[ros-diffs] [fireball] 23509: Relax restriction on the segment in NtSetLdtEntries(). Look into diff for details. Thanks to Myria for providing information. There were no reasons found which can proof that this change could lead to security issues.

[fireball at svn.reactos.org]

Author: fireball
Date: Mon Aug  7 02:02:02 2006
New Revision: 23509

URL: http://svn.reactos.org/svn/reactos?rev=23509&view=rev
Log:
Relax restriction on the segment in NtSetLdtEntries(). Look into diff for details. Thanks to Myria for providing information.

There were no reasons found which can proof that this change could lead to security issues.

Modified:
    trunk/reactos/ntoskrnl/ke/i386/ldt.c

Modified: trunk/reactos/ntoskrnl/ke/i386/ldt.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ke/i386/ldt.c?rev=23509&r1=23508&r2=23509&view=diff
==============================================================================
--- trunk/reactos/ntoskrnl/ke/i386/ldt.c (original)
+++ trunk/reactos/ntoskrnl/ke/i386/ldt.c Mon Aug  7 02:02:02 2006
@@ -58,8 +58,20 @@
     SegLimit=(SegLimit << 12) | 0xfff;
   }
 
-  return ((Base + SegLimit > (ULONG) MmHighestUserAddress) ||
-          (Base > Base+SegLimit) ? FALSE : TRUE);
+  if ((Base + SegLimit > (ULONG_PTR) MmHighestUserAddress) ||
+      (Base > Base+SegLimit))
+  {
+    DPRINT1("WARNING: Windows would mark this descriptor invalid!");
+  }
+
+  /*
+     Certain "DOS32" programs expect to be able to create DPMI selectors
+     that wrap the address space.  Windows NT does not allow user-created
+     selectors to reach into kernel memory.  However, there is no security
+     risk in allowing it; the page table will prevent access anyway.
+  */  
+  return (/*(Base + SegLimit > (ULONG_PTR) MmHighestUserAddress) ||
+          (Base > Base+SegLimit) ? FALSE : TRUE*/ TRUE);
 }
 
 NTSTATUS STDCALL