From 667e107d30eb0f3e530433122d5221c5571a584b Mon Sep 17 00:00:00 2001
From: Jinoh Kang <jinoh.kang.kr@gmail.com>
Date: Wed, 15 Nov 2023 00:29:34 +0900
Subject: [PATCH] server: Don't crash when opening null path with a console
 handle as RootDirectory.

Fixes: 7364a4b07536c10331e6049bc098ca9dba9554e6
---
 dlls/kernel32/tests/console.c | 23 +++++++++++++++++++++++
 server/console.c              |  6 ++++++
 2 files changed, 29 insertions(+)

diff --git a/dlls/kernel32/tests/console.c b/dlls/kernel32/tests/console.c
index 911c976128f..83bfed9af89 100644
--- a/dlls/kernel32/tests/console.c
+++ b/dlls/kernel32/tests/console.c
@@ -4500,6 +4500,28 @@ static void test_file_info(HANDLE input, HANDLE output)
     ok(type == FILE_TYPE_CHAR, "GetFileType returned %lu\n", type);
 }
 
+static void test_console_as_root_directory(void)
+{
+    OBJECT_ATTRIBUTES attr;
+    IO_STATUS_BLOCK iosb;
+    UNICODE_STRING name;
+    HANDLE handle, h2;
+    NTSTATUS status;
+
+    handle = CreateFileA( "CON", GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, 0 );
+    ok( handle != INVALID_HANDLE_VALUE, "CreateFileA error %lu\n", GetLastError() );
+
+    RtlInitUnicodeString( &name, L"" );
+    InitializeObjectAttributes( &attr, &name, 0, handle, NULL );
+    status = NtCreateFile( &h2, SYNCHRONIZE, &attr, &iosb, NULL, 0,
+                           FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                           FILE_OPEN, 0, NULL, 0 );
+    ok( status == STATUS_NOT_FOUND || broken( status == STATUS_OBJECT_TYPE_MISMATCH ) /* Win7 */,
+        "NtCreateFile returned %#lx\n", status );
+
+    CloseHandle( handle );
+}
+
 static void test_AttachConsole_child(DWORD console_pid)
 {
     HANDLE pipe_in, pipe_out;
@@ -5547,6 +5569,7 @@ START_TEST(console)
     test_GetConsoleOriginalTitle();
     test_GetConsoleTitleA();
     test_GetConsoleTitleW();
+    test_console_as_root_directory();
     if (!test_current)
     {
         test_pseudo_console();
diff --git a/server/console.c b/server/console.c
index b64283baf4a..bef48c205ed 100644
--- a/server/console.c
+++ b/server/console.c
@@ -796,6 +796,12 @@ static struct object *console_lookup_name( struct object *obj, struct unicode_st
     static const WCHAR connectionW[]    = {'C','o','n','n','e','c','t','i','o','n'};
     assert( obj->ops == &console_ops );
 
+    if (!name)
+    {
+        set_error( STATUS_NOT_FOUND );
+        return NULL;
+    }
+
     if (name->len == sizeof(connectionW) && !memcmp( name->str, connectionW, name->len ))
     {
         name->len = 0;
-- 
GitLab