Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-02-24 09:25:10 +00:00
Code Issues Projects Releases Packages Wiki Activity

Copying the string in NtUserDefSetText () must be protected with SEH, probing alone is not sufficient.

Browse source 
svn path=/trunk/; revision=38572
This commit is contained in:
Thomas Bluemel 2009-01-04 22:20:19 +00:00
parent bd38886763
commit 84d1b53dbc
1 changed files with 31 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
reactos/subsystems/win32/win32k/ntuser/window.c
View file

@ -4577,12 +4577,21 @@ NtUserDefSetText(HWND hWnd, PUNICODE_STRING WindowText)
{
ASSERT(Wnd->WindowName.Buffer != NULL);
_SEH2_TRY
{
Wnd->WindowName.Length = SafeText.Length;
Wnd->WindowName.Buffer[SafeText.Length / sizeof(WCHAR)] = L'\0';
RtlCopyMemory(Wnd->WindowName.Buffer,
SafeText.Buffer,
SafeText.Length);
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
Ret = FALSE;
SetLastNtError(_SEH2_GetExceptionCode());
}
_SEH2_END;
}
else
{
PWCHAR buf;
@ -4597,6 +4606,8 @@ NtUserDefSetText(HWND hWnd, PUNICODE_STRING WindowText)
Wnd->WindowName.Buffer = DesktopHeapAlloc(Wnd->pdesktop,
SafeText.Length + sizeof(UNICODE_NULL));
if (Wnd->WindowName.Buffer != NULL)
{
_SEH2_TRY
{
Wnd->WindowName.Buffer[SafeText.Length / sizeof(WCHAR)] = L'\0';
RtlCopyMemory(Wnd->WindowName.Buffer,
@ -4605,6 +4616,15 @@ NtUserDefSetText(HWND hWnd, PUNICODE_STRING WindowText)
Wnd->WindowName.MaximumLength = SafeText.Length + sizeof(UNICODE_NULL);
Wnd->WindowName.Length = SafeText.Length;
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
Wnd->WindowName.Buffer = NULL;
DesktopHeapFree(Wnd->pdesktop, Wnd->WindowName.Buffer);
Ret = FALSE;
SetLastNtError(_SEH2_GetExceptionCode());
}
_SEH2_END;
}
else
{
SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);