From 9aafcccad63e3a867d012054cf43cb4f38619199 Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Tue, 6 May 2008 20:09:34 +0000
Subject: [PATCH] rename 2nd parameter of NtUserGetClipboardData from Unknown1
 to pBuffer. Use SEH to copy data.

svn path=/trunk/; revision=33329
---
 reactos/include/reactos/win32k/ntuser.h       |  4 +-
 .../win32/win32k/ntuser/clipboard.c           | 39 +++++++++++++------
 2 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/reactos/include/reactos/win32k/ntuser.h b/reactos/include/reactos/win32k/ntuser.h
index 4dd7f32f768..6b61b580a20 100644
--- a/reactos/include/reactos/win32k/ntuser.h
+++ b/reactos/include/reactos/win32k/ntuser.h
@@ -1169,7 +1169,7 @@ HANDLE
 NTAPI
 NtUserGetClipboardData(
   UINT uFormat,
-  DWORD Unknown1);
+  PVOID pBuffer);
 
 INT
 NTAPI
@@ -1614,7 +1614,7 @@ NtUserMapVirtualKeyEx( UINT keyCode,
 
 #define NUMC_SENDMESSAGE            0x02B0
 // Kernel has option to use TO or normal msg send, based on type of msg.
-#define NUMC_SENDMESSAGEWTOOPTION   0x02B1 
+#define NUMC_SENDMESSAGEWTOOPTION   0x02B1
 #define NUMC_SENDMESSAGETIMEOUT     0x02B2
 #define NUMC_BROADCASTSYSTEMMESSAGE 0x02B4
 #define NUMC_SENDNOTIFYMESSAGE      0x02B7
diff --git a/reactos/subsystems/win32/win32k/ntuser/clipboard.c b/reactos/subsystems/win32/win32k/ntuser/clipboard.c
index 2040ad12106..15b68917544 100644
--- a/reactos/subsystems/win32/win32k/ntuser/clipboard.c
+++ b/reactos/subsystems/win32/win32k/ntuser/clipboard.c
@@ -598,17 +598,16 @@ NtUserEmptyClipboard(VOID)
 }
 
 HANDLE STDCALL
-NtUserGetClipboardData(UINT uFormat, DWORD Unknown1)
+NtUserGetClipboardData(UINT uFormat, PVOID pBuffer)
 {
     HANDLE ret = NULL;
-    PCHAR buffer;
 
     UserEnterShared();
 
     if (intIsClipboardOpenByMe())
     {
         /* when Unknown1 is zero, we returns to user32 the data size */
-        if (Unknown1 == 0)
+        if (!pBuffer)
         {
             PCLIPBOARDELEMENT data = intIsFormatAvailable(uFormat);
 
@@ -624,7 +623,7 @@ NtUserGetClipboardData(UINT uFormat, DWORD Unknown1)
                         co_IntSendMessage(ClipboardOwnerWindow->hSelf, WM_RENDERFORMAT, (WPARAM)uFormat, 0);
                         data = intIsFormatAvailable(uFormat);
                         ASSERT(data->size);
-                        ret = (HANDLE)data->size;
+                        ret = (HANDLE)(ULONG_PTR)data->size;
                     }
                 }
                 else
@@ -635,7 +634,7 @@ NtUserGetClipboardData(UINT uFormat, DWORD Unknown1)
                     }
 
                 }
-                ret = (HANDLE)data->size;
+                ret = (HANDLE)(ULONG_PTR)data->size;
             }
             else
             {
@@ -668,20 +667,36 @@ NtUserGetClipboardData(UINT uFormat, DWORD Unknown1)
                         }
                         else
                         {
-                            buffer = (PCHAR)Unknown1;
-                            memcpy(buffer, (PCHAR)synthesizedData, synthesizedDataSize);
+                            ret = (HANDLE)pBuffer;
+
+                            _SEH_TRY
+                            {
+                                ProbeForWrite(pBuffer, synthesizedDataSize, 1);
+                                memcpy(pBuffer, (PCHAR)synthesizedData, synthesizedDataSize);
+                            }
+                            _SEH_HANDLE
+                            {
+                                ret = NULL;
+                            }
+                            _SEH_END
 
                             freeSynthesizedData();
-
-                            ret = (HANDLE)Unknown1;
                         }
                     }
                     else
                     {
-                        buffer = (PCHAR)Unknown1;
-                        memcpy(buffer, (PCHAR)data->hData, data->size);
+                        ret = (HANDLE)pBuffer;
 
-                        ret = (HANDLE)Unknown1;
+                        _SEH_TRY
+                        {
+                            ProbeForWrite(pBuffer, data->size, 1);
+                            memcpy(pBuffer, (PCHAR)data->hData, data->size);
+                        }
+                        _SEH_HANDLE
+                        {
+                            ret = NULL;
+                        }
+                        _SEH_END
                     }
                 }