a new process does not attempt
           * to use the current impersonation token for the new process */
@@ -139,10 +158,10 @@ index f8739d0..71d9d6d 100644
      }
      if (!process->handles || !process->token) goto error;
 diff --git a/server/protocol.def b/server/protocol.def
-index 35824ae..6ee6d28 100644
+index a121c371c19..ee07b1eca14 100644
 --- a/server/protocol.def
 +++ b/server/protocol.def
-@@ -3356,6 +3356,16 @@ enum caret_state
+@@ -3263,6 +3263,16 @@ enum caret_state
      obj_handle_t  new_handle; /* duplicated handle */
  @END
  
@@ -160,10 +179,10 @@ index 35824ae..6ee6d28 100644
      obj_handle_t    handle; /* handle to the token */
      unsigned int    desired_access; /* desired access to the object */
 diff --git a/server/security.h b/server/security.h
-index 873bbc6..bc4a8f6 100644
+index 606dbb2ab2c..6c337143c3d 100644
 --- a/server/security.h
 +++ b/server/security.h
-@@ -55,7 +55,9 @@ extern const PSID security_high_label_sid;
+@@ -56,7 +56,9 @@ extern const PSID security_high_label_sid;
  extern struct token *token_create_admin(void);
  extern int token_assign_label( struct token *token, PSID label );
  extern struct token *token_duplicate( struct token *src_token, unsigned primary,
@@ -175,10 +194,10 @@ index 873bbc6..bc4a8f6 100644
                                     const LUID_AND_ATTRIBUTES *reqprivs,
                                     unsigned int count, LUID_AND_ATTRIBUTES *usedprivs);
 diff --git a/server/token.c b/server/token.c
-index 0810a61..2f6a467 100644
+index 2fa95e17aaf..38a4c203d54 100644
 --- a/server/token.c
 +++ b/server/token.c
-@@ -276,6 +276,19 @@ static int acl_is_valid( const ACL *acl, data_size_t size )
+@@ -285,6 +285,19 @@ static int acl_is_valid( const ACL *acl, data_size_t size )
      return TRUE;
  }
  
@@ -198,7 +217,7 @@ index 0810a61..2f6a467 100644
  /* checks whether all members of a security descriptor fit inside the size
   * of memory specified */
  int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
-@@ -619,8 +632,36 @@ static struct token *create_token( unsigned primary, const SID *user,
+@@ -626,8 +639,36 @@ static struct token *create_token( unsigned primary, const SID *user,
      return token;
  }
  
@@ -236,7 +255,7 @@ index 0810a61..2f6a467 100644
  {
      const luid_t *modified_id =
          primary || (impersonation_level == src_token->impersonation_level) ?
-@@ -656,6 +697,12 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
+@@ -663,6 +704,12 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
              return NULL;
          }
          memcpy( newgroup, group, size );
@@ -249,7 +268,7 @@ index 0810a61..2f6a467 100644
          list_add_tail( &token->groups, &newgroup->entry );
          if (src_token->primary_group == &group->sid)
          {
-@@ -667,11 +714,14 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
+@@ -674,11 +721,14 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
  
      /* copy privileges */
      LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
@@ -264,7 +283,7 @@ index 0810a61..2f6a467 100644
  
      if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
                              DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
-@@ -1304,7 +1354,7 @@ DECL_HANDLER(duplicate_token)
+@@ -1311,7 +1361,7 @@ DECL_HANDLER(duplicate_token)
                                                       TOKEN_DUPLICATE,
                                                       &token_ops )))
      {
@@ -273,7 +292,7 @@ index 0810a61..2f6a467 100644
          if (token)
          {
              reply->new_handle = alloc_handle_no_access_check( current->process, token, req->access, objattr->attributes );
-@@ -1314,6 +1364,36 @@ DECL_HANDLER(duplicate_token)
+@@ -1321,6 +1371,36 @@ DECL_HANDLER(duplicate_token)
      }
  }
  
@@ -311,5 +330,5 @@ index 0810a61..2f6a467 100644
  DECL_HANDLER(check_token_privileges)
  {
 -- 
-2.7.4
+2.27.0
 

patches/advapi32-LsaLookupSids/0002-advapi32-Prepend-a-hidden-LSA_TRUST_INFORMATION-in-L.patch

