From 216026918d1bf2b8f533cfbea88cbad8a27af189 Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Tue, 29 Mar 2011 09:52:39 +0000
Subject: [PATCH] [WIN32K] Fix parameter check and buffer probing in
 NtUserSetSysColors

svn path=/trunk/; revision=51188
---
 .../subsystems/win32/win32k/ntuser/ntstubs.c  | 25 ++++++++-----------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/reactos/subsystems/win32/win32k/ntuser/ntstubs.c b/reactos/subsystems/win32/win32k/ntuser/ntstubs.c
index 7cdc720cd0a..1ec7f71ca97 100644
--- a/reactos/subsystems/win32/win32k/ntuser/ntstubs.c
+++ b/reactos/subsystems/win32/win32k/ntuser/ntstubs.c
@@ -539,37 +539,34 @@ NtUserSetSysColors(
    FLONG Flags)
 {
    DWORD Ret = TRUE;
-   NTSTATUS Status = STATUS_SUCCESS;
 
    if (cElements == 0)
       return TRUE;
 
+   if ((ULONG)cElements >= 0x40000000)
+      return FALSE;
+
    UserEnterExclusive();
+
    _SEH2_TRY
    {
-      ProbeForRead(lpaElements,
-                   sizeof(INT),
-                   1);
-      ProbeForRead(lpaRgbValues,
-                   sizeof(COLORREF),
-                   1);
-// Developers: We are thread locked and calling gdi.
+      ProbeForRead(lpaElements, cElements * sizeof(INT), 1);
+      ProbeForRead(lpaRgbValues, cElements * sizeof(COLORREF), 1);
+
       IntSetSysColors(cElements, lpaElements, lpaRgbValues);
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
-      Status = _SEH2_GetExceptionCode();
-   }
-   _SEH2_END;
-   if (!NT_SUCCESS(Status))
-   {
-      SetLastNtError(Status);
+      SetLastNtError(_SEH2_GetExceptionCode());
       Ret = FALSE;
    }
+   _SEH2_END;
+
    if (Ret)
    {
       UserSendNotifyMessage(HWND_BROADCAST, WM_SYSCOLORCHANGE, 0, 0);
    }
+
    UserLeave();
    return Ret;
 }