[WIN32SS/USER]

- Handle transferring buffer to user mode in WH_CALLWNDPROC(RET) hooks if lParam is a pointer.
This fixes the gallium3d opengl ICD, so newest VMWare opengl Driver should now work.
Please TEST!

svn path=/trunk/; revision=56931

reactos/win32ss/user/ntuser/callback.c

@@ -13,6 +13,7 @@
 #include <win32k.h>
 DBG_DEFAULT_CHANNEL(UserCallback);
 
+
 /* CALLBACK MEMORY MANAGEMENT ************************************************/
 
 typedef struct _INT_CALLBACK_HEADER
@@ -443,6 +444,7 @@ co_IntCallHookProc(INT HookId,
    PWND pWnd;
    PMSG pMsg = NULL;
    BOOL Hit = FALSE;
+   UINT lParamSize = 0;
 
    ASSERT(Proc);
 
@@ -509,11 +511,21 @@ co_IntCallHookProc(INT HookId,
          ArgumentLength += sizeof(MOUSEHOOKSTRUCT);
          break;
      case WH_CALLWNDPROC:
+     {
+         CWPSTRUCT* pCWP = (CWPSTRUCT*) lParam;
          ArgumentLength += sizeof(CWPSTRUCT);
+         lParamSize = lParamMemorySize(pCWP->message, pCWP->wParam, pCWP->lParam);
+         ArgumentLength += lParamSize;
          break;
+      }
       case WH_CALLWNDPROCRET:
+      {
+         CWPRETSTRUCT* pCWPR = (CWPRETSTRUCT*) lParam;
          ArgumentLength += sizeof(CWPRETSTRUCT);
+         lParamSize = lParamMemorySize(pCWPR->message, pCWPR->wParam, pCWPR->lParam);
+         ArgumentLength += lParamSize;
          break;
+      }
       case WH_MSGFILTER:
       case WH_SYSMSGFILTER:
       case WH_GETMESSAGE:
@@ -583,12 +595,25 @@ co_IntCallHookProc(INT HookId,
          Common->lParam = (LPARAM) (Extra - (PCHAR) Common);
          break;
       case WH_CALLWNDPROC:
+         /* For CALLWNDPROC and CALLWNDPROCRET, we must be wary of the fact that
+          * lParam could be a pointer to a buffer. This buffer must be exported
+          * to user space too */
          RtlCopyMemory(Extra, (PVOID) lParam, sizeof(CWPSTRUCT));
          Common->lParam = (LPARAM) (Extra - (PCHAR) Common);
+         if(lParamSize)
+         {
+             RtlCopyMemory(Extra + sizeof(CWPSTRUCT), (PVOID)((CWPSTRUCT*)lParam)->lParam, lParamSize);
+             ((CWPSTRUCT*)Extra)->lParam = (LPARAM)lParamSize;
+         }
          break;
       case WH_CALLWNDPROCRET:
          RtlCopyMemory(Extra, (PVOID) lParam, sizeof(CWPRETSTRUCT));
          Common->lParam = (LPARAM) (Extra - (PCHAR) Common);
+         if(lParamSize)
+         {
+             RtlCopyMemory(Extra + sizeof(CWPRETSTRUCT), (PVOID)((CWPRETSTRUCT*)lParam)->lParam, lParamSize);
+             ((CWPRETSTRUCT*)Extra)->lParam = (LPARAM)lParamSize;
+         }
          break;
       case WH_MSGFILTER:
       case WH_SYSMSGFILTER:

reactos/win32ss/user/ntuser/message.c

@@ -223,6 +223,13 @@ MsgMemorySize(PMSGMEMORY MsgMemoryEntry, WPARAM wParam, LPARAM lParam)
     return Size;
 }
 
+UINT lParamMemorySize(UINT Msg, WPARAM wParam, LPARAM lParam)
+{
+    PMSGMEMORY MsgMemory = FindMsgMemory(Msg);
+    if(MsgMemory == NULL) return 0;
+    return MsgMemorySize(MsgMemory, wParam, lParam);
+}
+
 static NTSTATUS
 PackParam(LPARAM *lParamPacked, UINT Msg, WPARAM wParam, LPARAM lParam, BOOL NonPagedPoolNeeded)
 {

reactos/win32ss/user/ntuser/msgqueue.h

@@ -296,4 +296,6 @@ UserSetCursor(PCURICON_OBJECT NewCursor,
               BOOL ForceChange);
 
