terminal/src/host/readDataDirect.cpp
Dustin Howett c0ab9cb5b5 Merged PR 6034984: Fix a crash caused by improper buffer management w/ multiple clients
Until there's a "Wait", there's usually only one API message inflight at
a time.

In our quest for performance, we put that single API message in charge
of its own buffer management: instead of allocating buffers on the heap
and deleting them later (storing pointers to them at the far corners of
the earth), it would instead allocate them from small internal pools (if
possible) and only heap allocate (transparently) if necessary. The
pointers flung to the corners of the earth would be pointers (1) back
into the API_MSG or (2) to a heap block owned by boost::small_vector.

It took us months to realize that those bare pointers were being held by
COOKED_READ and RAW_READ and not actually being updated when the API
message was _copied_ as it was shuffled off to the background to become
a "Wait" message.

It turns out that it's trivially possible to crash the console by
sending two API calls--one that waits and one that completes
immediately--when the waiting message or the "wait completer" has a
bunch of dangling pointers in it. It further turns out that some
accessibility software (like JAWS) attaches directly to the console
session, much like winpty and ConEmu and friends. They're trying to read
out the buffer (API call!) and sometimes there's a shell waiting for
input (API call!). Oops.

In this commit, we fix up the message's internal pointers (in lieu of
giving it a proper copy constructor; see GH-10076) and then tell the
wait completion routine (which is going to be a COOKED_READ, RAW_READ,
DirectRead or WriteData) about the new buffer location.

This is a scoped fix that should be replaced (TODO GH-10076) with a
final one after Ask mode.

Retrieved from https://microsoft.visualstudio.com os.2020 OS official/rs_wdx_dxp_windev eca0875950fd3a9735662474613405e2dc06f485

