Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-08-25 04:38:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed a crash caused by requesting a large number of extra class space

Browse source 
svn path=/trunk/; revision=8976
This commit is contained in:
Thomas Bluemel 2004-04-05 14:42:30 +00:00
parent c78a2cfb83
commit 0c33860003
1 changed files with 32 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
reactos/subsys/win32k/ntuser/class.c
View file

@ -16,7 +16,7 @@
* along with this program; if not, write to the Free Software * along with this program; if not, write to the Free Software
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/ */
/* $Id: class.c,v 1.49 2004/03/09 21:21:39 dwelch Exp $ /* $Id: class.c,v 1.50 2004/04/05 14:42:30 weiden Exp $
* *
* COPYRIGHT: See COPYING in the top level directory * COPYRIGHT: See COPYING in the top level directory
* PROJECT: ReactOS kernel * PROJECT: ReactOS kernel
@ -39,6 +39,7 @@
#include <include/window.h> #include <include/window.h>
#include <include/color.h> #include <include/color.h>
#include <include/tags.h> #include <include/tags.h>
#include <internal/safe.h>
#define NDEBUG #define NDEBUG
#include <debug.h> #include <debug.h>
@ -273,7 +274,7 @@ IntCreateClass(CONST WNDCLASSEXW *lpwcx,
RTL_ATOM Atom) RTL_ATOM Atom)
{ {
PWNDCLASS_OBJECT ClassObject; PWNDCLASS_OBJECT ClassObject;
WORD objectSize; ULONG objectSize;
NTSTATUS Status; NTSTATUS Status;
/* Check for double registration of the class. */ /* Check for double registration of the class. */
@ -343,7 +344,7 @@ IntCreateClass(CONST WNDCLASSEXW *lpwcx,
if (ClassObject->cbClsExtra != 0) if (ClassObject->cbClsExtra != 0)
{ {
ClassObject->ExtraData = (PCHAR)(ClassObject + 1); ClassObject->ExtraData = (PCHAR)(ClassObject + 1);
RtlZeroMemory(ClassObject->ExtraData, ClassObject->cbClsExtra); RtlZeroMemory(ClassObject->ExtraData, (ULONG)ClassObject->cbClsExtra);
} }
else else
{ {
@ -373,10 +374,32 @@ NtUserRegisterClassExWOW(
* Atom identifying the new class * Atom identifying the new class
*/ */
{ {
WNDCLASSEXW SafeClass;
PWINSTATION_OBJECT WinStaObject; PWINSTATION_OBJECT WinStaObject;
PWNDCLASS_OBJECT ClassObject; PWNDCLASS_OBJECT ClassObject;
NTSTATUS Status; NTSTATUS Status;
RTL_ATOM Atom; RTL_ATOM Atom;
if(!lpwcx)
{
SetLastWin32Error(ERROR_INVALID_PARAMETER);
return (RTL_ATOM)0;
}
Status = MmCopyFromCaller(&SafeClass, lpwcx, sizeof(WNDCLASSEXW));
if (!NT_SUCCESS(Status))
{
SetLastNtError(Status);
return (RTL_ATOM)0;
}
/* Deny negative sizes */
if(lpwcx->cbClsExtra < 0 || lpwcx->cbWndExtra < 0)
{
SetLastWin32Error(ERROR_INVALID_PARAMETER);
return (RTL_ATOM)0;
}
DPRINT("About to open window station handle (0x%X)\n", DPRINT("About to open window station handle (0x%X)\n",
PROCESS_WINDOW_STATION()); PROCESS_WINDOW_STATION());
Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(), Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
@ -389,10 +412,11 @@ NtUserRegisterClassExWOW(
PROCESS_WINDOW_STATION()); PROCESS_WINDOW_STATION());
return((RTL_ATOM)0); return((RTL_ATOM)0);
} }
if (!IS_ATOM(lpwcx->lpszClassName)) if (!IS_ATOM(SafeClass.lpszClassName))
{ {
/* FIXME - Safely copy/verify the buffer first!!! */
Status = RtlAddAtomToAtomTable(WinStaObject->AtomTable, Status = RtlAddAtomToAtomTable(WinStaObject->AtomTable,
(LPWSTR)lpwcx->lpszClassName, (LPWSTR)SafeClass.lpszClassName,
&Atom); &Atom);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {
@ -405,12 +429,12 @@ NtUserRegisterClassExWOW(
} }
else else
{ {
Atom = (RTL_ATOM)(ULONG)lpwcx->lpszClassName; Atom = (RTL_ATOM)(ULONG)SafeClass.lpszClassName;
} }
ClassObject = IntCreateClass(lpwcx, bUnicodeClass, wpExtra, Atom); ClassObject = IntCreateClass(&SafeClass, bUnicodeClass, wpExtra, Atom);
if (ClassObject == NULL) if (ClassObject == NULL)
{ {
if (!IS_ATOM(lpwcx->lpszClassName)) if (!IS_ATOM(SafeClass.lpszClassName))
{ {
RtlDeleteAtomFromAtomTable(WinStaObject->AtomTable, Atom); RtlDeleteAtomFromAtomTable(WinStaObject->AtomTable, Atom);
} }