diff --git a/reactos/lib/user32/windows/cursor.c b/reactos/lib/user32/windows/cursor.c
index 245d8692901..f20d34a0c3f 100644
--- a/reactos/lib/user32/windows/cursor.c
+++ b/reactos/lib/user32/windows/cursor.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: cursor.c,v 1.12 2003/08/29 08:46:20 weiden Exp $
+/* $Id: cursor.c,v 1.13 2003/09/24 21:09:22 weiden Exp $
  *
  * PROJECT:         ReactOS user32.dll
  * FILE:            lib/user32/windows/cursor.c
@@ -94,20 +94,7 @@ DestroyCursor(HCURSOR hCursor)
 WINBOOL STDCALL
 GetClipCursor(LPRECT lpRect)
 {
-  RECT rc;
-  WINBOOL res;
-  
-  if(!lpRect)
-  {
-    SetLastError(ERROR_NOACCESS);
-    return FALSE;
-  }
-  
-  RtlCopyMemory(&rc, lpRect, sizeof(RECT));
-  res = NtUserGetClipCursor(&rc);
-  RtlCopyMemory(lpRect, &rc, sizeof(RECT));
-  
-  return res;
+  return NtUserGetClipCursor(lpRect);
 }
 
 
@@ -139,7 +126,6 @@ GetCursorInfo(PCURSORINFO pci)
 WINBOOL STDCALL
 GetCursorPos(LPPOINT lpPoint)
 {
-  POINT pos;
   WINBOOL res;
   /* Windows doesn't check if lpPoint == NULL, we do */
   if(!lpPoint)
@@ -148,13 +134,9 @@ GetCursorPos(LPPOINT lpPoint)
     return FALSE;
   }
   
-  res = (WINBOOL)NtUserCallTwoParam((DWORD)&pos, (DWORD)FALSE, 
+  res = (WINBOOL)NtUserCallTwoParam((DWORD)lpPoint, (DWORD)FALSE, 
                                     TWOPARAM_ROUTINE_CURSORPOSITION);
-  if(res)
-  {
-    lpPoint->x = pos.x;
-    lpPoint->y = pos.y;
-  }
+
   return res;
 }
 
diff --git a/reactos/subsys/win32k/ntuser/misc.c b/reactos/subsys/win32k/ntuser/misc.c
index 59c6b280466..c86a2597b54 100644
--- a/reactos/subsys/win32k/ntuser/misc.c
+++ b/reactos/subsys/win32k/ntuser/misc.c
@@ -1,4 +1,4 @@
-/* $Id: misc.c,v 1.17 2003/09/13 13:58:38 weiden Exp $
+/* $Id: misc.c,v 1.18 2003/09/24 21:09:22 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -12,6 +12,7 @@
 #include <ddk/ntddmou.h>
 #include <win32k/win32k.h>
 #include <win32k/dc.h>
+#include <internal/safe.h>
 #include <include/error.h>
 #include <include/window.h>
 #include <include/painting.h>
@@ -134,7 +135,7 @@ NtUserCallTwoParam(
   PWINDOW_OBJECT WindowObject;
   PSYSTEM_CURSORINFO CurInfo;
   PWINSTATION_OBJECT WinStaObject;
-  PPOINT Pos;
+  POINT Pos;
   
   switch(Routine)
   {
@@ -179,20 +180,26 @@ NtUserCallTwoParam(
                                            &WinStaObject);
       if (!NT_SUCCESS(Status))
         return (DWORD)FALSE;
-        
-      Pos = (PPOINT)Param1;
       
       if(Param2)
       {
         /* set cursor position */
         
+        Status = MmCopyFromCaller(&Pos, (PPOINT)Param1, sizeof(POINT));
+        if(!NT_SUCCESS(Status))
+        {
+          ObDereferenceObject(WinStaObject);
+          SetLastNtError(Status);
+          return FALSE;
+        }
+        
         CurInfo = &WinStaObject->SystemCursor;
         /* FIXME - check if process has WINSTA_WRITEATTRIBUTES */
         
         //CheckClipCursor(&Pos->x, &Pos->y, CurInfo);  
-        if((Pos->x != CurInfo->x) || (Pos->y != CurInfo->y))
+        if((Pos.x != CurInfo->x) || (Pos.y != CurInfo->y))
         {
-          MouseMoveCursor(Pos->x, Pos->y);
+          MouseMoveCursor(Pos.x, Pos.y);
         }
 
       }
@@ -200,8 +207,17 @@ NtUserCallTwoParam(
       {
         /* get cursor position */
         /* FIXME - check if process has WINSTA_READATTRIBUTES */
-        Pos->x = WinStaObject->SystemCursor.x;
-        Pos->y = WinStaObject->SystemCursor.y;
+        Pos.x = WinStaObject->SystemCursor.x;
+        Pos.y = WinStaObject->SystemCursor.y;
+        
+        Status = MmCopyToCaller((PPOINT)Param1, &Pos, sizeof(POINT));
+        if(!NT_SUCCESS(Status))
+        {
+          ObDereferenceObject(WinStaObject);
+          SetLastNtError(Status);
+          return FALSE;
+        }
+        
       }
       