References GH-10076

Fixes MSFT-33127449
Fixes GH-9692
2021-05-11 16:56:43 +00:00

198 lines
7.4 KiB
C++

// Copyright (c) Microsoft Corporation.
// Licensed under the MIT license.
#include "precomp.h"
#include "readDataDirect.hpp"
#include "dbcs.h"
#include "misc.h"
#include "../interactivity/inc/ServiceLocator.hpp"
// Routine Description:
// - Constructs direct read data class to hold context across sessions
// generally when there's not enough data to return. Also used a bit
// internally to just pass some information along the stack
// (regardless of wait necessity).
// Arguments:
// - pInputBuffer - Buffer that data will be read from.
// - pInputReadHandleData - Context stored across calls from the same
// input handle to return partial data appropriately.
// the user's buffer (pOutRecords)
// - eventReadCount - the number of events to read
// - partialEvents - any partial events already read
// Return Value:
// - THROW: Throws E_INVALIDARG for invalid pointers.
DirectReadData::DirectReadData(_In_ InputBuffer* const pInputBuffer,
_In_ INPUT_READ_HANDLE_DATA* const pInputReadHandleData,
const size_t eventReadCount,
_In_ std::deque<std::unique_ptr<IInputEvent>> partialEvents) :
ReadData(pInputBuffer, pInputReadHandleData),
_eventReadCount{ eventReadCount },
_partialEvents{ std::move(partialEvents) },
_outEvents{}
{
}
// Routine Description:
// - Destructs a read data class.
// - Decrements count of readers waiting on the given handle.
DirectReadData::~DirectReadData()
{
}
// Routine Description:
// - This routine is called to complete a direct read that blocked in
// ReadInputBuffer. The context of the read was saved in the DirectReadData
// structure. This routine is called when events have been written to
// the input buffer. It is called in the context of the writing thread.
// Arguments:
// - TerminationReason - if this routine is called because a ctrl-c or
// ctrl-break was seen, this argument contains CtrlC or CtrlBreak. If
// the owning thread is exiting, it will have ThreadDying. Otherwise 0.
// - fIsUnicode - Should we return UCS-2 unicode data, or should we
// run the final data through the current Input Codepage before
// returning?
// - pReplyStatus - The status code to return to the client
// application that originally called the API (before it was queued to
// wait)
// - pNumBytes - not used
// - pControlKeyState - For certain types of reads, this specifies
// which modifier keys were held.
// - pOutputData - a pointer to a
// std::deque<std::unique_ptr<IInputEvent>> that is used to the read
// input events back to the server
// Return Value:
// - true if the wait is done and result buffer/status code can be sent back to the client.
// - false if we need to continue to wait until more data is available.
bool DirectReadData::Notify(const WaitTerminationReason TerminationReason,
const bool fIsUnicode,
_Out_ NTSTATUS* const pReplyStatus,
_Out_ size_t* const pNumBytes,
_Out_ DWORD* const pControlKeyState,
_Out_ void* const pOutputData)
{
FAIL_FAST_IF_NULL(pOutputData);
FAIL_FAST_IF(_pInputReadHandleData->GetReadCount() == 0);
const CONSOLE_INFORMATION& gci = Microsoft::Console::Interactivity::ServiceLocator::LocateGlobals().getConsoleInformation();
FAIL_FAST_IF(!gci.IsConsoleLocked());
*pReplyStatus = STATUS_SUCCESS;
*pControlKeyState = 0;
*pNumBytes = 0;
bool retVal = true;
std::deque<std::unique_ptr<IInputEvent>> readEvents;
// If ctrl-c or ctrl-break was seen, ignore it.
if (WI_IsAnyFlagSet(TerminationReason, (WaitTerminationReason::CtrlC | WaitTerminationReason::CtrlBreak)))
{
return false;
}
// check if a partial byte is already stored that we should read
if (!fIsUnicode &&
_pInputBuffer->IsReadPartialByteSequenceAvailable() &&
_eventReadCount == 1)
{
_partialEvents.push_back(_pInputBuffer->FetchReadPartialByteSequence(false));
}
// See if called by CsrDestroyProcess or CsrDestroyThread
// via ConsoleNotifyWaitBlock. If so, just decrement the ReadCount and return.
if (WI_IsFlagSet(TerminationReason, WaitTerminationReason::ThreadDying))
{
*pReplyStatus = STATUS_THREAD_IS_TERMINATING;
}
// We must see if we were woken up because the handle is being
// closed. If so, we decrement the read count. If it goes to
// zero, we wake up the close thread. Otherwise, we wake up any
// other thread waiting for data.
else if (WI_IsFlagSet(TerminationReason, WaitTerminationReason::HandleClosing))
{
*pReplyStatus = STATUS_ALERTED;
}
else
{
// if we get to here, this routine was called either by the input
// thread or a write routine. both of these callers grab the
// current console lock.
// calculate how many events we need to read
size_t amountAlreadyRead;
if (FAILED(SizeTAdd(_partialEvents.size(), _outEvents.size(), &amountAlreadyRead)))
{
*pReplyStatus = STATUS_INTEGER_OVERFLOW;
return retVal;
}
size_t amountToRead;
if (FAILED(SizeTSub(_eventReadCount, amountAlreadyRead, &amountToRead)))
{
*pReplyStatus = STATUS_INTEGER_OVERFLOW;
return retVal;
}
*pReplyStatus = _pInputBuffer->Read(readEvents,
amountToRead,
false,
false,
fIsUnicode,
false);
if (*pReplyStatus == CONSOLE_STATUS_WAIT)
{
retVal = false;
}
}
if (*pReplyStatus != CONSOLE_STATUS_WAIT)
{
// split key events to oem chars if necessary
if (*pReplyStatus == STATUS_SUCCESS && !fIsUnicode)
{
try
{
SplitToOem(readEvents);
}
CATCH_LOG();
}
// combine partial and whole events
while (!_partialEvents.empty())
{
readEvents.push_front(std::move(_partialEvents.back()));
_partialEvents.pop_back();
}
// move read events to out storage
for (size_t i = 0; i < _eventReadCount; ++i)
{
if (readEvents.empty())
{
break;
}
_outEvents.push_back(std::move(readEvents.front()));
readEvents.pop_front();
}
// store partial event if necessary
if (!readEvents.empty())
{
_pInputBuffer->StoreReadPartialByteSequence(std::move(readEvents.front()));
readEvents.pop_front();
FAIL_FAST_IF(!(readEvents.empty()));
}
// move events to pOutputData
std::deque<std::unique_ptr<IInputEvent>>* const pOutputDeque = reinterpret_cast<std::deque<std::unique_ptr<IInputEvent>>* const>(pOutputData);
*pNumBytes = _outEvents.size() * sizeof(INPUT_RECORD);
pOutputDeque->swap(_outEvents);
}
return retVal;
}
void DirectReadData::MigrateUserBuffersOnTransitionToBackgroundWait(const void* /*oldBuffer*/, void* /*newBuffer*/)
{
// Direct read doesn't hold API message buffers
}