@@ -1,47 +0,0 @@
-From 246cb6b72666dcb77fb2f553d318d7dabbe8811d Mon Sep 17 00:00:00 2001
-From: Qian Hong <qhong@codeweavers.com>
-Date: Tue, 7 Apr 2015 13:18:47 +0800
-Subject: advapi32: Prepend a hidden LSA_TRUST_INFORMATION in LsaLookupSids to
- avoid crash when Domains[-1] incorrectly accessed by application. (try 2)
-
----
- dlls/advapi32/lsa.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/dlls/advapi32/lsa.c b/dlls/advapi32/lsa.c
-index 69c29c5..dfe25b3 100644
---- a/dlls/advapi32/lsa.c
-+++ b/dlls/advapi32/lsa.c
-@@ -488,14 +488,17 @@ NTSTATUS WINAPI LsaLookupSids(
-     if (!(*Names = heap_alloc(name_fullsize))) return STATUS_NO_MEMORY;
-     /* maximum count of stored domain infos is Count, allocate it like that cause really needed
-        count could only be computed after sid data is retrieved */
--    domain_fullsize = sizeof(LSA_REFERENCED_DOMAIN_LIST) + sizeof(LSA_TRUST_INFORMATION)*Count;
-+    domain_fullsize = sizeof(LSA_REFERENCED_DOMAIN_LIST) + sizeof(LSA_TRUST_INFORMATION) * (Count + 1);
-     if (!(*ReferencedDomains = heap_alloc(domain_fullsize)))
-     {
-         heap_free(*Names);
-         return STATUS_NO_MEMORY;
-     }
-     (*ReferencedDomains)->Entries = 0;
--    (*ReferencedDomains)->Domains = (LSA_TRUST_INFORMATION*)((char*)*ReferencedDomains + sizeof(LSA_REFERENCED_DOMAIN_LIST));
-+    (*ReferencedDomains)->Domains = (LSA_TRUST_INFORMATION*)((char*)*ReferencedDomains +
-+                                    sizeof(LSA_REFERENCED_DOMAIN_LIST) + sizeof(LSA_TRUST_INFORMATION));
-+    (*ReferencedDomains)->Domains[-1].Sid = NULL;
-+    RtlInitUnicodeStringEx(&(*ReferencedDomains)->Domains[-1].Name, NULL);
- 
-     /* Get full names data length and full length needed to store domain name and SID */
-     for (i = 0; i < Count; i++)
-@@ -555,7 +558,8 @@ NTSTATUS WINAPI LsaLookupSids(
- 
-     *ReferencedDomains = heap_realloc(*ReferencedDomains, domain_fullsize);
-     /* fix pointer after reallocation */
--    (*ReferencedDomains)->Domains = (LSA_TRUST_INFORMATION*)((char*)*ReferencedDomains + sizeof(LSA_REFERENCED_DOMAIN_LIST));
-+    (*ReferencedDomains)->Domains = (LSA_TRUST_INFORMATION*)((char*)*ReferencedDomains +
-+                                    sizeof(LSA_REFERENCED_DOMAIN_LIST) + sizeof(LSA_TRUST_INFORMATION));
-     domain_data = (char*)(*ReferencedDomains)->Domains + sizeof(LSA_TRUST_INFORMATION)*Count;
- 
-     mapped = 0;
--- 
-2.3.5
-

patches/advapi32-LsaLookupSids/0003-advapi32-Prepend-a-hidden-LSA_TRUST_INFORMATION-in-L.patch

@@ -1,39 +0,0 @@
-From ce254ac3659e0c040136341d035629f99ec6d1ea Mon Sep 17 00:00:00 2001
-From: Qian Hong <qhong@codeweavers.com>
-Date: Tue, 7 Apr 2015 13:19:06 +0800
-Subject: advapi32: Prepend a hidden LSA_TRUST_INFORMATION in LsaLookupNames2
- to avoid crash when Domains[-1] incorrectly accessed by application. (try 2)
-
----
- dlls/advapi32/lsa.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/dlls/advapi32/lsa.c b/dlls/advapi32/lsa.c
-index dfe25b3..258b8ca 100644
---- a/dlls/advapi32/lsa.c
-+++ b/dlls/advapi32/lsa.c
-@@ -404,14 +404,18 @@ NTSTATUS WINAPI LsaLookupNames2( LSA_HANDLE policy, ULONG flags, ULONG count,
-     sid = (SID *)(*sids + count);
- 
-     /* use maximum domain count */
--    if (!(*domains = heap_alloc(sizeof(LSA_REFERENCED_DOMAIN_LIST) + sizeof(LSA_TRUST_INFORMATION)*count +
--                                sid_size_total + domainname_size_total*sizeof(WCHAR))))
-+    if (!(*domains = heap_alloc(sizeof(LSA_REFERENCED_DOMAIN_LIST) + sizeof(LSA_TRUST_INFORMATION) * (count + 1) +
-+                                sid_size_total + domainname_size_total * sizeof(WCHAR))))
-     {
-         heap_free(*sids);
-         return STATUS_NO_MEMORY;
-     }
-     (*domains)->Entries = 0;
--    (*domains)->Domains = (LSA_TRUST_INFORMATION*)((char*)*domains + sizeof(LSA_REFERENCED_DOMAIN_LIST));
-+    (*domains)->Domains = (LSA_TRUST_INFORMATION*)((char*)*domains +
-+                          sizeof(LSA_REFERENCED_DOMAIN_LIST) + sizeof(LSA_TRUST_INFORMATION));
-+    (*domains)->Domains[-1].Sid = NULL;
-+    RtlInitUnicodeStringEx(&(*domains)->Domains[-1].Name, NULL);
-+
-     domain_data = (char*)(*domains)->Domains + sizeof(LSA_TRUST_INFORMATION)*count;
- 
-     domain.Buffer = heap_alloc(domain_size_max*sizeof(WCHAR));
--- 
-2.3.5
-

patches/advapi32-LsaLookupSids/0004-advapi32-Fallback-to-Sid-string-when-LookupAccountSi.patch

