From 813d9cd2ccac9f2539c8fbdec29a0d08c9b7f922 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Gardou?= <jerome.gardou@reactos.org>
Date: Fri, 18 Jun 2021 12:43:53 +0200
Subject: [PATCH] [WIN32K:NTUSER] Do not pass NULL keyboard layout to
 IntToUnicodeEx

There's an ASSERT on that
---
 win32ss/user/ntuser/keyboard.c | 37 +++++++++++++++++++++++++---------
 1 file changed, 28 insertions(+), 9 deletions(-)

diff --git a/win32ss/user/ntuser/keyboard.c b/win32ss/user/ntuser/keyboard.c
index 20673f95c7b..b4ff7805b86 100644
--- a/win32ss/user/ntuser/keyboard.c
+++ b/win32ss/user/ntuser/keyboard.c
@@ -1105,7 +1105,7 @@ UserProcessKeyboardInput(
         if (wVk & KBDEXT)
             KbdInput.dwFlags |= KEYEVENTF_EXTENDEDKEY;
         //
-        // Based on wine input:test_Input_blackbox this is okay. It seems the 
+        // Based on wine input:test_Input_blackbox this is okay. It seems the
         // bit did not get set and more research is needed. Now the right
         // shift works.
         //
@@ -1341,6 +1341,7 @@ NtUserToUnicodeEx(
     PWCHAR pwszBuff = NULL;
     INT i, iRet = 0;
     PKL pKl = NULL;
+    NTSTATUS Status;
 
     TRACE("Enter NtUserSetKeyboardState\n");
 
@@ -1390,17 +1391,35 @@ NtUserToUnicodeEx(
         pKl = pti->KeyboardLayout;
     }
 
-    iRet = IntToUnicodeEx(wVirtKey,
-                          wScanCode,
-                          afKeyState,
-                          pwszBuff,
-                          cchBuff,
-                          wFlags,
-                          pKl ? pKl->spkf->pKbdTbl : NULL);
+    if (pKl)
+    {
+        iRet = IntToUnicodeEx(wVirtKey,
+                            wScanCode,
+                            afKeyState,
+                            pwszBuff,
+                            cchBuff,
+                            wFlags,
+                            pKl->spkf->pKbdTbl);
+
+        if (iRet)
+        {
+            Status = MmCopyToCaller(pwszBuffUnsafe, pwszBuff, cchBuff * sizeof(WCHAR));
+        }
+    }
+    else
+    {
+        ERR("No keyboard layout ?!\n");
+        Status = STATUS_INVALID_HANDLE;
+    }
 
-    MmCopyToCaller(pwszBuffUnsafe, pwszBuff, cchBuff * sizeof(WCHAR));
     ExFreePoolWithTag(pwszBuff, TAG_STRING);
 
+    if (!NT_SUCCESS(Status))
+    {
+        iRet = 0;
+        SetLastNtError(Status);
+    }
+
     UserLeave();
     TRACE("Leave NtUserSetKeyboardState, ret=%i\n", iRet);
     return iRet;