[WIN32K]

Fix all MSVC static analyzer warnings. (a few are suppressed after checking that it's ok)
Fixes a number of missing or wrong function return checks, wrong printf format specifiers and a few other things,

svn path=/trunk/; revision=66646

reactos/include/ndk/kefuncs.h

@@ -312,9 +312,9 @@ NTSTATUS
 NTAPI
 KeUserModeCallback(
     _In_ ULONG FunctionID,
-    _In_ PVOID InputBuffer,
+    _In_reads_opt_(InputLength) PVOID InputBuffer,
     _In_ ULONG InputLength,
-    _Out_ PVOID *OutputBuffer,
+    _Outptr_result_buffer_(*OutputLength) PVOID *OutputBuffer,
     _Out_ PULONG OutputLength
 );
 

reactos/include/ndk/obfuncs.h

@@ -153,8 +153,8 @@ ObFindHandleForObject(
     _In_ PEPROCESS Process,
     _In_ PVOID Object,
     _In_ POBJECT_TYPE ObjectType,
-    _In_ POBJECT_HANDLE_INFORMATION HandleInformation,
+    _In_opt_ POBJECT_HANDLE_INFORMATION HandleInformation,
-    _Out_ PHANDLE Handle
+    _Out_opt_ PHANDLE Handle
 );
 
 NTKERNELAPI

reactos/include/ndk/psfuncs.h

@@ -69,8 +69,8 @@ PVOID
 NTAPI
 PsSetThreadWin32Thread(
     _Inout_ PETHREAD Thread,
-    _In_ PVOID Win32Thread,
+    _In_opt_ PVOID Win32Thread,
-    _In_ PVOID OldWin32Thread
+    _In_opt_ PVOID OldWin32Thread
 );
 
 NTKERNELAPI
@@ -92,7 +92,7 @@ VOID
 NTAPI
 PsSetProcessWindowStation(
     _Inout_ PEPROCESS Process,
-    _In_ PVOID WindowStation
+    _In_opt_ PVOID WindowStation
 );
 
 NTKERNELAPI

reactos/include/psdk/winddi.h

@@ -1372,6 +1372,7 @@ EngAcquireSemaphore(
 _Must_inspect_result_
 _When_(fl & FL_ZERO_MEMORY, _Ret_opt_bytecount_(cjMemSize))
 _When_(!(fl & FL_ZERO_MEMORY), _Ret_opt_bytecap_(cjMemSize))
+__drv_allocatesMem(Mem)
 ENGAPI
 PVOID
 APIENTRY
@@ -1382,6 +1383,7 @@ EngAllocMem(
 
 _Must_inspect_result_
 _Ret_opt_bytecount_(cjMemSize)
+__drv_allocatesMem(PrivateUserMem)
 ENGAPI
 PVOID
 APIENTRY
@@ -1392,6 +1394,7 @@ EngAllocPrivateUserMem(
 
 _Must_inspect_result_
 _Ret_opt_bytecount_(cjMemSize)
+__drv_allocatesMem(UserMem)
 ENGAPI
 PVOID
 APIENTRY
@@ -1814,20 +1817,20 @@ ENGAPI
 VOID
 APIENTRY
 EngFreeMem(
-    _In_ _Post_ptr_invalid_ PVOID pv);
+    _Pre_notnull_ __drv_freesMem(Mem) PVOID pv);
 
 ENGAPI
 VOID
 APIENTRY
 EngFreePrivateUserMem(
     _In_ PDD_SURFACE_LOCAL psl,
-    _In_ _Post_ptr_invalid_ PVOID  pv);
+    _Pre_notnull_ __drv_freesMem(PrivateUserMem) PVOID pv);
 
 ENGAPI
 VOID
 APIENTRY
 EngFreeUserMem(
-    _In_ _Post_ptr_invalid_ PVOID pv);
+    _Pre_notnull_ __drv_freesMem(UserMem) PVOID pv);
 
 #endif /* !USERMODE_DRIVER */
 

reactos/win32ss/gdi/eng/float.c

@@ -15,6 +15,10 @@
 
 /* FUNCTIONS *****************************************************************/
 
+#ifdef _PREFAST_
+#pragma warning(disable:__WARNING_WRONG_KIND)
+#endif
+
 _Check_return_
 _Success_(return)
 _Kernel_float_restored_

reactos/win32ss/gdi/eng/mem.c

@@ -17,6 +17,7 @@
 _Must_inspect_result_
 _When_(fl & FL_ZERO_MEMORY, _Ret_opt_bytecount_(cjMemSize))
 _When_(!(fl & FL_ZERO_MEMORY), _Ret_opt_bytecap_(cjMemSize))
+__drv_allocatesMem(Mem)
 ENGAPI
 PVOID
 APIENTRY
@@ -61,6 +62,7 @@ EngFreeMem(PVOID pvBaseAddress)
  */
 _Must_inspect_result_
 _Ret_opt_bytecount_(cjMemSize)
+__drv_allocatesMem(UserMem)
 ENGAPI
 PVOID
 APIENTRY

reactos/win32ss/gdi/ntgdi/freetype.c

@@ -4346,13 +4346,14 @@ NtGdiGetCharWidthW(
     return TRUE;
 }
 
+#if 0
 DWORD
 FASTCALL
 GreGetGlyphIndicesW(
     _In_ HDC hdc,
-    _In_opt_ LPWSTR pwc,
+    _In_reads_(cwc) LPWSTR pwc,
     _In_ INT cwc,
-    _Out_opt_ LPWORD pgi,
+    _Out_writes_opt_(cwc) LPWORD pgi,
     _In_ DWORD iMode,
     _In_ DWORD dwUnknown)
 {
@@ -4431,25 +4432,30 @@ GreGetGlyphIndicesW(
 
     IntUnLockFreeType;
 
-    RtlCopyMemory( pgi, Buffer, cwc*sizeof(WORD));
+    if (pgi != NULL)
+    {
+        RtlCopyMemory(pgi, Buffer, cwc * sizeof(WORD));
+    }
 
 ErrorRet:
     if (Buffer) ExFreePoolWithTag(Buffer, GDITAG_TEXT);
     return cwc;
 }
-
+#endif // 0
 
 /*
 * @implemented
 */
+__kernel_entry
+W32KAPI
 DWORD
 APIENTRY
 NtGdiGetGlyphIndicesW(
-    IN HDC hdc,
+    _In_ HDC hdc,
-    IN OPTIONAL LPWSTR UnSafepwc,
+    _In_reads_opt_(cwc) LPWSTR pwc,
-    IN INT cwc,
+    _In_ INT cwc,
-    OUT OPTIONAL LPWORD UnSafepgi,
+    _Out_writes_opt_(cwc) LPWORD pgi,
-    IN DWORD iMode)
+    _In_ DWORD iMode)
 {
     PDC dc;
     PDC_ATTR pdcattr;
@@ -4464,9 +4470,17 @@ NtGdiGetGlyphIndicesW(
     PWSTR Buffer = NULL;
     ULONG Size, pwcSize;
     PWSTR Safepwc = NULL;
+    LPWSTR UnSafepwc = pwc;
+    LPWORD UnSafepgi = pgi;
 
     if ((!UnSafepwc) && (!UnSafepgi)) return cwc;
 
+    if ((UnSafepwc == NULL) || (UnSafepgi == NULL))
+    {
+        DPRINT1("UnSafepwc == %p, UnSafepgi = %p\n", UnSafepwc, UnSafepgi);
+        return -1;
+    }
+
     dc = DC_LockDc(hdc);
     if (!dc)
     {
@@ -4563,7 +4577,10 @@ NtGdiGetGlyphIndicesW(
 
 ErrorRet:
     ExFreePoolWithTag(Buffer, GDITAG_TEXT);
-    ExFreePoolWithTag(Safepwc, GDITAG_TEXT);
+    if (Safepwc != NULL)
+    {
+        ExFreePoolWithTag(Safepwc, GDITAG_TEXT);
+    }
     if (NT_SUCCESS(Status)) return cwc;
     EngSetLastError(Status);
     return GDI_ERROR;

reactos/win32ss/gdi/ntgdi/misc.h

@@ -54,14 +54,15 @@ BOOL
 NTAPI
 RegReadDWORD(HKEY hkey, PWSTR pwszValue, PDWORD pdwData);
 
+_Success_(return!=FALSE)
 BOOL
 NTAPI
 RegReadUserSetting(
-    IN PCWSTR pwszKeyName,
+    _In_z_ PCWSTR pwszKeyName,
-    IN PCWSTR pwszValueName,
+    _In_z_ PCWSTR pwszValueName,
-    IN ULONG ulType,
+    _In_ ULONG ulType,
-    OUT PVOID pvData,
+    _Out_writes_(cbDataSize) _When_(ulType == REG_SZ, _Post_z_) PVOID pvData,
-    IN ULONG cbDataSize);
+    _In_ ULONG cbDataSize);
 
 BOOL
 NTAPI

reactos/win32ss/gdi/ntgdi/path.c

@@ -1736,6 +1736,13 @@ PATH_WidenPath(DC *dc)
     }
 
     elp = ExAllocatePoolWithTag(PagedPool, size, TAG_PATH);
+    if (elp == NULL)
+    {
+        PATH_UnlockPath(pPath);
+        EngSetLastError(ERROR_OUTOFMEMORY);
+        return FALSE;
+    }
+
     GreGetObject(pdcattr->hpen, size, elp);
 
     obj_type = GDI_HANDLE_GET_TYPE(pdcattr->hpen);

reactos/win32ss/gdi/ntgdi/polyfill.c

@@ -84,6 +84,7 @@ POLYGONFILL_DestroyEdgeList(FILL_EDGE_LIST* list)
         {
             for (i = 0; i < list->Count; i++)
             {
+                _PRAGMA_WARNING_SUPPRESS(__WARNING_USING_UNINIT_VAR)
                 if (list->Edges[i])
                     EngFreeMem(list->Edges[i]);
             }

reactos/win32ss/gdi/ntgdi/text.h

@@ -130,7 +130,6 @@ BOOL NTAPI GreExtTextOutW(IN HDC,IN INT,IN INT,IN UINT,IN OPTIONAL RECTL*,
 DWORD FASTCALL IntGetCharDimensions(HDC, PTEXTMETRICW, PDWORD);
 BOOL FASTCALL GreGetTextExtentW(HDC,LPWSTR,INT,LPSIZE,UINT);
 BOOL FASTCALL GreGetTextExtentExW(HDC,LPWSTR,ULONG,ULONG,PULONG,PULONG,LPSIZE,FLONG);
-DWORD FASTCALL GreGetGlyphIndicesW(HDC,LPWSTR,INT,LPWORD,DWORD,DWORD);
 BOOL FASTCALL GreTextOutW(HDC,int,int,LPCWSTR,int);
 HFONT FASTCALL GreCreateFontIndirectW( LOGFONTW * );
 

reactos/win32ss/gdi/ntgdi/xformobj.c

@@ -332,7 +332,8 @@ XFORMOBJ_bXformFixPoints(
 
     if ((flAccel & (XFORM_SCALE|XFORM_UNITY)) == (XFORM_SCALE|XFORM_UNITY))
     {
-        /* Identity transformation, nothing to do */
+        /* Identity transformation */
+        RtlCopyMemory(pptOut, pptIn, cPoints * sizeof(POINTL));
     }
     else if (flAccel & XFORM_INTEGER)
     {

reactos/win32ss/reactx/ntddraw/eng.c

@@ -59,11 +59,16 @@ VidMemFree(LPVMEMHEAP pvmh,
 /************************************************************************/
 /* EngAllocPrivateUserMem                                               */
 /************************************************************************/
+_Must_inspect_result_
+_Ret_opt_bytecount_(cjMemSize)
+__drv_allocatesMem(PrivateUserMem)
+ENGAPI
 PVOID
 APIENTRY
-EngAllocPrivateUserMem(PDD_SURFACE_LOCAL  psl,
+EngAllocPrivateUserMem(
-                       SIZE_T  cj,
+    _In_ PDD_SURFACE_LOCAL psl,
-                       ULONG  tag)
+    _In_ SIZE_T cjMemSize,
+    _In_ ULONG ulTag)
 {
     PGD_ENGALLOCPRIVATEUSERMEM pfnEngAllocPrivateUserMem = (PGD_ENGALLOCPRIVATEUSERMEM)gpDxFuncs[DXG_INDEX_DxDdAllocPrivateUserMem].pfn;
 
@@ -74,7 +79,7 @@ EngAllocPrivateUserMem(PDD_SURFACE_LOCAL  psl,
     }
 
     DPRINT1("Calling dxg.sys pfnEngAllocPrivateUserMem\n");
-    return pfnEngAllocPrivateUserMem(psl, cj, tag);
+    return pfnEngAllocPrivateUserMem(psl, cjMemSize, ulTag);
 }
 
 /************************************************************************/

reactos/win32ss/user/ntuser/callback.c

@@ -338,6 +338,11 @@ co_IntCallWindowProc(WNDPROC Proc,
                                ArgumentLength,
                                &ResultPointer,
                                &ResultLength);
+   if (!NT_SUCCESS(Status))
+   {
+      UserEnterCo();
+      return -1;
+   }
 
    _SEH2_TRY
    {
@@ -346,7 +351,7 @@ co_IntCallWindowProc(WNDPROC Proc,
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
-      ERR("Failed to copy result from user mode, Message %d lParam size %d!\n", Message, lParamBufferSize);
+      ERR("Failed to copy result from user mode, Message %u lParam size %d!\n", Message, lParamBufferSize);
       Status = _SEH2_GetExceptionCode();
    }
    _SEH2_END;
@@ -357,7 +362,7 @@ co_IntCallWindowProc(WNDPROC Proc,
 
    if (!NT_SUCCESS(Status))
    {
-     ERR("Call to user mode failed! %p\n",Status);
+     ERR("Call to user mode failed! 0x%08lx\n",Status);
       if (lParamBufferSize != -1)
       {
          IntCbFreeMemory(Arguments);
@@ -372,11 +377,11 @@ co_IntCallWindowProc(WNDPROC Proc,
       // Is this message being processed from inside kernel space?
       BOOL InSendMessage = (pti->pcti->CTI_flags & CTI_INSENDMESSAGE);
 
-      TRACE("Copy lParam Message %d lParam %d!\n", Message, lParam);
+      TRACE("Copy lParam Message %u lParam %d!\n", Message, lParam);
       switch (Message)
       {
           default:
-            TRACE("Don't copy lParam, Message %d Size %d lParam %d!\n", Message, lParamBufferSize, lParam);
+            TRACE("Don't copy lParam, Message %u Size %d lParam %d!\n", Message, lParamBufferSize, lParam);
             break;
           // Write back to user/kernel space. Also see g_MsgMemory.
           case WM_CREATE:
@@ -388,7 +393,7 @@ co_IntCallWindowProc(WNDPROC Proc,
           case WM_WINDOWPOSCHANGING:
           case WM_SIZING:
           case WM_MOVING:
-            TRACE("Copy lParam, Message %d Size %d lParam %d!\n", Message, lParamBufferSize, lParam);
+            TRACE("Copy lParam, Message %u Size %d lParam %d!\n", Message, lParamBufferSize, lParam);
             if (InSendMessage)
                // Copy into kernel space.
                RtlMoveMemory((PVOID) lParam,
@@ -404,7 +409,7 @@ co_IntCallWindowProc(WNDPROC Proc,
              }
              _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
              {
-                ERR("Failed to copy lParam to user space, Message %d!\n", Message);
+                ERR("Failed to copy lParam to user space, Message %u!\n", Message);
              }
              _SEH2_END;
             }
@@ -483,13 +488,14 @@ co_IntLoadDefaultCursors(VOID)
 
    UserEnterCo();
 
-   /* HACK: The desktop class doen't have a proper cursor yet, so set it here */
-    gDesktopCursor = *((HCURSOR*)ResultPointer);
-
    if (!NT_SUCCESS(Status))
    {
       return FALSE;
    }
+
+   /* HACK: The desktop class doen't have a proper cursor yet, so set it here */
+    gDesktopCursor = *((HCURSOR*)ResultPointer);
+
    return TRUE;
 }
 
@@ -721,6 +727,12 @@ co_IntCallHookProc(INT HookId,
 
    UserEnterCo();
 
+   if (!NT_SUCCESS(Status))
+   {
+      ERR("Failure to make Callback! Status 0x%x",Status);
+      goto Fault_Exit;
+   }
+
    if (ResultPointer)
    {
       _SEH2_TRY
@@ -741,11 +753,6 @@ co_IntCallHookProc(INT HookId,
       ERR("ERROR: Hook %d Code %d ResultPointer 0x%p ResultLength %u\n",HookId,Code,ResultPointer,ResultLength);
    }
 
-   if (!NT_SUCCESS(Status))
-   {
-      ERR("Failure to make Callback! Status 0x%x",Status);
-      goto Fault_Exit;
-   }
    /* Support write backs... SEH is in UserCallNextHookEx. */
    switch (HookId)
    {
@@ -906,15 +913,17 @@ co_IntCallLoadMenu( HINSTANCE hModule,
 
    UserEnterCo();
 
-   Result = *(LRESULT*)ResultPointer;
+   if (NT_SUCCESS(Status))
+   {
+      Result = *(LRESULT*)ResultPointer;
+   }
+   else
+   {
+      Result = 0;
+   }
 
    IntCbFreeMemory(Argument);
 
-   if (!NT_SUCCESS(Status))
-   {
-      return 0;
-   }
-
    return (HMENU)Result;
 }
 
@@ -984,16 +993,18 @@ co_IntCopyImage(HANDLE hnd, UINT type, INT desiredx, INT desiredy, UINT flags)
 
    UserEnterCo();
 
-   Handle = *(HANDLE*)ResultPointer;
+   if (NT_SUCCESS(Status))
-
+   {
-   IntCbFreeMemory(Argument);
+      Handle = *(HANDLE*)ResultPointer;
-
+   }
-   if (!NT_SUCCESS(Status))
+   else
    {
       ERR("CopyImage callback failed!\n");
-      return 0;
+      Handle = NULL;
    }
 
+   IntCbFreeMemory(Argument);
+
    return Handle;
 }
 
@@ -1029,17 +1040,20 @@ co_IntGetCharsetInfo(LCID Locale, PCHARSETINFO pCs)
                                &ResultPointer,
                                &ResultLength);
 
-   _SEH2_TRY
+   if (NT_SUCCESS(Status))
    {
-      /* Need to copy into our local buffer */
+      _SEH2_TRY
-      RtlMoveMemory(Argument, ResultPointer, ArgumentLength);
+      {
+         /* Need to copy into our local buffer */
+         RtlMoveMemory(Argument, ResultPointer, ArgumentLength);
+      }
+      _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+      {
+         ERR("Failed to copy result from user mode!\n");
+         Status = _SEH2_GetExceptionCode();
+      }
+      _SEH2_END;
    }
-   _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
-   {
-      ERR("Failed to copy result from user mode!\n");
-      Status = _SEH2_GetExceptionCode();
-   }
-   _SEH2_END;
 
    UserEnterCo();
 
@@ -1115,14 +1129,16 @@ co_IntSetWndIcons(VOID)
 VOID FASTCALL
 co_IntDeliverUserAPC(VOID)
 {
+   ULONG ResultLength;
+   PVOID ResultPointer;
    NTSTATUS Status;
    UserLeaveCo();
 
    Status = KeUserModeCallback(USER32_CALLBACK_DELIVERUSERAPC,
                                0,
                                0,
-                               NULL,
+                               &ResultPointer,
-                               NULL);
+                               &ResultLength);
 
 
    UserEnterCo();
@@ -1130,6 +1146,6 @@ co_IntDeliverUserAPC(VOID)
    if (!NT_SUCCESS(Status))
    {
       ERR("Delivering User APC callback failed!\n");
-   }   
+   }
 }
 /* EOF */

reactos/win32ss/user/ntuser/callproc.c

@@ -135,7 +135,7 @@ UserGetCPD(
    {
       if (!pCls->rpdeskParent)
       {
-         TRACE("Null DESKTOP Atom %d\n",pCls->atomClassName);
+         TRACE("Null DESKTOP Atom %u\n",pCls->atomClassName);
          pDesk = pti->rpdesk;
       }
       else
@@ -157,7 +157,7 @@ UserGetCPD(
 
 /* SYSCALLS *****************************************************************/
 
-/* 
+/*
    Retrieve the WinProcA/W or CallProcData handle for Class, Dialog or Window.
    This Function called from user space uses Window handle for class, window
    and dialog procs only.
@@ -183,12 +183,12 @@ NtUserGetCPD(
 
    UserEnterExclusive();
    if (!(Wnd = UserGetWindowObject(hWnd)))
-   {   
+   {
       goto Cleanup;
    }
 
    // Processing Window only from User space.
-   if ((Flags & ~(UserGetCPDU2A|UserGetCPDA2U)) != UserGetCPDClass)        
+   if ((Flags & ~(UserGetCPDU2A|UserGetCPDA2U)) != UserGetCPDClass)
       Result = UserGetCPD(Wnd, Flags, ProcIn);
 
 Cleanup:

reactos/win32ss/user/ntuser/caret.c

@@ -35,8 +35,14 @@ co_IntDrawCaret(PWND pWnd, PTHRDCARETINFO CaretInfo)
        NtGdiSaveDC(hdc);
     }
 
-    if(CaretInfo->Bitmap && NtGdiGetBitmapDimension(CaretInfo->Bitmap, &CaretInfo->Size))
+    if (CaretInfo->Bitmap)
     {
+        if (!NtGdiGetBitmapDimension(CaretInfo->Bitmap, &CaretInfo->Size))
+        {
+            ERR("Failed to get bitmap dimensions\n");
+            return;
+        }
+
         hdcMem = NtGdiCreateCompatibleDC(hdc);
         if (hdcMem)
         {
@@ -88,13 +94,13 @@ CaretSystemTimerProc(HWND hwnd,
 
    pti = PsGetCurrentThreadWin32Thread();
    ThreadQueue = pti->MessageQueue;
-   
+
    if (ThreadQueue->CaretInfo->hWnd != hwnd)
    {
       ERR("Not the same caret window!\n");
       return;
    }
-   
+
    if (hwnd)
    {
       pWnd = UserGetWindowObject(hwnd);
@@ -118,7 +124,7 @@ CaretSystemTimerProc(HWND hwnd,
          co_IntDrawCaret(pWnd, ThreadQueue->CaretInfo);
       }
    }
-   return;  
+   return;
 }
 
 static

reactos/win32ss/user/ntuser/class.c

@@ -1042,7 +1042,7 @@ IntCreateClass(IN CONST WNDCLASSEXW* lpwcx,
         /* FIXME: The class was created before being connected
                   to a desktop. It is possible for the desktop window,
                   but should it be allowed for any other case? */
-        TRACE("This CLASS has no Desktop to heap from! Atom %d\n",Atom);
+        TRACE("This CLASS has no Desktop to heap from! Atom %u\n",Atom);
         Class = UserHeapAlloc(ClassSize);
     }
 
@@ -1232,6 +1232,7 @@ IntFindClass(IN RTL_ATOM Atom,
     return Class;
 }
 
+_Success_(return)
 BOOL
 NTAPI
 IntGetAtomFromStringOrAtom(
@@ -1314,8 +1315,7 @@ IntGetClassAtom(
 
     ASSERT(BaseClass != NULL);
 
-    if (IntGetAtomFromStringOrAtom(ClassName,
+    if (IntGetAtomFromStringOrAtom(ClassName, &Atom) &&
-                                   &Atom) &&
         Atom != (RTL_ATOM)0)
     {
         PCLS Class;
@@ -1369,6 +1369,10 @@ IntGetClassAtom(
 FoundClass:
         *BaseClass = Class;
     }
+    else
+    {
+        Atom = 0;
+    }
 
     return Atom;
 }

reactos/win32ss/user/ntuser/class.h

@@ -46,6 +46,7 @@ VOID
 UserAddCallProcToClass(IN OUT PCLS Class,
                        IN PCALLPROCDATA CallProc);
 
+_Success_(return)
 BOOL
 NTAPI
 IntGetAtomFromStringOrAtom(

reactos/win32ss/user/ntuser/cursoricon.c

@@ -1310,6 +1310,7 @@ IntSetAconData(
 
         /* Get a pointer to the frame cursor */
         aspcur[i] = UserGetCurIconObject(hcurFrame);
+        _PRAGMA_WARNING_SUPPRESS(__WARNING_READ_OVERRUN);
         NT_ASSERT(aspcur[i] != NULL);
 
         /* Check if the flags are valid */

reactos/win32ss/user/ntuser/dde.c

@@ -243,6 +243,11 @@ IntDdePostMessageHook(
       {
          // Set buffer with users data size.
          Buffer = ExAllocatePoolWithTag(PagedPool, size, USERTAG_DDE);
+         if (Buffer == NULL)
+         {
+             ERR("Failed to allocate %i bytes.\n", size);
+             return FALSE;
+         }
          // No SEH? Yes, the user memory is freed after the Acknowledgment or at Termination.
          RtlCopyMemory(Buffer, userBuf, size);
       }
@@ -254,6 +259,7 @@ IntDdePostMessageHook(
           case WM_DDE_POKE:
           {
               DDEPOKE *pddePoke = Buffer;
+              NT_ASSERT(pddePoke != NULL);
               switch(pddePoke->cfFormat)
               {
                  case CF_BITMAP:
@@ -268,13 +274,14 @@ IntDdePostMessageHook(
           }
           case WM_DDE_DATA:
           {
-              DDEDATA *pddeData = Buffer;
+              DDEDATA *pddeData2 = Buffer;
-              switch(pddeData->cfFormat)
+              NT_ASSERT(pddeData2 != NULL);
+              switch(pddeData2->cfFormat)
               {
                  case CF_BITMAP:
                  case CF_DIB:
                  case CF_PALETTE:
-                    RtlCopyMemory(&Object, pddeData->Value, sizeof(HGDIOBJ));
+                    RtlCopyMemory(&Object, pddeData2->Value, sizeof(HGDIOBJ));
                     break;
                  default:
                     break;
@@ -292,14 +299,20 @@ IntDdePostMessageHook(
       }
 
       pddeData = ExAllocatePoolWithTag(PagedPool, sizeof(DDE_DATA), USERTAG_DDE5);
+      if (pddeData == NULL)
+      {
+         ERR("Failed to allocate DDE_DATA\n");
+         ExFreePoolWithTag(Buffer, USERTAG_DDE);
+         return FALSE;
+      }
 
       pddeData->cbSize       = size;
       pddeData->pvBuffer     = Buffer;
       pddeData->lParam       = lp;
- 
+
       TRACE("DDE Post lParam c=%08lx\n",lp);
       *lParam = lp;
- 
+
       // Attach this data packet to the user message.
       *ExtraInfo = (LONG_PTR)pddeData;
    }
@@ -397,6 +410,11 @@ IntDdeSendMessageHook(PWND pWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
 
       // Setup property so this conversation can be tracked.
       pddeProp = ExAllocatePoolWithTag(PagedPool, sizeof(DDE_PROP), USERTAG_DDE1);
+      if (pddeProp == NULL)
+      {
+         ERR("failed to allocate DDE_PROP\n");
+         return FALSE;
+      }
 
       pddeProp->spwnd        = pWndServer;
       pddeProp->spwndPartner = pWnd;

reactos/win32ss/user/ntuser/desktop.c

@@ -515,8 +515,8 @@ IntSetFocusMessageQueue(PUSER_MESSAGE_QUEUE NewQueue)
    if(Old != NULL)
    {
       (void)InterlockedExchangePointer((PVOID*)&Old->Desktop, 0);
-      IntDereferenceMessageQueue(Old);
       gpqForegroundPrev = Old;
+      IntDereferenceMessageQueue(Old);
    }
    // Only one Q can have active foreground even when there are more than one desktop.
    if (NewQueue)
@@ -999,7 +999,10 @@ IntPaintDesktop(HDC hDC)
    UINT align_old;
    int mode_old;
 
-   GdiGetClipBox(hDC, &Rect);
+   if (GdiGetClipBox(hDC, &Rect) == ERROR)
+   {
+       return FALSE;
+   }
 
    hWndDesktop = IntGetDesktopWindow(); // rpdesk->DesktopWindow;
 
@@ -1292,7 +1295,7 @@ NtUserCreateDesktop(
    PDESKTOP pdesk = NULL;
    NTSTATUS Status = STATUS_SUCCESS;
    HDESK hdesk;
-   BOOLEAN Context;
+   BOOLEAN Context = FALSE;
    UNICODE_STRING ClassName;
    LARGE_STRING WindowName;
    BOOL NoHooks = FALSE;

reactos/win32ss/user/ntuser/event.c

@@ -11,7 +11,7 @@ DBG_DEFAULT_CHANNEL(UserEvent);
 
 typedef struct _EVENTPACK
 {
-  PEVENTHOOK pEH; 
+  PEVENTHOOK pEH;
   LONG idObject;
   LONG idChild;
   LONG idThread;
@@ -97,7 +97,7 @@ LRESULT
 FASTCALL
 IntCallLowLevelEvent( PEVENTHOOK pEH,
                          DWORD event,
-                           HWND hwnd, 
+                           HWND hwnd,
                        LONG idObject,
                         LONG idChild,
                        LONG idThread)
@@ -158,7 +158,7 @@ co_EVENT_CallEvents( DWORD event,
    PEVENTPACK pEP = (PEVENTPACK)idChild;
 
    pEH = pEP->pEH;
-   TRACE("Dispatch Event 0x%x, idObject %d hwnd %p\n", event, idObject, hwnd);   
+   TRACE("Dispatch Event 0x%lx, idObject %uI hwnd %p\n", event, idObject, hwnd);
    Result = co_IntCallEventProc( UserHMGetHandle(pEH),
                                  event,
                                  hwnd,
@@ -241,13 +241,13 @@ IntNotifyWinEvent(
                                     idChild,
                                     PtrToUint(NtCurrentTeb()->ClientId.UniqueThread));
            }
-        }        
+        }
      }
      UserDereferenceObject(pEH);
      pLE = pEH->Chain.Flink;
      pEH = CONTAINING_RECORD(pLE, EVENTHOOK, Chain);
    } while (pLE != &GlobalEvents->Events);
-}            
+}
 
 VOID
 APIENTRY
@@ -311,7 +311,7 @@ NtUserSetWinEventHook(
          EngSetLastError(ERROR_NOT_ENOUGH_MEMORY);
          goto SetEventExit;
       }
-      GlobalEvents->Counts = 0;      
+      GlobalEvents->Counts = 0;
       InitializeListHead(&GlobalEvents->Events);
    }
 
@@ -353,7 +353,7 @@ NtUserSetWinEventHook(
       PETHREAD Thread;
       Status = PsLookupThreadByThreadId((HANDLE)(DWORD_PTR)idThread, &Thread);
       if (!NT_SUCCESS(Status))
-      {   
+      {
          EngSetLastError(ERROR_INVALID_THREAD_ID);
          goto SetEventExit;
       }
@@ -419,7 +419,7 @@ NtUserUnhookWinEvent(
    UserEnterExclusive();
 
    pEH = (PEVENTHOOK)UserGetObject(gHandleTable, hWinEventHook, TYPE_WINEVENTHOOK);
-   if (pEH) 
+   if (pEH)
    {
       Ret = IntRemoveEvent(pEH);
    }

reactos/win32ss/user/ntuser/focus.c

@@ -416,7 +416,7 @@ CanForceFG(PPROCESSINFO ppi)
 static
 BOOL FASTCALL
 co_IntSetForegroundAndFocusWindow(
-    _In_ PWND Wnd,
+    _In_opt_ PWND Wnd,
     _In_ BOOL MouseActivate)
 {
    HWND hWnd = Wnd ? UserHMGetHandle(Wnd) : NULL;
@@ -805,6 +805,7 @@ co_UserSetFocus(PWND Window)
       {
          if (pwndTop->style & (WS_MINIMIZED|WS_DISABLED)) return 0;
          if ((pwndTop->style & (WS_POPUP|WS_CHILD)) != WS_CHILD) break;
+         if (pwndTop->spwndParent == NULL) break;
       }
       ////
       if (co_HOOK_CallHooks( WH_CBT, HCBT_SETFOCUS, (WPARAM)Window->head.h, (LPARAM)hWndPrev))

reactos/win32ss/user/ntuser/hook.c

@@ -720,7 +720,8 @@ co_UserCallNextHookEx(PHOOK Hook,
 
                             if (!IS_ATOM(pcbtcww->lpcs->lpszClass))
                             {
-                               ProbeForRead( pcbtcww->lpcs->lpszClass,
+                                _Analysis_assume_(pcbtcww->lpcs->lpszClass != NULL);
+                                ProbeForRead(pcbtcww->lpcs->lpszClass,
                                              sizeof(CHAR),
                                              1);
                             }
@@ -739,7 +740,8 @@ co_UserCallNextHookEx(PHOOK Hook,
 
                             if (!IS_ATOM(pcbtcww->lpcs->lpszClass))
                             {
-                               ProbeForRead( pcbtcww->lpcs->lpszClass,
+                                _Analysis_assume_(pcbtcww->lpcs->lpszClass != NULL);
+                                ProbeForRead(pcbtcww->lpcs->lpszClass,
                                              sizeof(WCHAR),
                                              1);
                             }
@@ -968,15 +970,16 @@ IntGetGlobalHookHandles(PDESKTOP pdo, int HookId)
       ++cHooks;
 
     pList = ExAllocatePoolWithTag(PagedPool, (cHooks + 1) * sizeof(HHOOK), TAG_HOOK);
-    if(!pList)
+    if (!pList)
     {
         EngSetLastError(ERROR_NOT_ENOUGH_MEMORY);
         return NULL;
-}
+    }
 
     for (pElem = pLastHead->Flink; pElem != pLastHead; pElem = pElem->Flink)
-{
+    {
         pHook = CONTAINING_RECORD(pElem, HOOK, Chain);
+        NT_ASSERT(i < cHooks);
         pList[i++] = pHook->head.h;
     }
     pList[i] = NULL;
@@ -1180,7 +1183,7 @@ co_HOOK_CallHooks( INT HookId,
                                     wParam,
                                     lParam,
                                     Hook->Proc,
-                                    Hook->ihmod, 
+                                    Hook->ihmod,
                                     Hook->offPfn,
                                     Hook->Ansi,
                                    &Hook->ModuleName);
@@ -1261,7 +1264,7 @@ co_HOOK_CallHooks( INT HookId,
                                              wParam,
                                              lParam,
                                              Hook->Proc,
-                                             Hook->ihmod, 
+                                             Hook->ihmod,
                                              Hook->offPfn,
                                              Hook->Ansi,
                                             &Hook->ModuleName);
@@ -1279,7 +1282,7 @@ co_HOOK_CallHooks( INT HookId,
                                           wParam,
                                           lParam,
                                           Hook->Proc,
-                                          Hook->ihmod, 
+                                          Hook->ihmod,
                                           Hook->offPfn,
                                           Hook->Ansi,
                                          &Hook->ModuleName);

reactos/win32ss/user/ntuser/hotkey.c

@@ -217,7 +217,7 @@ co_UserProcessHotKeys(WORD wVk, BOOL bIsDown)
                 pWnd = ValidateHwndNoErr(InputWindowStation->ShellWindow);
                 if (pWnd)
                 {
-                   TRACE("System Hot key Id %d Key %d\n",pHotKey->id, wVk );
+                   TRACE("System Hot key Id %d Key %u\n", pHotKey->id, wVk );
                    UserPostMessage(UserHMGetHandle(pWnd), WM_SYSCOMMAND, SC_TASKLIST, 0);
                    co_IntShellHookNotify(HSHELL_TASKMAN, 0, 0);
                    bWinHotkeyActive = FALSE;
@@ -238,7 +238,7 @@ co_UserProcessHotKeys(WORD wVk, BOOL bIsDown)
         {
             if (!pHotKey->pWnd)
             {
-                TRACE("UPTM Hot key Id %d Key %d\n",pHotKey->id, wVk );
+                TRACE("UPTM Hot key Id %d Key %u\n", pHotKey->id, wVk );
                 UserPostThreadMessage(pHotKey->pti, WM_HOTKEY, pHotKey->id, MAKELONG(fModifiers, wVk));
                 //ptiLastInput = pHotKey->pti;
                 return TRUE; /* Don't send any message */
@@ -267,7 +267,7 @@ co_UserProcessHotKeys(WORD wVk, BOOL bIsDown)
                    }
                    else
                    {
-                      TRACE("UPM Hot key Id %d Key %d\n",pHotKey->id, wVk );
+                      TRACE("UPM Hot key Id %d Key %u\n", pHotKey->id, wVk );
                       UserPostMessage(UserHMGetHandle(pWnd), WM_HOTKEY, pHotKey->id, MAKELONG(fModifiers, wVk));
                    }
                    //ptiLastInput = pWnd->head.pti;

reactos/win32ss/user/ntuser/input.c

@@ -153,6 +153,9 @@ RawInputThreadMain()
     StartTheTimers();
     UserLeave();
 
+    NT_ASSERT(ghMouseDevice == NULL);
+    NT_ASSERT(ghKeyboardDevice == NULL);
+
     for (;;)
     {
         if (!ghMouseDevice)
@@ -247,10 +250,16 @@ RawInputThreadMain()
                 pSignaledObject = WaitObjects[Status - STATUS_WAIT_0];
 
                 /* Check if it is mouse or keyboard and update status */
-                if (pSignaledObject == &pMouDevice->Event)
+                if ((MouStatus == STATUS_PENDING) &&
+                    (pSignaledObject == &pMouDevice->Event))
+                {
                     MouStatus = MouIosb.Status;
-                else if (pSignaledObject == &pKbdDevice->Event)
+                }
+                else if ((KbdStatus == STATUS_PENDING) &&
+                         (pSignaledObject == &pKbdDevice->Event))
+                {
                     KbdStatus = KbdIosb.Status;
+                }
                 else if (pSignaledObject == MasterTimer)
                 {
                     ProcessTimers();
@@ -414,7 +423,7 @@ IsRemoveAttachThread(PTHREADINFO pti)
     do
     {
        if (!gpai) return TRUE;
- 
+
        pai = gpai; // Bottom of the list.
 
        do
@@ -432,7 +441,7 @@ IsRemoveAttachThread(PTHREADINFO pti)
              break;
           }
           pai = pai->paiNext;
-        
+
        } while (pai);
 
        if (!pai && !ptiFrom && !ptiTo) break;
@@ -529,7 +538,7 @@ UserAttachThreadInput(PTHREADINFO ptiFrom, PTHREADINFO ptiTo, BOOL fAttach)
            }
 
            ptiFrom->MessageQueue->cThreads++;
-           ERR("ptiTo S Share count %d\n", ptiFrom->MessageQueue->cThreads);
+           ERR("ptiTo S Share count %u\n", ptiFrom->MessageQueue->cThreads);
 
            IntReferenceMessageQueue(ptiTo->MessageQueue);
         }
@@ -563,9 +572,9 @@ UserAttachThreadInput(PTHREADINFO ptiFrom, PTHREADINFO ptiTo, BOOL fAttach)
         }
 
         if (!Hit) return STATUS_INVALID_PARAMETER;
- 
+
         ERR("Attach Free! ptiFrom 0x%p  ptiTo 0x%p paiCount %d\n",ptiFrom,ptiTo,paiCount);
- 
+
         if (ptiTo->MessageQueue == ptiFrom->MessageQueue)
         {
            if (gptiForeground == ptiFrom)
@@ -575,7 +584,7 @@ UserAttachThreadInput(PTHREADINFO ptiFrom, PTHREADINFO ptiTo, BOOL fAttach)
               gptiForeground = ptiTo;
            }
            ptiTo->MessageQueue->cThreads--;
-           ERR("ptiTo E Share count %d\n", ptiTo->MessageQueue->cThreads);
+           ERR("ptiTo E Share count %u\n", ptiTo->MessageQueue->cThreads);
            ASSERT(ptiTo->MessageQueue->cThreads >= 1);
 
            IntDereferenceMessageQueue(ptiTo->MessageQueue);

reactos/win32ss/user/ntuser/kbdlayout.c

@@ -204,7 +204,7 @@ cleanup:
  * Loads keyboard layout and creates KL object
  */
 static PKL
-UserLoadKbdLayout(PUNICODE_STRING pwszKLID, HKL hKL)
+UserLoadKbdLayout(PUNICODE_STRING pustrKLID, HKL hKL)
 {
     LCID lCid;
     CHARSETINFO cs;
@@ -219,7 +219,7 @@ UserLoadKbdLayout(PUNICODE_STRING pwszKLID, HKL hKL)
     }
 
     pKl->hkl = hKL;
-    pKl->spkf = UserLoadKbdFile(pwszKLID);
+    pKl->spkf = UserLoadKbdFile(pustrKLID);
 
     /* Dereference keyboard layout */
     UserDereferenceObject(pKl);
@@ -227,20 +227,27 @@ UserLoadKbdLayout(PUNICODE_STRING pwszKLID, HKL hKL)
     /* If we failed, remove KL object */
     if (!pKl->spkf)
     {
-        ERR("UserLoadKbdFile(%wZ) failed!\n", pwszKLID);
+        ERR("UserLoadKbdFile(%wZ) failed!\n", pustrKLID);
         UserDeleteObject(pKl->head.h, TYPE_KBDLAYOUT);
         return NULL;
     }
 
     // Up to Language Identifiers..
-    RtlUnicodeStringToInteger(pwszKLID, (ULONG)16, (PULONG)&lCid);
+    if (!NT_SUCCESS(RtlUnicodeStringToInteger(pustrKLID, 16, (PULONG)&lCid)))
-    TRACE("Language Identifiers %wZ LCID 0x%x\n", pwszKLID, lCid);
+    {
+        ERR("RtlUnicodeStringToInteger failed for '%wZ'\n", pustrKLID);
+        UserDeleteObject(pKl->head.h, TYPE_KBDLAYOUT);
+        return NULL;
+    }
+
+    TRACE("Language Identifiers %wZ LCID 0x%x\n", pustrKLID, lCid);
     if (co_IntGetCharsetInfo(lCid, &cs))
     {
        pKl->iBaseCharset = cs.ciCharset;
        pKl->dwFontSigs = cs.fs.fsCsb[0];
        pKl->CodePage = (USHORT)cs.ciACP;
-       TRACE("Charset %u Font Sig %lu CodePage %u\n", pKl->iBaseCharset, pKl->dwFontSigs, pKl->CodePage);
+       TRACE("Charset %u Font Sig %lu CodePage %u\n",
+             pKl->iBaseCharset, pKl->dwFontSigs, pKl->CodePage);
     }
     else
     {

reactos/win32ss/user/ntuser/keyboard.c

@@ -170,12 +170,16 @@ UserInitKeyboard(HANDLE hKeyboardDevice)
                                    &Block,
                                    IOCTL_KEYBOARD_QUERY_INDICATORS,
                                    NULL, 0,
-                                   &gIndicators, sizeof(gIndicators));
+                                   &gIndicators,
+                                   sizeof(gIndicators));
 
     if (!NT_SUCCESS(Status))
     {
         WARN("NtDeviceIoControlFile() failed, ignored\n");
+        gIndicators.LedFlags = 0;
+        gIndicators.UnitId = 0;
     }
+
     SET_KEY_LOCKED(gafAsyncKeyState, VK_CAPITAL,
                    gIndicators.LedFlags & KEYBOARD_CAPS_LOCK_ON);
     SET_KEY_LOCKED(gafAsyncKeyState, VK_NUMLOCK,
@@ -197,7 +201,7 @@ UserInitKeyboard(HANDLE hKeyboardDevice)
     {
         ERR("NtDeviceIoControlFile() failed, ignored\n");
     }
-    TRACE("Keyboard type %d, subtype %d and number of func keys %d\n",
+    TRACE("Keyboard type %u, subtype %u and number of func keys %u\n",
              gKeyboardInfo.KeyboardIdentifier.Type,
              gKeyboardInfo.KeyboardIdentifier.Subtype,
              gKeyboardInfo.NumberOfFunctionKeys);
@@ -1067,7 +1071,7 @@ UserProcessKeyboardInput(
              but it wouldn't interpret E1 key(s) properly */
     wVk = IntVscToVk(wScanCode, pKbdTbl);
     TRACE("UserProcessKeyboardInput: %x (break: %u) -> %x\n",
-          wScanCode, (pKbdInputData->Flags & KEY_BREAK) ? 1 : 0, wVk);
+          wScanCode, (pKbdInputData->Flags & KEY_BREAK) ? 1u : 0, wVk);
 
     if (wVk)
     {
@@ -1194,7 +1198,7 @@ IntTranslateKbdMessage(LPMSG lpMsg,
         bResult = TRUE;
     }
 