@@ -1,68 +0,0 @@
-From 77d43d721793edda9b419f7426442a35f0cb5918 Mon Sep 17 00:00:00 2001
-From: Qian Hong <qhong@codeweavers.com>
-Date: Tue, 7 Apr 2015 11:23:34 +0800
-Subject: advapi32: Fallback to Sid string when LookupAccountSid fails.
-
----
- dlls/advapi32/lsa.c | 31 +++++++++++++++++++++++++++++++
- 1 file changed, 31 insertions(+)
-
-diff --git a/dlls/advapi32/lsa.c b/dlls/advapi32/lsa.c
-index 1b270a80829..b8dedbd6d58 100644
---- a/dlls/advapi32/lsa.c
-+++ b/dlls/advapi32/lsa.c
-@@ -29,6 +29,7 @@
- #include "winbase.h"
- #include "winreg.h"
- #include "winternl.h"
-+#include "sddl.h"
- #include "advapi32_misc.h"
- 
- #include "wine/debug.h"
-@@ -562,6 +563,21 @@ NTSTATUS WINAPI LsaLookupSids(
-                 domain.MaximumLength = sizeof(WCHAR);
-             }
-         }
-+        else
-+        {
-+            WCHAR *strsid = NULL;
-+
-+            if (ConvertSidToStringSidW(Sids[i], &strsid))
-+            {
-+                name_size = strlenW(strsid) + 1;
-+
-+                (*Names)[i].Name.Length = (name_size - 1) * sizeof(WCHAR);
-+                (*Names)[i].Name.MaximumLength = name_size * sizeof(WCHAR);
-+                name_fullsize += (*Names)[i].Name.MaximumLength;
-+
-+                LocalFree(strsid);
-+            }
-+        }
-     }
- 
-     /* now we have full length needed for both */
-@@ -605,6 +621,21 @@ NTSTATUS WINAPI LsaLookupSids(
-             (*Names)[i].DomainIndex = lsa_reflist_add_domain(*ReferencedDomains, &domain, &domain_data);
-             heap_free(domain.Buffer);
-         }
-+        else
-+        {
-+            WCHAR *strsid = NULL;
-+
-+            if (ConvertSidToStringSidW(Sids[i], &strsid))
-+            {
-+                name_size = strlenW(strsid) + 1;
-+                mapped++;
-+
-+                (*Names)[i].Name.Buffer = name_buffer;
-+                memcpy((*Names)[i].Name.Buffer, strsid, name_size * sizeof(WCHAR));
-+
-+                LocalFree(strsid);
-+            }
-+        }
- 
-         name_buffer += name_size;
-     }
--- 
-2.11.0
-

patches/advapi32-LsaLookupSids/0007-advapi32-Fix-name-and-use-of-DOMAIN_GROUP_RID_USERS.patch

@@ -1,56 +0,0 @@
-From 486ec8b5ea1b39195d92cfdbfe3a334280780a14 Mon Sep 17 00:00:00 2001
-From: Qian Hong <qhong@codeweavers.com>
-Date: Tue, 28 Apr 2015 23:00:08 +0800
-Subject: [PATCH] advapi32: Fix name and use of DOMAIN_GROUP_RID_USERS.
-
----
- dlls/advapi32/security.c       | 7 +++++--
- dlls/advapi32/tests/security.c | 4 ++--
- 2 files changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/dlls/advapi32/security.c b/dlls/advapi32/security.c
-index a7707f15d39..73c1f054d5c 100644
---- a/dlls/advapi32/security.c
-+++ b/dlls/advapi32/security.c
-@@ -187,7 +187,7 @@ static const WCHAR Domain_Admins[] = { 'D','o','m','a','i','n',' ','A','d','m','
- static const WCHAR Domain_Computers[] = { 'D','o','m','a','i','n',' ','C','o','m','p','u','t','e','r','s',0 };
- static const WCHAR Domain_Controllers[] = { 'D','o','m','a','i','n',' ','C','o','n','t','r','o','l','l','e','r','s',0 };
- static const WCHAR Domain_Guests[] = { 'D','o','m','a','i','n',' ','G','u','e','s','t','s',0 };
--static const WCHAR Domain_Users[] = { 'D','o','m','a','i','n',' ','U','s','e','r','s',0 };
-+static const WCHAR None[] = { 'N','o','n','e',0 };
- static const WCHAR Enterprise_Admins[] = { 'E','n','t','e','r','p','r','i','s','e',' ','A','d','m','i','n','s',0 };
- static const WCHAR ENTERPRISE_DOMAIN_CONTROLLERS[] = { 'E','N','T','E','R','P','R','I','S','E',' ','D','O','M','A','I','N',' ','C','O','N','T','R','O','L','L','E','R','S',0 };
- static const WCHAR Everyone[] = { 'E','v','e','r','y','o','n','e',0 };
-@@ -1185,7 +1185,10 @@ LookupAccountSidW(
-                             ac = Domain_Admins;
-                             break;
-                         case DOMAIN_GROUP_RID_USERS:
--                            ac = Domain_Users;
-+                            /* MSDN says the name of DOMAIN_GROUP_RID_USERS is Domain Users,
-+                             * tests show that MSDN seems to be wrong. */
-+                            ac = None;
-+                            use = 2;
-                             break;
-                         case DOMAIN_GROUP_RID_GUESTS:
-                             ac = Domain_Guests;
-diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c
-index 5f65ed385dd..a9d745cfe39 100644
---- a/dlls/advapi32/tests/security.c
-+++ b/dlls/advapi32/tests/security.c
-@@ -3003,11 +3003,11 @@ static void test_process_security(void)
-     dom_size = sizeof(domain);
-     ret = LookupAccountSidA( NULL, UsersSid, account, &acc_size, domain, &dom_size, &use );
-     ok(ret, "LookupAccountSid failed with %d\n", ret);
--    todo_wine ok(use == SidTypeGroup, "expect SidTypeGroup, got %d\n", use);
-+    ok(use == SidTypeGroup, "expect SidTypeGroup, got %d\n", use);
-     if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
-         skip("Non-English locale (test with hardcoded 'None')\n");
-     else
--        todo_wine ok(!strcmp(account, "None"), "expect None, got %s\n", account);
-+        ok(!strcmp(account, "None"), "expect None, got %s\n", account);
- 
-     res = GetTokenInformation( token, TokenUser, NULL, 0, &size );
-     ok(!res, "Expected failure, got %d\n", res);
--- 
-2.17.1
-

patches/advapi32-LsaLookupSids/definition

@@ -1,3 +0,0 @@
-# Originally sent 2015 April by Qian Hong, apparently dropped off the list:
-# <https://www.winehq.org/pipermail/wine-patches/2015-April/138515.html>
-# Some of the patches were labeled as for Cygwin.