 DWORD APIENTRY IntGetQueueStatus(DWORD);
+
+UINT lParamMemorySize(UINT Msg, WPARAM wParam, LPARAM lParam);
 /* EOF */

reactos/win32ss/user/user32/windows/hook.c

@@ -558,8 +558,8 @@ User32CallHookProcFromKernel(PVOID Arguments, ULONG ArgumentLength)
   MSLLHOOKSTRUCT MouseLlData, *pMouseLlData;
   MSG *pcMsg, *pMsg;
   PMOUSEHOOKSTRUCT pMHook;
-  CWPSTRUCT CWP, *pCWP;
-  CWPRETSTRUCT CWPR, *pCWPR;
+  CWPSTRUCT *pCWP;
+  CWPRETSTRUCT *pCWPR;
   PRECTL prl;
   LPCBTACTIVATESTRUCT pcbtas;
   WPARAM wParam = 0;
@@ -666,14 +666,34 @@ User32CallHookProcFromKernel(PVOID Arguments, ULONG ArgumentLength)
       break;
     case WH_CALLWNDPROC:
 //      ERR("WH_CALLWNDPROC: Code %d, wParam %d\n",Common->Code,Common->wParam);
-      pCWP = (PCWPSTRUCT)((PCHAR) Common + Common->lParam);
-      RtlCopyMemory(&CWP, pCWP, sizeof(CWPSTRUCT));
-      Result = Common->Proc(Common->Code, Common->wParam, (LPARAM) &CWP);
+      pCWP = HeapAlloc(GetProcessHeap(), 0, ArgumentLength - sizeof(HOOKPROC_CALLBACK_ARGUMENTS));
+      RtlCopyMemory(pCWP, (PCHAR) Common + Common->lParam, sizeof(CWPSTRUCT));
+      /* If more memory is reserved, then lParam is a pointer.
+       * Size of the buffer is stocked in the lParam member, and its content
+       * is at the end of the argument buffer */
+      if(ArgumentLength > (sizeof(CWPSTRUCT) + sizeof(HOOKPROC_CALLBACK_ARGUMENTS)))
+      {
+         RtlCopyMemory((PCHAR)pCWP + sizeof(CWPSTRUCT),
+            (PCHAR)Common + Common->lParam + sizeof(CWPSTRUCT),
+            pCWP->lParam);
+         pCWP->lParam = (LPARAM)((PCHAR)pCWP + sizeof(CWPSTRUCT));
+      }
+      Result = Common->Proc(Common->Code, Common->wParam, (LPARAM) pCWP);
+      HeapFree(GetProcessHeap(), 0, pCWP);
       break;
     case WH_CALLWNDPROCRET:
-      pCWPR = (PCWPRETSTRUCT)((PCHAR) Common + Common->lParam);
-      RtlCopyMemory(&CWPR, pCWPR, sizeof(CWPRETSTRUCT));
-      Result = Common->Proc(Common->Code, Common->wParam, (LPARAM) &CWPR);
+      /* Almost the same as WH_CALLWNDPROC */
+      pCWPR = HeapAlloc(GetProcessHeap(), 0, ArgumentLength - sizeof(HOOKPROC_CALLBACK_ARGUMENTS));
+      RtlCopyMemory(pCWPR, (PCHAR) Common + Common->lParam, sizeof(CWPRETSTRUCT));
+      if(ArgumentLength > (sizeof(CWPRETSTRUCT) + sizeof(HOOKPROC_CALLBACK_ARGUMENTS)))
+      {
+         RtlCopyMemory((PCHAR)pCWPR + sizeof(CWPRETSTRUCT),
+            (PCHAR)Common + Common->lParam + sizeof(CWPRETSTRUCT),
+            pCWPR->lParam);
+         pCWPR->lParam = (LPARAM)((PCHAR)pCWPR + sizeof(CWPRETSTRUCT));
+      }
+      Result = Common->Proc(Common->Code, Common->wParam, (LPARAM) pCWPR);
+      HeapFree(GetProcessHeap(), 0, pCWPR);
       break;
     case WH_MSGFILTER: /* All SEH support */
     case WH_SYSMSGFILTER: