Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-04-22 13:10:39 +00:00
Code Issues Projects Releases Packages Wiki Activity

[WIN32K]

Browse source 
- Correctly treat nLengthNeeded as optional in NtUserGetObjectInformation, and access it only within SEH. Fixes crash in user32_winetest:winstation
CORE-8094

svn path=/trunk/; revision=62963
This commit is contained in:
Thomas Faber 2014-04-25 11:23:16 +00:00
parent ebd14e9811
commit 49be9c0033
1 changed files with 33 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
reactos/win32ss/user/ntuser/winsta.c
View file

@ -641,6 +641,19 @@ NtUserGetObjectInformation(
PVOID pvData = NULL; PVOID pvData = NULL;
DWORD nDataSize = 0; DWORD nDataSize = 0;
_SEH2_TRY
{
if (nLengthNeeded)
ProbeForWrite(nLengthNeeded, sizeof(*nLengthNeeded), 1);
ProbeForWrite(pvInformation, nLength, 1);
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
SetLastNtError(_SEH2_GetExceptionCode());
return FALSE;
}
_SEH2_END;
/* try windowstation */ /* try windowstation */
TRACE("Trying to open window station %p\n", hObject); TRACE("Trying to open window station %p\n", hObject);
Status = ObReferenceObjectByHandle( Status = ObReferenceObjectByHandle(
@ -665,8 +678,7 @@ NtUserGetObjectInformation(
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {
ERR("Failed: 0x%x\n", Status); ERR("Failed: 0x%x\n", Status);
SetLastNtError(Status); goto Exit;
return FALSE;
} }
TRACE("WinSta or Desktop opened!!\n"); TRACE("WinSta or Desktop opened!!\n");
@ -723,16 +735,27 @@ NtUserGetObjectInformation(
break; break;
} }
Exit:
_SEH2_TRY
{
if (nLengthNeeded)
*nLengthNeeded = nDataSize;
/* try to copy data to caller */ /* try to copy data to caller */
if (Status == STATUS_SUCCESS) if (Status == STATUS_SUCCESS)
{ {
TRACE("Trying to copy data to caller (len = %lu, len needed = %lu)\n", nLength, nDataSize); TRACE("Trying to copy data to caller (len = %lu, len needed = %lu)\n", nLength, nDataSize);
*nLengthNeeded = nDataSize;
if (nLength >= nDataSize) if (nLength >= nDataSize)
Status = MmCopyToCaller(pvInformation, pvData, nDataSize); RtlCopyMemory(pvInformation, pvData, nDataSize);
else else
Status = STATUS_BUFFER_TOO_SMALL; Status = STATUS_BUFFER_TOO_SMALL;
} }
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
Status = _SEH2_GetExceptionCode();
}
_SEH2_END;
/* release objects */ /* release objects */
if (WinStaObject != NULL) if (WinStaObject != NULL)