patches/advapi32-Token_Integrity_Level/0001-advapi32-tests-Extend-security-label-token-integrity.patch

@@ -1,15 +1,16 @@
-From ba50fc98ee4690e62899d48efc856c2bc910536c Mon Sep 17 00:00:00 2001
+From 8044f571b7e674ce9e562488864d48646a9c7b88 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Mon, 7 Aug 2017 01:25:02 +0200
-Subject: advapi32/tests: Extend security label / token integrity tests.
+Subject: [PATCH] advapi32/tests: Extend security label / token integrity
+ tests.
 
 ---
  dlls/advapi32/tests/Makefile.in |   2 +-
- dlls/advapi32/tests/security.c  | 389 +++++++++++++++++++++++++++++++++++++++-
+ dlls/advapi32/tests/security.c  | 389 +++++++++++++++++++++++++++++++-
  2 files changed, 387 insertions(+), 4 deletions(-)
 
 diff --git a/dlls/advapi32/tests/Makefile.in b/dlls/advapi32/tests/Makefile.in
-index 36ce031ef62..4437e6e5de7 100644
+index 12583e59f57..caee5fae308 100644
 --- a/dlls/advapi32/tests/Makefile.in
 +++ b/dlls/advapi32/tests/Makefile.in
 @@ -1,5 +1,5 @@
@@ -20,10 +21,10 @@ index 36ce031ef62..4437e6e5de7 100644
  C_SRCS = \
  	cred.c \
 diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c
-index 0fd41fe82fa..4a03db27e69 100644
+index a736dbffd22..4529469d932 100644
 --- a/dlls/advapi32/tests/security.c
 +++ b/dlls/advapi32/tests/security.c
-@@ -7191,13 +7191,19 @@ static void test_token_security_descriptor(void)
+@@ -7034,13 +7034,19 @@ static void test_token_security_descriptor(void)
  {
      static SID low_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY},
                              {SECURITY_MANDATORY_LOW_RID}};
@@ -46,7 +47,7 @@ index 0fd41fe82fa..4a03db27e69 100644
      PROCESS_INFORMATION info;
      DWORD size, index, retd;
      ACCESS_ALLOWED_ACE *ace;
-@@ -7347,6 +7353,185 @@ static void test_token_security_descriptor(void)
+@@ -7190,6 +7196,185 @@ static void test_token_security_descriptor(void)
      /* The security label is also not inherited */
      if (pAddMandatoryAce)
      {
@@ -103,7 +104,7 @@ index 0fd41fe82fa..4a03db27e69 100644
 +
 +            if (sacl)
 +            {
-+                ret = pGetAce(sacl, 0, (void **)&ace);
++                ret = GetAce(sacl, 0, (void **)&ace);
 +                ok(ret, "GetAce failed with error %u\n", GetLastError());
 +                ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
 +                   "Unexpected ACE type %#x\n", ace->Header.AceType);
@@ -165,7 +166,7 @@ index 0fd41fe82fa..4a03db27e69 100644
 +
 +            if (sacl)
 +            {
-+                ret = pGetAce(sacl, 0, (void **)&ace);
++                ret = GetAce(sacl, 0, (void **)&ace);
 +                ok(ret, "GetAce failed with error %u\n", GetLastError());
 +                ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
 +                   "Unexpected ACE type %#x\n", ace->Header.AceType);
@@ -215,7 +216,7 @@ index 0fd41fe82fa..4a03db27e69 100644
 +
 +            if (sacl)
 +            {
-+                ret = pGetAce(sacl, 0, (void **)&ace);
++                ret = GetAce(sacl, 0, (void **)&ace);
 +                ok(ret, "GetAce failed with error %u\n", GetLastError());
 +                ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
 +                   "Unexpected ACE type %#x\n", ace->Header.AceType);
@@ -232,7 +233,7 @@ index 0fd41fe82fa..4a03db27e69 100644
          ret = InitializeAcl(acl, 256, ACL_REVISION);
          ok(ret, "InitializeAcl failed with error %u\n", GetLastError());
  
-@@ -7362,6 +7547,90 @@ static void test_token_security_descriptor(void)
+@@ -7205,6 +7390,90 @@ static void test_token_security_descriptor(void)
  
          ret = SetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd);
          ok(ret, "SetKernelObjectSecurity failed with error %u\n", GetLastError());
@@ -272,7 +273,7 @@ index 0fd41fe82fa..4a03db27e69 100644
 +
 +        if (sacl)
 +        {
-+            ret = pGetAce(sacl, 0, (void **)&ace);
++            ret = GetAce(sacl, 0, (void **)&ace);
 +            ok(ret, "GetAce failed with error %u\n", GetLastError());
 +            ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
 +               "Unexpected ACE type %#x\n", ace->Header.AceType);
@@ -310,7 +311,7 @@ index 0fd41fe82fa..4a03db27e69 100644
 +
 +        if (sacl)
 +        {
-+            ret = pGetAce(sacl, 0, (void **)&ace);
++            ret = GetAce(sacl, 0, (void **)&ace);
 +            ok(ret, "GetAce failed with error %u\n", GetLastError());
 +            ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
 +               "Unexpected ACE type %#x\n", ace->Header.AceType);
@@ -323,7 +324,7 @@ index 0fd41fe82fa..4a03db27e69 100644
      }
      else
          win_skip("SYSTEM_MANDATORY_LABEL not supported\n");
-@@ -7467,6 +7736,116 @@ static void test_child_token_sd(void)
+@@ -7312,6 +7581,116 @@ static void test_child_token_sd(void)
      HeapFree(GetProcessHeap(), 0, sd);
  }
  