       ObDereferenceObject(WinStaObject);
@@ -235,6 +251,7 @@ NtUserSystemParametersInfo(
     0, 0, DEFAULT_QUALITY, FF_MODERN, L"Bitstream Vera Sans Bold" };*/
   NTSTATUS Status;
   PWINSTATION_OBJECT WinStaObject;
+  RECT Rect;
   
   switch(uiAction)
   {
@@ -271,19 +288,34 @@ NtUserSystemParametersInfo(
 
     case SPI_GETWORKAREA:
       {
-        ((PRECT)pvParam)->left = 0;
-        ((PRECT)pvParam)->top = 0;
-        ((PRECT)pvParam)->right = 640;
-        ((PRECT)pvParam)->bottom = 480;
+        /* FIXME */
+        Rect.left = 0;
+        Rect.top = 0;
+        Rect.right = 640;
+        Rect.bottom = 480;
+        
+        Status = MmCopyToCaller((PRECT)pvParam, &Rect, sizeof(RECT));
+        if(!NT_SUCCESS(Status))
+        {
+          SetLastNtError(Status);
+          return FALSE;
+        }
+        
         return TRUE;
       }
     case SPI_GETICONTITLELOGFONT:
       {
-        memcpy(pvParam, &CaptionFont, sizeof(CaptionFont));
+        Status = MmCopyToCaller(pvParam, &CaptionFont, sizeof(CaptionFont));
+        if(!NT_SUCCESS(Status))
+        {
+          SetLastNtError(Status);
+          return FALSE;
+        }
         return TRUE;
       }
     case SPI_GETNONCLIENTMETRICS:
       {
+        /* FIXME - use MmCopyToCaller() !!! */
         LPNONCLIENTMETRICSW pMetrics = (LPNONCLIENTMETRICSW)pvParam;
     
         if (pMetrics->cbSize != sizeof(NONCLIENTMETRICSW) || 
diff --git a/reactos/subsys/win32k/objects/cursoricon.c b/reactos/subsys/win32k/objects/cursoricon.c
index f0e2f3f5131..7778afff593 100644
--- a/reactos/subsys/win32k/objects/cursoricon.c
+++ b/reactos/subsys/win32k/objects/cursoricon.c
@@ -326,14 +326,16 @@ NtUserGetClipCursor(
   /* FIXME - check if process has WINSTA_READATTRIBUTES */
   
   PWINSTATION_OBJECT WinStaObject;
+  RECT Rect;
+  NTSTATUS Status;
   
   if(!lpRect)
     return FALSE;
 
-  NTSTATUS Status = ValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				       KernelMode,
-				       0,
-				       &WinStaObject);
+  Status = ValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+	       KernelMode,
+	       0,
+	       &WinStaObject);
   if (!NT_SUCCESS(Status))
   {
     DPRINT("Validation of window station handle (0x%X) failed\n",
@@ -344,17 +346,25 @@ NtUserGetClipCursor(
   
   if(WinStaObject->SystemCursor.CursorClipInfo.IsClipped)
   {
-    lpRect->left = WinStaObject->SystemCursor.CursorClipInfo.Left;
-    lpRect->top = WinStaObject->SystemCursor.CursorClipInfo.Top;
-    lpRect->right = WinStaObject->SystemCursor.CursorClipInfo.Right;
-    lpRect->bottom = WinStaObject->SystemCursor.CursorClipInfo.Bottom;
+    Rect.left = WinStaObject->SystemCursor.CursorClipInfo.Left;
+    Rect.top = WinStaObject->SystemCursor.CursorClipInfo.Top;
+    Rect.right = WinStaObject->SystemCursor.CursorClipInfo.Right;
+    Rect.bottom = WinStaObject->SystemCursor.CursorClipInfo.Bottom;
   }
   else
   {
-    lpRect->left = 0;
-    lpRect->top = 0;
-    lpRect->right = NtUserGetSystemMetrics(SM_CXSCREEN);
-    lpRect->bottom = NtUserGetSystemMetrics(SM_CYSCREEN);
+    Rect.left = 0;
+    Rect.top = 0;
+    Rect.right = NtUserGetSystemMetrics(SM_CXSCREEN);
+    Rect.bottom = NtUserGetSystemMetrics(SM_CYSCREEN);
+  }
+  
+  Status = MmCopyToCaller((PRECT)lpRect, &Rect, sizeof(RECT));
+  if(!NT_SUCCESS(Status))
+  {
+    ObDereferenceObject(WinStaObject);
+    SetLastNtError(Status);
+    return FALSE;
   }
     
   ObDereferenceObject(WinStaObject);