Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-04-20 12:29:56 +00:00
Code Issues Projects Releases Packages Wiki Activity

[WIN32K]

Browse source 
- Correctly treat nLengthNeeded as optional in NtUserGetObjectInformation, and access it only within SEH. Fixes crash in user32_winetest:winstation
CORE-8094

svn path=/trunk/; revision=62963
This commit is contained in:
Thomas Faber 2014-04-25 11:23:16 +00:00
parent ebd14e9811
commit 49be9c0033
1 changed files with 33 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

43
reactos/win32ss/user/ntuser/winsta.c
View file

@ -641,6 +641,19 @@ NtUserGetObjectInformation(
PVOID pvData = NULL;
DWORD nDataSize = 0;
_SEH2_TRY
{
if (nLengthNeeded)
ProbeForWrite(nLengthNeeded, sizeof(*nLengthNeeded), 1);
ProbeForWrite(pvInformation, nLength, 1);
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
SetLastNtError(_SEH2_GetExceptionCode());
return FALSE;
}
_SEH2_END;
/* try windowstation */
TRACE("Trying to open window station %p\n", hObject);
Status = ObReferenceObjectByHandle(
@ -665,8 +678,7 @@ NtUserGetObjectInformation(
if (!NT_SUCCESS(Status))
{
ERR("Failed: 0x%x\n", Status);
SetLastNtError(Status);
return FALSE;
goto Exit;
}
TRACE("WinSta or Desktop opened!!\n");
@ -723,16 +735,27 @@ NtUserGetObjectInformation(
break;
}
/* try to copy data to caller */
if (Status == STATUS_SUCCESS)
Exit:
_SEH2_TRY
{
TRACE("Trying to copy data to caller (len = %lu, len needed = %lu)\n", nLength, nDataSize);
*nLengthNeeded = nDataSize;
if (nLength >= nDataSize)
Status = MmCopyToCaller(pvInformation, pvData, nDataSize);
else
Status = STATUS_BUFFER_TOO_SMALL;
if (nLengthNeeded)
*nLengthNeeded = nDataSize;
/* try to copy data to caller */
if (Status == STATUS_SUCCESS)
{
TRACE("Trying to copy data to caller (len = %lu, len needed = %lu)\n", nLength, nDataSize);
if (nLength >= nDataSize)
RtlCopyMemory(pvInformation, pvData, nDataSize);
else
Status = STATUS_BUFFER_TOO_SMALL;
}
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
Status = _SEH2_GetExceptionCode();
}
_SEH2_END;
/* release objects */
if (WinStaObject != NULL)