@@ -366,7 +367,7 @@ index 0fd41fe82fa..4a03db27e69 100644
 +    ok(acl && acl != (void *)0xdeadbeef, "Got invalid SACL\n");
 +    ok(!defaulted, "SACL defaulted\n");
 +    ok(acl->AceCount == 1, "Expected exactly one ACE\n");
-+    ret = pGetAce(acl, 0, (void **)&ace_label);
++    ret = GetAce(acl, 0, (void **)&ace_label);
 +    ok(ret, "GetAce failed with error %u\n", GetLastError());
 +    ok(ace_label->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
 +       "Unexpected ACE type %#x\n", ace_label->Header.AceType);
@@ -421,7 +422,7 @@ index 0fd41fe82fa..4a03db27e69 100644
 +    ok(acl && acl != (void *)0xdeadbeef, "Got invalid SACL\n");
 +    ok(!defaulted, "SACL defaulted\n");
 +    ok(acl->AceCount == 1, "Expected exactly one ACE\n");
-+    ret = pGetAce(acl, 0, (void **)&ace_label);
++    ret = GetAce(acl, 0, (void **)&ace_label);
 +    ok(ret, "GetAce failed with error %u\n", GetLastError());
 +    ok(ace_label->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
 +       "Unexpected ACE type %#x\n", ace_label->Header.AceType);
@@ -440,7 +441,7 @@ index 0fd41fe82fa..4a03db27e69 100644
  static void test_GetExplicitEntriesFromAclW(void)
  {
      static const WCHAR wszCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
-@@ -7653,6 +8032,10 @@ START_TEST(security)
+@@ -7571,6 +7950,10 @@ START_TEST(security)
      {
          if (!strcmp(myARGV[2], "test_token_sd"))
              test_child_token_sd();
@@ -452,5 +453,5 @@ index 0fd41fe82fa..4a03db27e69 100644
              test_process_security_child();
          return;
 -- 
-2.13.1
+2.17.1
 

patches/advapi32-Token_Integrity_Level/0002-server-Implement-token-elevation-information.patch

@@ -1,38 +1,39 @@
-From c8dc0ec6406e8449b59c219ede2e9bd88d8a56fa Mon Sep 17 00:00:00 2001
+From d2e98b2054a5af671fd81ded32f2cf60a062312c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sat, 5 Aug 2017 00:26:03 +0200
 Subject: [PATCH] server: Implement token elevation information.
 
 ---
- dlls/ntdll/nt.c     | 16 ++++++++++++----
- server/protocol.def |  8 ++++++++
- server/token.c      | 22 +++++++++++++++++++---
+ dlls/ntdll/unix/security.c | 16 ++++++++++++----
+ server/protocol.def        |  8 ++++++++
+ server/token.c             | 22 +++++++++++++++++++---
  3 files changed, 39 insertions(+), 7 deletions(-)
 
-diff --git a/dlls/ntdll/nt.c b/dlls/ntdll/nt.c
-index cd271fde9c..b1dd999cf5 100644
---- a/dlls/ntdll/nt.c
-+++ b/dlls/ntdll/nt.c
-@@ -625,18 +625,26 @@ NTSTATUS WINAPI NtQueryInformationToken(
-         SERVER_END_REQ;
+diff --git a/dlls/ntdll/unix/security.c b/dlls/ntdll/unix/security.c
+index d063d43d6d4..03a81afa46e 100644
+--- a/dlls/ntdll/unix/security.c
++++ b/dlls/ntdll/unix/security.c
+@@ -390,19 +390,27 @@ NTSTATUS WINAPI NtQueryInformationToken( HANDLE token, TOKEN_INFORMATION_CLASS c
          break;
+ 
      case TokenElevationType:
 +        SERVER_START_REQ( get_token_elevation_type )
          {
-             TOKEN_ELEVATION_TYPE *elevation_type = tokeninfo;
+             TOKEN_ELEVATION_TYPE *type = info;
 -            FIXME("QueryInformationToken( ..., TokenElevationType, ...) semi-stub\n");
--            *elevation_type = TokenElevationTypeFull;
+-            *type = TokenElevationTypeFull;
 +            req->handle = wine_server_obj_handle( token );
 +            status = wine_server_call( req );
 +            if (status == STATUS_SUCCESS)
-+                *elevation_type = reply->elevation;
++                *type = reply->elevation;
          }
 +        SERVER_END_REQ;
          break;
+ 
      case TokenElevation:
 +        SERVER_START_REQ( get_token_elevation_type )
          {
-             TOKEN_ELEVATION *elevation = tokeninfo;
+             TOKEN_ELEVATION *elevation = info;
 -            FIXME("QueryInformationToken( ..., TokenElevation, ...) semi-stub\n");
 -            elevation->TokenIsElevated = TRUE;
 +            req->handle = wine_server_obj_handle( token );
@@ -42,13 +43,13 @@ index cd271fde9c..b1dd999cf5 100644
          }
 +        SERVER_END_REQ;
          break;
+ 
      case TokenSessionId:
-         {
 diff --git a/server/protocol.def b/server/protocol.def
-index 90af9df7f4..93afaabca1 100644
+index ee07b1eca14..84f0b577d72 100644
 --- a/server/protocol.def
 +++ b/server/protocol.def
-@@ -3643,6 +3643,14 @@ struct handle_info
+@@ -3566,6 +3566,14 @@ struct handle_info
  @END
  
  
@@ -64,10 +65,10 @@ index 90af9df7f4..93afaabca1 100644
  @REQ(create_completion)
      unsigned int access;          /* desired access to a port */
 diff --git a/server/token.c b/server/token.c
-index 6d193603b4..64f20e1b57 100644
+index 38a4c203d54..14343637af5 100644
 --- a/server/token.c
 +++ b/server/token.c
-@@ -112,6 +112,7 @@ struct token
+@@ -110,6 +110,7 @@ struct token
      ACL           *default_dacl;    /* the default DACL to assign to objects created by this user */
      TOKEN_SOURCE   source;          /* source of the token */
      int            impersonation_level; /* impersonation level this token is capable of if non-primary token */
@@ -75,7 +76,7 @@ index 6d193603b4..64f20e1b57 100644
  };
  
  struct privilege
-@@ -545,7 +546,7 @@ static struct token *create_token( unsigned primary, const SID *user,
+@@ -552,7 +553,7 @@ static struct token *create_token( unsigned primary, const SID *user,
                                     const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
                                     const ACL *default_dacl, TOKEN_SOURCE source,
                                     const luid_t *modified_id,
@@ -84,7 +85,7 @@ index 6d193603b4..64f20e1b57 100644
  {
      struct token *token = alloc_object( &token_ops );
      if (token)
-@@ -567,6 +568,7 @@ static struct token *create_token( unsigned primary, const SID *user,
+@@ -574,6 +575,7 @@ static struct token *create_token( unsigned primary, const SID *user,
              token->impersonation_level = impersonation_level;
          token->default_dacl = NULL;
          token->primary_group = NULL;
@@ -92,7 +93,7 @@ index 6d193603b4..64f20e1b57 100644
  
          /* copy user */
          token->user = memdup( user, security_sid_len( user ));
-@@ -682,7 +684,8 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
+@@ -689,7 +691,8 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
      token = create_token( primary, src_token->user, NULL, 0,
                            NULL, 0, src_token->default_dacl,
                            src_token->source, modified_id,
@@ -102,7 +103,7 @@ index 6d193603b4..64f20e1b57 100644
      if (!token) return token;
  
      /* copy groups */
-@@ -888,7 +891,7 @@ struct token *token_create_admin( void )
+@@ -895,7 +898,7 @@ struct token *token_create_admin( void )
          static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
          token = create_token( TRUE, user_sid, admin_groups, ARRAY_SIZE( admin_groups ),
                                admin_privs, ARRAY_SIZE( admin_privs ), default_dacl,
@@ -111,7 +112,7 @@ index 6d193603b4..64f20e1b57 100644
          /* we really need a primary group */
          assert( token->primary_group );
      }
-@@ -1627,6 +1630,19 @@ DECL_HANDLER(get_token_statistics)
+@@ -1634,6 +1637,19 @@ DECL_HANDLER(get_token_statistics)
      }
  }
  
@@ -132,5 +133,5 @@ index 6d193603b4..64f20e1b57 100644
  {
      struct token *token;
 -- 
-2.19.1
+2.27.0
 

patches/advapi32-Token_Integrity_Level/0004-server-Implement-token-integrity-level.patch

@@ -1,19 +1,19 @@
-From ae503e8e7eb8f4fcb9bf3e642458c2a1bba6ccaa Mon Sep 17 00:00:00 2001
+From 6dc1b7d9e533379133857629bb9c09e1045a9020 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Mon, 7 Aug 2017 02:28:35 +0200
 Subject: [PATCH] server: Implement token integrity level.
 
 ---
- dlls/ntdll/nt.c     | 23 ++++++++++++++---------
- server/protocol.def |  7 +++++++
- server/token.c      | 30 +++++++++++++++++++++++++++---
+ dlls/ntdll/unix/security.c | 23 ++++++++++++++---------
+ server/protocol.def        |  7 +++++++
+ server/token.c             | 30 +++++++++++++++++++++++++++---
  3 files changed, 48 insertions(+), 12 deletions(-)
 
-diff --git a/dlls/ntdll/nt.c b/dlls/ntdll/nt.c
-index ca26ab15..8aab0a48 100644
---- a/dlls/ntdll/nt.c
-+++ b/dlls/ntdll/nt.c
-@@ -400,7 +400,7 @@ NTSTATUS WINAPI NtQueryInformationToken(
+diff --git a/dlls/ntdll/unix/security.c b/dlls/ntdll/unix/security.c
+index 03a81afa46e..f0057116dee 100644
+--- a/dlls/ntdll/unix/security.c
++++ b/dlls/ntdll/unix/security.c
+@@ -172,7 +172,7 @@ NTSTATUS WINAPI NtQueryInformationToken( HANDLE token, TOKEN_INFORMATION_CLASS c
          0,    /* TokenAccessInformation */
          0,    /* TokenVirtualizationAllowed */
          sizeof(DWORD), /* TokenVirtualizationEnabled */
@@ -22,9 +22,9 @@ index ca26ab15..8aab0a48 100644
          0,    /* TokenUIAccess */
          0,    /* TokenMandatoryPolicy */
          0,    /* TokenLogonSid */
-@@ -659,18 +659,23 @@ NTSTATUS WINAPI NtQueryInformationToken(
-         }
+@@ -428,18 +428,23 @@ NTSTATUS WINAPI NtQueryInformationToken( HANDLE token, TOKEN_INFORMATION_CLASS c
          break;
+ 
      case TokenIntegrityLevel:
 +        SERVER_START_REQ( get_token_integrity )
          {
@@ -32,14 +32,14 @@ index ca26ab15..8aab0a48 100644
 -            static const SID high_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY},
 -                                                            {SECURITY_MANDATORY_HIGH_RID}};
 -
-             TOKEN_MANDATORY_LABEL *tml = tokeninfo;
+             TOKEN_MANDATORY_LABEL *tml = info;
 -            PSID psid = tml + 1;
 +            PSID sid = tml + 1;
-+            DWORD sid_len = tokeninfolength < sizeof(*tml) ? 0 : tokeninfolength - sizeof(*tml);
++            DWORD sid_len = length < sizeof(*tml) ? 0 : length - sizeof(*tml);
  
 -            tml->Label.Sid = psid;
 -            tml->Label.Attributes = SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED;
--            memcpy(psid, &high_level, sizeof(SID));
+-            memcpy( psid, &high_level, sizeof(SID) );
 +            req->handle = wine_server_obj_handle( token );
 +            wine_server_set_reply( req, sid, sid_len );
 +            status = wine_server_call( req );
@@ -52,13 +52,13 @@ index ca26ab15..8aab0a48 100644
          }
 +        SERVER_END_REQ;
          break;
+ 
      case TokenAppContainerSid:
-         {
 diff --git a/server/protocol.def b/server/protocol.def
-index 11221d7d..1bfe3234 100644
+index 84f0b577d72..4d37a0df348 100644
 --- a/server/protocol.def
 +++ b/server/protocol.def
-@@ -3405,6 +3405,13 @@ enum caret_state
+@@ -3296,6 +3296,13 @@ enum caret_state
      VARARG(sid,SID);              /* the sid specified by which_sid from the token */
  @END
  
@@ -73,10 +73,10 @@ index 11221d7d..1bfe3234 100644
      obj_handle_t    handle;       /* handle to the token */
  @REPLY
 diff --git a/server/token.c b/server/token.c
-index ccde0c2d..2d81118a 100644
+index 7c510fbdad9..d267991f751 100644
 --- a/server/token.c
 +++ b/server/token.c
-@@ -113,6 +113,7 @@ struct token
+@@ -111,6 +111,7 @@ struct token
      TOKEN_SOURCE   source;          /* source of the token */
      int            impersonation_level; /* impersonation level this token is capable of if non-primary token */
      TOKEN_ELEVATION_TYPE elevation; /* elevation level */
@@ -84,7 +84,7 @@ index ccde0c2d..2d81118a 100644
  };
  
  struct privilege
-@@ -546,7 +547,8 @@ static struct token *create_token( unsigned primary, const SID *user,
+@@ -553,7 +554,8 @@ static struct token *create_token( unsigned primary, const SID *user,
                                     const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
                                     const ACL *default_dacl, TOKEN_SOURCE source,
                                     const luid_t *modified_id,
@@ -94,7 +94,7 @@ index ccde0c2d..2d81118a 100644
  {
      struct token *token = alloc_object( &token_ops );
      if (token)
-@@ -630,6 +632,7 @@ static struct token *create_token( unsigned primary, const SID *user,
+@@ -637,6 +639,7 @@ static struct token *create_token( unsigned primary, const SID *user,
          }
  
          token->source = source;
@@ -102,7 +102,7 @@ index ccde0c2d..2d81118a 100644
      }
      return token;
  }
-@@ -685,7 +688,8 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
+@@ -692,7 +695,8 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
                            NULL, 0, src_token->default_dacl,
                            src_token->source, modified_id,
                            impersonation_level,
@@ -112,7 +112,7 @@ index ccde0c2d..2d81118a 100644
      if (!token) return token;
  
      /* copy groups */
-@@ -890,7 +894,7 @@ struct token *token_create_admin( void )
+@@ -898,7 +902,7 @@ struct token *token_create_admin( void )
          static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
          token = create_token( TRUE, user_sid, admin_groups, ARRAY_SIZE( admin_groups ),
                                admin_privs, ARRAY_SIZE( admin_privs ), default_dacl,
@@ -121,7 +121,7 @@ index ccde0c2d..2d81118a 100644
          /* we really need a primary group */
          assert( token->primary_group );
      }
-@@ -1524,6 +1528,26 @@ DECL_HANDLER(get_token_sid)
+@@ -1532,6 +1536,26 @@ DECL_HANDLER(get_token_sid)
      }
  }
  
@@ -149,5 +149,5 @@ index ccde0c2d..2d81118a 100644
  DECL_HANDLER(get_token_groups)
  {
 -- 
-2.19.1
+2.27.0
 

patches/advapi32-Token_Integrity_Level/0006-ntdll-Add-function-to-create-new-tokens-for-elevatio.patch

@@ -1,4 +1,4 @@
-From 8959c13f2be7e2a31f27c8483ee2202692f00710 Mon Sep 17 00:00:00 2001
+From c47977a8bbd739483589d1f01cfece435be1c100 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sat, 5 Aug 2017 01:45:29 +0200
 Subject: [PATCH] ntdll: Add function to create new tokens for elevation
@@ -14,10 +14,10 @@ Subject: [PATCH] ntdll: Add function to create new tokens for elevation
  6 files changed, 117 insertions(+)
 
 diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
-index d626e0bf2..5057e2b07 100644
+index 0997c310110..8e3786e1972 100644
 --- a/dlls/ntdll/ntdll.spec
 +++ b/dlls/ntdll/ntdll.spec
-@@ -1556,6 +1556,9 @@
+@@ -1600,6 +1600,9 @@
  # Virtual memory
  @ cdecl __wine_locked_recvmsg(long ptr long)
  
@@ -25,27 +25,27 @@ index d626e0bf2..5057e2b07 100644
 +@ cdecl __wine_create_default_token(long)
 +
  # Version
- @ cdecl wine_get_version() NTDLL_wine_get_version
- @ cdecl wine_get_patches() NTDLL_wine_get_patches
+ @ cdecl wine_get_version()
+ @ cdecl wine_get_build_id()
 diff --git a/dlls/ntdll/ntdll_misc.h b/dlls/ntdll/ntdll_misc.h
-index ac1469412..6c2345c6c 100644
+index 63ceac42e94..5a98501381b 100644
 --- a/dlls/ntdll/ntdll_misc.h
 +++ b/dlls/ntdll/ntdll_misc.h
-@@ -89,6 +89,9 @@ extern void init_user_process_params( SIZE_T data_size ) DECLSPEC_HIDDEN;
- extern char **build_envp( const WCHAR *envW ) DECLSPEC_HIDDEN;
+@@ -67,6 +67,9 @@ extern void init_user_process_params(void) DECLSPEC_HIDDEN;
  extern NTSTATUS restart_process( RTL_USER_PROCESS_PARAMETERS *params, NTSTATUS status ) DECLSPEC_HIDDEN;
+ extern void CDECL DECLSPEC_NORETURN signal_start_thread( CONTEXT *ctx ) DECLSPEC_HIDDEN;
  
 +/* token */
 +extern HANDLE CDECL __wine_create_default_token(BOOL admin);
 +
  /* server support */
- extern timeout_t server_start_time DECLSPEC_HIDDEN;
- extern unsigned int server_cpus DECLSPEC_HIDDEN;
+ extern BOOL is_wow64 DECLSPEC_HIDDEN;
+ 
 diff --git a/dlls/ntdll/process.c b/dlls/ntdll/process.c
-index 52d7ea429..e24691b8a 100644
+index 77ba5b371e2..3e91a1fa9c4 100644
 --- a/dlls/ntdll/process.c
 +++ b/dlls/ntdll/process.c
-@@ -125,6 +125,24 @@ HANDLE CDECL __wine_make_process_system(void)
+@@ -72,6 +72,24 @@ HANDLE CDECL __wine_make_process_system(void)
      return ret;
  }
  
@@ -67,14 +67,14 @@ index 52d7ea429..e24691b8a 100644
 +    return ret;
 +}
 +
- static UINT process_error_mode;
- 
- #define UNIMPLEMENTED_INFO_CLASS(c) \
+ /***********************************************************************
+  *           restart_process
+  */
 diff --git a/server/protocol.def b/server/protocol.def
-index e908f2131..0177cb579 100644
+index 30a102d7b82..a9308904afc 100644
 --- a/server/protocol.def
 +++ b/server/protocol.def
-@@ -3734,6 +3734,14 @@ struct handle_info
+@@ -3481,6 +3481,14 @@ struct handle_info
  @END
  
  
@@ -90,7 +90,7 @@ index e908f2131..0177cb579 100644
  @REQ(create_completion)
      unsigned int access;          /* desired access to a port */
 diff --git a/server/security.h b/server/security.h
-index 6c337143c..21e90ccf2 100644
+index 6c337143c3d..21e90ccf23f 100644
 --- a/server/security.h
 +++ b/server/security.h
 @@ -49,6 +49,7 @@ extern const PSID security_builtin_users_sid;
@@ -102,10 +102,10 @@ index 6c337143c..21e90ccf2 100644
  
  /* token functions */
 diff --git a/server/token.c b/server/token.c
-index 381ae6871..fcab79955 100644
+index c4f1cd943c2..970ed1838da 100644
 --- a/server/token.c
 +++ b/server/token.c
-@@ -79,6 +79,7 @@ static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORIT
+@@ -77,6 +77,7 @@ static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORIT
  static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
  static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
  static const SID high_label_sid = { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY }, { SECURITY_MANDATORY_HIGH_RID } };
@@ -113,7 +113,7 @@ index 381ae6871..fcab79955 100644
  static const SID_N(5) local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
  static const SID_N(2) builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
  static const SID_N(2) builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
-@@ -95,6 +96,7 @@ const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
+@@ -93,6 +94,7 @@ const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
  const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
  const PSID security_domain_users_sid = (PSID)&domain_users_sid;
  const PSID security_high_label_sid = (PSID)&high_label_sid;
@@ -121,7 +121,7 @@ index 381ae6871..fcab79955 100644
  
  static luid_t prev_luid_value = { 1000, 0 };
  
-@@ -917,6 +919,64 @@ struct token *token_create_admin( void )
+@@ -915,6 +917,64 @@ struct token *token_create_admin( void )
      return token;
  }
  
@@ -186,7 +186,7 @@ index 381ae6871..fcab79955 100644
  static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
  {
      struct privilege *privilege;
-@@ -1722,3 +1782,27 @@ DECL_HANDLER(set_token_default_dacl)
+@@ -1720,3 +1780,27 @@ DECL_HANDLER(set_token_default_dacl)
          release_object( token );
      }
  }
@@ -215,5 +215,5 @@ index 381ae6871..fcab79955 100644
 +    }
 +}
 -- 
-2.23.0
+2.28.0