setupapi: Add magic bytes to struct file_queue and validate them in SetupCloseFileQueue().

dlls/setupapi/queue.c

@@ -79,6 +79,7 @@ struct file_op_queue
 
 struct file_queue
 {
+    DWORD magic;
     struct file_op_queue copy_queue;
     struct file_op_queue delete_queue;
     struct file_op_queue rename_queue;
@@ -87,6 +88,7 @@ struct file_queue
     unsigned int source_count;
 };
 
+#define FILE_QUEUE_MAGIC 0x21514653
 
 /* append a file operation to a queue */
 static inline void queue_file_op( struct file_op_queue *queue, struct file_op *op )
@@ -434,6 +436,7 @@ HSPFILEQ WINAPI SetupOpenFileQueue(void)
 
     if (!(queue = HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(*queue))))
         return INVALID_HANDLE_VALUE;
+    queue->magic = FILE_QUEUE_MAGIC;
     return queue;
 }
 
@@ -446,6 +449,14 @@ BOOL WINAPI SetupCloseFileQueue( HSPFILEQ handle )
     struct file_queue *queue = handle;
     unsigned int i;
 
+    /* Windows XP DDK installer passes the handle returned from
+     * SetupInitDefaultQueueCallback() to this function. */
+    if (queue->magic != FILE_QUEUE_MAGIC)
+    {
+        SetLastError(ERROR_INVALID_HANDLE);
+        return FALSE;
+    }
+
     free_file_op_queue( &queue->copy_queue );
     free_file_op_queue( &queue->rename_queue );
     free_file_op_queue( &queue->delete_queue );

dlls/setupapi/tests/install.c

@@ -1815,6 +1815,21 @@ static void test_need_media(void)
     ok(ret, "Failed to delete INF file, error %u.\n", GetLastError());
 }
 
+static void test_close_queue(void)
+{
+    void *context;
+    BOOL ret;
+
+    context = SetupInitDefaultQueueCallback(NULL);
+    ok(!!context, "Failed to create callback context, error %#x.\n", GetLastError());
+
+    ret = SetupCloseFileQueue(context);
+    ok(!ret, "Expected failure.\n");
+    ok(GetLastError() == ERROR_INVALID_HANDLE, "Got unexpected error %u.\n", GetLastError());
+
+    SetupTermDefaultQueueCallback(context);
+}
+
 START_TEST(install)
 {
     char temp_path[MAX_PATH], prev_path[MAX_PATH];
@@ -1841,6 +1856,7 @@ START_TEST(install)
     test_dirid();
     test_install_files_queue();
     test_need_media();
+    test_close_queue();
 
     UnhookWindowsHookEx(hhook);