ntdll: Add a helper function to check that a fault address lies in a known virtual memory view.

dlls/ntdll/ntdll_misc.h

@@ -166,6 +166,7 @@ extern NTSTATUS virtual_create_builtin_view( void *base ) DECLSPEC_HIDDEN;
 extern NTSTATUS virtual_alloc_thread_stack( TEB *teb, SIZE_T reserve_size, SIZE_T commit_size ) DECLSPEC_HIDDEN;
 extern void virtual_clear_thread_stack(void) DECLSPEC_HIDDEN;
 extern BOOL virtual_handle_stack_fault( void *addr ) DECLSPEC_HIDDEN;
+extern BOOL virtual_is_valid_code_address( const void *addr, SIZE_T size ) DECLSPEC_HIDDEN;
 extern NTSTATUS virtual_handle_fault( LPCVOID addr, DWORD err ) DECLSPEC_HIDDEN;
 extern BOOL virtual_check_buffer_for_read( const void *ptr, SIZE_T size ) DECLSPEC_HIDDEN;
 extern BOOL virtual_check_buffer_for_write( void *ptr, SIZE_T size ) DECLSPEC_HIDDEN;

dlls/ntdll/signal_i386.c

@@ -1528,6 +1528,8 @@ static BOOL check_atl_thunk( EXCEPTION_RECORD *rec, CONTEXT *context )
     const struct atl_thunk *thunk = (const struct atl_thunk *)rec->ExceptionInformation[1];
     BOOL ret = FALSE;
 
+    if (!virtual_is_valid_code_address( thunk, sizeof(thunk) )) return FALSE;
+
     __TRY
     {
         if (thunk->movl == 0x042444c7 && thunk->jmp == 0xe9)

dlls/ntdll/virtual.c

@@ -1617,6 +1617,23 @@ NTSTATUS virtual_handle_fault( LPCVOID addr, DWORD err )
 
 
 /***********************************************************************
+ *           virtual_is_valid_code_address
+ */
+BOOL virtual_is_valid_code_address( const void *addr, SIZE_T size )
+{
+    struct file_view *view;
+    BOOL ret = FALSE;
+    sigset_t sigset;
+
+    server_enter_uninterrupted_section( &csVirtual, &sigset );
+    if ((view = VIRTUAL_FindView( addr, size )))
+        ret = !(view->protect & VPROT_SYSTEM);  /* system views are not visible to the app */
+    server_leave_uninterrupted_section( &csVirtual, &sigset );
+    return ret;
+}
+
+
+/***********************************************************************
  *           virtual_handle_stack_fault
  *
  * Handle an access fault inside the current thread stack.