-    TRACE("Leave IntTranslateKbdMessage ret %u, cch %d, msg %x, wch %x\n",
+    TRACE("Leave IntTranslateKbdMessage ret %d, cch %d, msg %x, wch %x\n",
         bResult, cch, NewMsg.message, NewMsg.wParam);
     return bResult;
 }

reactos/win32ss/user/ntuser/main.c

@@ -100,7 +100,8 @@ do { \
  * Called from IntDereferenceProcessInfo
  */
 VOID
-UserDeleteW32Process(PPROCESSINFO ppiCurrent)
+UserDeleteW32Process(
+    _Pre_notnull_ __drv_freesMem(Mem) PPROCESSINFO ppiCurrent)
 {
     if (ppiCurrent->InputIdleEvent)
     {
@@ -863,7 +864,7 @@ Win32kThreadCallback(PETHREAD Thread,
     return Status;
 }
 
-
+_Function_class_(DRIVER_UNLOAD)
 VOID NTAPI
 DriverUnload(IN PDRIVER_OBJECT DriverObject)
 {

reactos/win32ss/user/ntuser/menu.c

@@ -286,7 +286,7 @@ int FASTCALL MENU_depth( PMENU pmenu, int depth)
     if( depth > MAXMENUDEPTH) return depth;
     item = pmenu->rgItems;
     subdepth = depth;
-    for( i = 0; item, i < pmenu->cItems && subdepth <= MAXMENUDEPTH; i++, item++)
+    for( i = 0; i < pmenu->cItems && subdepth <= MAXMENUDEPTH; i++, item++)
     {
         if( item->spSubMenu)//VerifyMenu(item->spSubMenu))
         {
@@ -323,7 +323,7 @@ PITEM FASTCALL MENU_FindItem( PMENU *pmenu, UINT *nPos, UINT wFlags )
     else
     {
         PITEM item = menu->rgItems;
-	for (i = 0; item, i < menu->cItems; i++, item++)
+	for (i = 0; i < menu->cItems; i++, item++)
 	{
 	    if (item->spSubMenu)
 	    {
@@ -478,7 +478,7 @@ IntInsertMenuItem(
    SubMenu->cyMenu = 0;
    MenuItem->hbmpChecked = MenuItem->hbmpUnchecked = 0;
 
-   TRACE("IntInsertMenuItemToList = %i %d\n", uItem, (BOOL)((INT)uItem >= 0));
+   TRACE("IntInsertMenuItemToList = %u %i\n", uItem, (BOOL)((INT)uItem >= 0));
 
    return TRUE;
 }
@@ -1033,7 +1033,7 @@ UserSetMenuDefaultItem(PMENU MenuObject, UINT uItem, UINT fByPos)
    if (!MenuItem) return FALSE;
 
    /* reset all default-item flags */
-   for (i = 0; MenuItem, i < MenuObject->cItems; i++, MenuItem++)
+   for (i = 0; i < MenuObject->cItems; i++, MenuItem++)
    {
        MenuItem->fState &= ~MFS_DEFAULT;
    }
@@ -1052,7 +1052,7 @@ UserSetMenuDefaultItem(PMENU MenuObject, UINT uItem, UINT fByPos)
    }
    else
    {
-      for (i = 0; MenuItem, i < MenuObject->cItems; i++, MenuItem++)
+      for (i = 0; i < MenuObject->cItems; i++, MenuItem++)
       {
           if (MenuItem->wID == uItem)
           {
@@ -1623,7 +1623,7 @@ IntGetMenuItemRect(
    }
    else
    {
-      ERR("Failed Item Lookup! %d\n", uItem);
+      ERR("Failed Item Lookup! %u\n", uItem);
       return FALSE;
    }
 
@@ -2162,7 +2162,7 @@ NtUserGetMenuBarInfo(
             RETURN(FALSE);
         if (pWnd->pcls->fnid != FNID_MENU)
         {
-            WARN("called on invalid window: %d\n", pWnd->pcls->fnid);
+            WARN("called on invalid window: %u\n", pWnd->pcls->fnid);
             EngSetLastError(ERROR_INVALID_MENU_HANDLE);
             RETURN(FALSE);
         }

reactos/win32ss/user/ntuser/message.c

@@ -319,6 +319,7 @@ PackParam(LPARAM *lParamPacked, UINT Msg, WPARAM wParam, LPARAM lParam, BOOL Non
         }
         else
         {
+            NT_ASSERT(ClassName->Buffer != NULL);
             *((WCHAR *) CsData) = L'S';
             CsData += sizeof(WCHAR);
             RtlCopyMemory(CsData, ClassName->Buffer, ClassName->Length);
@@ -444,7 +445,7 @@ CopyMsgToKernelMem(MSG *KernelModeMsg, MSG *UserModeMsg, PMSGMEMORY MsgMemoryEnt
         /* Copy data if required */
         if (0 != (MsgMemoryEntry->Flags & MMS_FLAG_READ))
         {
-            TRACE("Copy Message %d from usermode buffer\n", KernelModeMsg->message);
+            TRACE("Copy Message %u from usermode buffer\n", KernelModeMsg->message);
             Status = MmCopyFromCaller(KernelMem, (PVOID) UserModeMsg->lParam, Size);
             if (! NT_SUCCESS(Status))
             {
@@ -612,7 +613,7 @@ static LRESULT handle_internal_message( PWND pWnd, UINT msg, WPARAM wparam, LPAR
          pWnd == UserGetMessageWindow() )  // pWnd->fnid == FNID_MESSAGEWND
        return 0;
 
-    TRACE("Internal Event Msg %p hWnd 0x%x\n",msg,pWnd->head.h);
+    TRACE("Internal Event Msg 0x%x hWnd 0x%p\n", msg, pWnd->head.h);
 
     switch(msg)
     {
@@ -1225,7 +1226,7 @@ UserPostMessage( HWND Wnd,
         Window = UserGetWindowObject(Wnd);
         if ( !Window )
         {
-            ERR("UserPostMessage: Invalid handle 0x%p Msg %d!\n",Wnd,Msg);
+            ERR("UserPostMessage: Invalid handle 0x%p Msg 0x%x!\n", Wnd, Msg);
             return FALSE;
         }
 

reactos/win32ss/user/ntuser/misc.c

@@ -58,7 +58,7 @@ UserGetLanguageID(VOID)
   HANDLE KeyHandle;
   OBJECT_ATTRIBUTES ObAttr;
 //  http://support.microsoft.com/kb/324097
-  ULONG Ret = 0x409; // English
+  ULONG Ret = MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT);
   PKEY_VALUE_PARTIAL_INFORMATION pKeyInfo;
   ULONG Size = sizeof(KEY_VALUE_PARTIAL_INFORMATION) + MAX_PATH*sizeof(WCHAR);
   UNICODE_STRING Language;
@@ -87,7 +87,10 @@ UserGetLanguageID(VOID)
                                              &Size)) )
       {
         RtlInitUnicodeString(&Language, (PWSTR)pKeyInfo->Data);
-        RtlUnicodeStringToInteger(&Language, 16, &Ret);
+        if (!NT_SUCCESS(RtlUnicodeStringToInteger(&Language, 16, &Ret)))
+        {
+            Ret = MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT);
+        }
       }
       ExFreePoolWithTag(pKeyInfo, TAG_STRING);
     }

reactos/win32ss/user/ntuser/misc/file.c

@@ -83,7 +83,7 @@ W32kCreateFileSection(HANDLE hFile,
                       ULONGLONG ullMaxSize)
 {
     NTSTATUS Status;
-    HANDLE hSection = NULL;
+    HANDLE hSection;
     ACCESS_MASK amDesiredAccess;
 
     /* Set access mask */
@@ -107,6 +107,7 @@ W32kCreateFileSection(HANDLE hFile,
     if (!NT_SUCCESS(Status))
     {
         SetLastNtError(Status);
+        hSection = NULL;
     }
 
     DPRINT("Leaving W32kCreateFileSection, Status=0x%lx, hSection=0x%p\n", Status, hSection);
@@ -125,7 +126,7 @@ W32kMapViewOfSection(
     NTSTATUS Status;
     LARGE_INTEGER liSectionOffset;
     ULONG_PTR ulViewSize;
-    PVOID pvBase = 0;
+    PVOID pvBase = NULL;
 
     liSectionOffset.QuadPart = ulViewSize = ulSectionOffset;
     Status = ZwMapViewOfSection(hSection,
@@ -141,6 +142,7 @@ W32kMapViewOfSection(
     if (!NT_SUCCESS(Status))
     {
         SetLastNtError(Status);
+        pvBase = NULL;
     }
 
     DPRINT("Leaving W32kMapViewOfSection, Status=0x%lx, pvBase=0x%p\n", Status, pvBase);

reactos/win32ss/user/ntuser/misc/registry.c

@@ -82,19 +82,34 @@ RegQueryValue(
                              cbInfoSize,
                              &cbInfoSize);
 
-    cbDataSize = pInfo->DataLength;
-
     /* Note: STATUS_BUFFER_OVERFLOW is not a success */
     if (NT_SUCCESS(Status))
     {
+        cbDataSize = pInfo->DataLength;
+
         /* Did we get the right type */
-        if (pInfo->Type == ulType)
+        if (pInfo->Type != ulType)
+        {
+            Status = STATUS_OBJECT_TYPE_MISMATCH;
+        }
+        else if (cbDataSize > *pcbValue)
+        {
+            Status = STATUS_BUFFER_TOO_SMALL;
+        }
+        else
         {
             /* Copy the contents to the caller */
             RtlCopyMemory(pvData, pInfo->Data, cbDataSize);
         }
-        else
+    }
-            Status = STATUS_OBJECT_TYPE_MISMATCH;
+    else if ((Status == STATUS_BUFFER_OVERFLOW) || (Status == STATUS_BUFFER_TOO_SMALL))
+    {
+        _PRAGMA_WARNING_SUPPRESS(6102); /* cbInfoSize is initialized here! */
+        cbDataSize = cbInfoSize - FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data);
+    }
+    else
+    {
+        cbDataSize = 0;
     }
 
     /* Return the data size to the caller */
@@ -140,14 +155,15 @@ RegReadDWORD(HKEY hkey, PWSTR pwszValue, PDWORD pdwData)
     return NT_SUCCESS(Status);
 }
 
+_Success_(return!=FALSE)
 BOOL
 NTAPI
 RegReadUserSetting(
-    IN PCWSTR pwszKeyName,
+    _In_z_ PCWSTR pwszKeyName,
-    IN PCWSTR pwszValueName,
+    _In_z_ PCWSTR pwszValueName,
-    IN ULONG ulType,
+    _In_ ULONG ulType,
-    OUT PVOID pvData,
+    _Out_writes_(cbDataSize) _When_(ulType == REG_SZ, _Post_z_) PVOID pvData,
-    IN ULONG cbDataSize)
+    _In_ ULONG cbDataSize)
 {
     NTSTATUS Status;
     OBJECT_ATTRIBUTES ObjectAttributes;

reactos/win32ss/user/ntuser/monitor.c

@@ -542,7 +542,8 @@ NtUserEnumDisplayMonitors(
     OPTIONAL OUT PRECTL prcUnsafeMonitorList,
     OPTIONAL IN DWORD dwListSize)
 {
-    INT cMonitors, iRet = -1, i;
+    UINT cMonitors, i;
+    INT iRet = -1;
     HMONITOR *phMonitorList = NULL;
     PRECTL prcMonitorList = NULL;
     RECTL rc, *pRect;
@@ -619,7 +620,7 @@ NtUserEnumDisplayMonitors(
         (phUnsafeMonitorList == NULL && prcUnsafeMonitorList == NULL))
     {
         /* Simple case - just return monitors count */
-        TRACE("cMonitors = %d\n", cMonitors);
+        TRACE("cMonitors = %u\n", cMonitors);
         iRet = cMonitors;
         goto cleanup;
     }
@@ -636,7 +637,7 @@ NtUserEnumDisplayMonitors(
     }
     if (prcUnsafeMonitorList != NULL && dwListSize != 0)
     {
-        prcMonitorList = ExAllocatePoolWithTag(PagedPool, sizeof (RECT) * dwListSize, USERTAG_MONITORRECTS);
+        prcMonitorList = ExAllocatePoolWithTag(PagedPool, sizeof(RECT) * dwListSize,USERTAG_MONITORRECTS);
         if (prcMonitorList == NULL)
         {
             EngSetLastError(ERROR_NOT_ENOUGH_MEMORY);
@@ -649,13 +650,16 @@ NtUserEnumDisplayMonitors(
                                        dwListSize, MONITOR_DEFAULTTONULL);
 
     if (hdc != NULL && pRect != NULL && prcMonitorList != NULL)
-        for (i = 0; i < cMonitors; i++)
+    {
+        for (i = 0; i < min(cMonitors, dwListSize); i++)
         {
+            _Analysis_assume_(i < dwListSize);
             prcMonitorList[i].left -= DcRect.left;
             prcMonitorList[i].right -= DcRect.left;
             prcMonitorList[i].top -= DcRect.top;
             prcMonitorList[i].bottom -= DcRect.top;
         }
+    }
 
     /* Output result */
     if (phUnsafeMonitorList != NULL && dwListSize != 0)

reactos/win32ss/user/ntuser/msgqueue.c

@@ -738,7 +738,8 @@ MsqDestroyMessage(PUSER_MESSAGE Message)
 }
 
 BOOLEAN FASTCALL
-co_MsqDispatchOneSentMessage(PTHREADINFO pti)
+co_MsqDispatchOneSentMessage(
+    _In_ PTHREADINFO pti)
 {
    PUSER_SENT_MESSAGE SaveMsg, Message;
    PLIST_ENTRY Entry;
@@ -2107,7 +2108,10 @@ MsqCleanupThreadMsgs(PTHREADINFO pti)
       if (CurrentSentMessage->HasPackedLParam)
       {
          if (CurrentSentMessage->Msg.lParam)
+         {
+            _PRAGMA_WARNING_SUPPRESS(__WARNING_USING_UNINIT_VAR);
             ExFreePool((PVOID)CurrentSentMessage->Msg.lParam);
+         }
       }
 
       /* free the message */
@@ -2219,11 +2223,12 @@ MsqCreateMessageQueue(PTHREADINFO pti)
 }
 
 VOID FASTCALL
-MsqDestroyMessageQueue(PTHREADINFO pti)
+MsqDestroyMessageQueue(_In_ PTHREADINFO pti)
 {
    PDESKTOP desk;
    PUSER_MESSAGE_QUEUE MessageQueue = pti->MessageQueue;
 
+   NT_ASSERT(MessageQueue != NULL);
    MessageQueue->QF_flags |= QF_INDESTROY;
 
    /* remove the message queue from any desktops */
@@ -2237,6 +2242,7 @@ MsqDestroyMessageQueue(PTHREADINFO pti)
    MsqCleanupMessageQueue(pti);
 
    /* decrease the reference counter, if it hits zero, the queue will be freed */
+   _PRAGMA_WARNING_SUPPRESS(__WARNING_USING_UNINIT_VAR);
    IntDereferenceMessageQueue(MessageQueue);
 }
 

reactos/win32ss/user/ntuser/msgqueue.h

@@ -146,9 +146,9 @@ co_MsqPeekHardwareMessage(IN PTHREADINFO pti,
 BOOLEAN FASTCALL MsqInitializeMessageQueue(PTHREADINFO, PUSER_MESSAGE_QUEUE);
 PUSER_MESSAGE_QUEUE FASTCALL MsqCreateMessageQueue(PTHREADINFO);
 VOID FASTCALL MsqCleanupThreadMsgs(PTHREADINFO);
-VOID FASTCALL MsqDestroyMessageQueue(PTHREADINFO);
+VOID FASTCALL MsqDestroyMessageQueue(_In_ PTHREADINFO pti);
 INIT_FUNCTION NTSTATUS NTAPI MsqInitializeImpl(VOID);
-BOOLEAN FASTCALL co_MsqDispatchOneSentMessage(PTHREADINFO pti);
+BOOLEAN FASTCALL co_MsqDispatchOneSentMessage(_In_ PTHREADINFO pti);
 NTSTATUS FASTCALL
 co_MsqWaitForNewMessages(PTHREADINFO pti, PWND WndFilter,
                       UINT MsgFilterMin, UINT MsgFilterMax);

reactos/win32ss/user/ntuser/ntstubs.c

@@ -479,7 +479,7 @@ NtUserConsoleControl(
         }
 
         default:
-            ERR("Calling invalid control %lu in NtUserConsoleControl\n", ConsoleCtrl);
+            ERR("Calling invalid control %d in NtUserConsoleControl\n", ConsoleCtrl);
             Status = STATUS_INVALID_INFO_CLASS;
             break;
     }

reactos/win32ss/user/ntuser/object.c

@@ -13,6 +13,7 @@ DBG_DEFAULT_CHANNEL(UserObj);
 PUSER_HANDLE_TABLE gHandleTable = NULL;
 
 /* Forward declarations */
+_Success_(return!=NULL)
 static PVOID AllocThreadObject(
     _In_ PDESKTOP pDesk,
     _In_ PTHREADINFO pti,
@@ -53,6 +54,7 @@ static void FreeThreadObject(
     IntDereferenceThreadInfo(pti);
 }
 
+_Success_(return!=NULL)
 static PVOID AllocDeskThreadObject(
     _In_ PDESKTOP pDesk,
     _In_ PTHREADINFO pti,
@@ -97,6 +99,7 @@ static void FreeDeskThreadObject(
     IntDereferenceThreadInfo(pti);
 }
 
+_Success_(return!=NULL)
 static PVOID AllocDeskProcObject(
     _In_ PDESKTOP pDesk,
     _In_ PTHREADINFO pti,
@@ -141,6 +144,7 @@ static void FreeDeskProcObject(
     DesktopHeapFree(pDesk, Object);
 }
 
+_Success_(return!=NULL)
 static PVOID AllocProcMarkObject(
     _In_ PDESKTOP pDesk,
     _In_ PTHREADINFO pti,
@@ -179,6 +183,7 @@ void FreeProcMarkObject(
     IntDereferenceProcessInfo(ppi);
 }
 
+_Success_(return!=NULL)
 static PVOID AllocSysObject(
     _In_ PDESKTOP pDesk,
     _In_ PTHREADINFO pti,

reactos/win32ss/user/ntuser/painting.c

@@ -419,7 +419,7 @@ co_IntPaintWindows(PWND Wnd, ULONG Flags, BOOL Recurse)
 VOID FASTCALL
 IntInvalidateWindows(PWND Wnd, PREGION Rgn, ULONG Flags)
 {
-   INT RgnType;
+   INT RgnType = NULLREGION;
    BOOL HadPaintMessage;
 
    TRACE("IntInvalidateWindows start\n");
@@ -986,7 +986,7 @@ IntFlashWindowEx(PWND pWnd, PFLASHWINFO pfwi)
       // Set previous window state.
       Ret = !!(FlashState & FLASHW_ACTIVE);
 
-      if ( pfwi->dwFlags & FLASHW_TIMERNOFG && 
+      if ( pfwi->dwFlags & FLASHW_TIMERNOFG &&
            gpqForeground == pWnd->head.pti->MessageQueue )
       {
           // Flashing until foreground, set this to Stop.
@@ -1390,8 +1390,11 @@ CLEANUP:
            EngSetLastError(ERROR_INVALID_HANDLE);
            _ret_ = ERROR;
        }
-       IntGdiCombineRgn(TheRgn, Rgn, NULL, RGN_COPY);
+       else
-       REGION_UnlockRgn(TheRgn);
+       {
+          IntGdiCombineRgn(TheRgn, Rgn, NULL, RGN_COPY);
+          REGION_UnlockRgn(TheRgn);
+       }
    }
 
    if (Rgn)
@@ -1604,7 +1607,12 @@ UserScrollDC(
    RECTL rcScroll, rcClip, rcSrc, rcDst;
    INT Result;
 
-   GdiGetClipBox(hDC, &rcClip);
+   if (GdiGetClipBox(hDC, &rcClip) == ERROR)
+   {
+       ERR("GdiGetClipBox failed for HDC %p\n", hDC);
+       return ERROR;
+   }
+
    rcScroll = rcClip;
    if (prcClip)
    {

reactos/win32ss/user/ntuser/prop.c

@@ -26,7 +26,7 @@ IntGetProp(PWND Window, ATOM Atom)
 
       if (ListEntry == NULL)
       {
-          ERR("Corrupted (or uninitialized?) property list for window %p. Prop count %d. Atom %d.\n",
+          ERR("Corrupted (or uninitialized?) property list for window %p. Prop count %u. Atom %u.\n",
               Window, Window->PropListItems, Atom);
           return NULL;
       }

reactos/win32ss/user/ntuser/shutdown.c

@@ -64,11 +64,10 @@ IntClientShutdown(IN PWND pWindow,
             }
         }
         ExFreePoolWithTag(List, USERTAG_WINDOWLIST);
+        if (lResult == MCSR_DONOTSHUTDOWN)
+            return lResult;
     }
 
-    if (List && (lResult == MCSR_DONOTSHUTDOWN))
-        return lResult;
-
     /* Send to the caller */
     if (wParam & MCS_QUERYENDSESSION)
     {

reactos/win32ss/user/ntuser/sysparams.c

@@ -570,14 +570,18 @@ SpiSetUserPref(DWORD dwMask, PVOID pvValue, FLONG fl)
     if (fl & SPIF_UPDATEINIFILE)
     {
         /* Read current value */
-        RegReadUserSetting(KEY_DESKTOP,
+        if (!RegReadUserSetting(KEY_DESKTOP,
-                           VAL_USERPREFMASK,
+                                VAL_USERPREFMASK,
-                           REG_BINARY,
+                                REG_BINARY,
-                           &dwRegMask,
+                                &dwRegMask,
-                           sizeof(DWORD));
+                                sizeof(DWORD)))
+        {
+            WARN("Failed to read UserPreferencesMask setting\n");
+            dwRegMask = 0;
+        }
 
         /* Set or clear bit according to bValue */
-        dwRegMask = bValue ? dwRegMask | dwMask : dwRegMask & ~dwMask;
+        dwRegMask = bValue ? (dwRegMask | dwMask) : (dwRegMask & ~dwMask);
 
         /* write back value */
         RegWriteUserSetting(KEY_DESKTOP,

reactos/win32ss/user/ntuser/timer.c

@@ -571,7 +571,7 @@ BOOL FASTCALL
 IntKillTimer(PWND Window, UINT_PTR IDEvent, BOOL SystemTimer)
 {
    PTIMER pTmr = NULL;
-   TRACE("IntKillTimer Window %p id %p systemtimer %s\n",
+   TRACE("IntKillTimer Window %p id %uI systemtimer %s\n",
          Window, IDEvent, SystemTimer ? "TRUE" : "FALSE");
 
    TimerEnterExclusive();

reactos/win32ss/user/ntuser/win32.h

@@ -175,7 +175,7 @@ do { \
 #define IntReferenceProcessInfo(ppi) \
     InterlockedIncrement((volatile LONG*)(&(ppi)->RefCount))
 
-VOID UserDeleteW32Process(PPROCESSINFO);
+VOID UserDeleteW32Process(_Pre_notnull_ __drv_freesMem(Mem) PPROCESSINFO);
 
 #define IntDereferenceProcessInfo(ppi) \
 do { \

reactos/win32ss/user/ntuser/window.c

@@ -594,7 +594,7 @@ LRESULT co_UserFreeWindow(PWND Window,
    if (Window->PropListItems)
    {
       IntRemoveWindowProp(Window);
-      TRACE("Window->PropListItems %d\n",Window->PropListItems);
+      TRACE("Window->PropListItems %lu\n",Window->PropListItems);
       ASSERT(Window->PropListItems==0);
    }
 
@@ -610,6 +610,7 @@ LRESULT co_UserFreeWindow(PWND Window,
    }
 
    /* dereference the class */
+   NT_ASSERT(Window->head.pti != NULL);
    IntDereferenceClass(Window->pcls,
                        Window->head.pti->pDeskInfo,
                        Window->head.pti->ppi);
@@ -1170,7 +1171,7 @@ co_IntSetParent(PWND Wnd, PWND WndNewParent)
    {
       if ( Wnd->spwndParent != co_GetDesktopWindow(Wnd))
       {
-         if (Wnd->head.pti != WndOldParent->head.pti)
+         if (WndOldParent && (Wnd->head.pti != WndOldParent->head.pti))
          {
             //ERR("SetParent Old out.\n");
             UserAttachThreadInput(Wnd->head.pti, WndOldParent->head.pti, FALSE);
@@ -2483,10 +2484,7 @@ NtUserCreateWindowEx(
     Cs.x = x;
     Cs.y = y;
     Cs.lpszName = (LPCWSTR) plstrWindowName->Buffer;
-    if (IS_ATOM(plstrClassName))
+    Cs.lpszClass = ustrClassName.Buffer;
-       Cs.lpszClass = (LPCWSTR) plstrClassName;
-    else
-       Cs.lpszClass = (LPCWSTR) plstrClassName->Buffer;
     Cs.dwExStyle = dwExStyle;
 
     UserEnterExclusive();
@@ -3181,12 +3179,7 @@ NtUserGetComboBoxInfo(
    }
    _SEH2_TRY
    {
-       if(pcbi)
+        ProbeForWrite(pcbi, sizeof(COMBOBOXINFO), 1);
-       {
-          ProbeForWrite(pcbi,
-                        sizeof(COMBOBOXINFO),
-                        1);
-       }
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {

reactos/win32ss/user/ntuser/winpos.c

@@ -372,7 +372,7 @@ co_WinPosActivateOtherWindow(PWND Wnd)
 done:
    if (WndTo) UserRefObjectCo(WndTo, &Ref);
 
-   if ((gpqForeground && !gpqForeground->spwndActive) || Wnd == gpqForeground->spwndActive)
+   if (gpqForeground && (!gpqForeground->spwndActive || Wnd == gpqForeground->spwndActive))
    {
       /* ReactOS can pass WndTo = NULL to co_IntSetForegroundWindow and returns FALSE. */
       //ERR("WinPosActivateOtherWindow Set FG 0x%p hWnd %p\n",WndTo, WndTo ? WndTo->head.h : 0);
@@ -2218,7 +2218,8 @@ co_WinPosShowWindow(PWND Wnd, INT Cmd)
    WasVisible = (Wnd->style & WS_VISIBLE) != 0;
    style = Wnd->style;
 
-   TRACE("co_WinPosShowWindow START hwnd %p Cmd %d usicmd %d\n",Wnd->head.h,Cmd,pti->ppi->usi.wShowWindow);
+   TRACE("co_WinPosShowWindow START hwnd %p Cmd %d usicmd %u\n",
+         Wnd->head.h, Cmd, pti->ppi->usi.wShowWindow);
 
    if ( pti->ppi->usi.dwFlags & STARTF_USESHOWWINDOW )
    {
@@ -2378,7 +2379,7 @@ co_WinPosShowWindow(PWND Wnd, INT Cmd)
 
    if ((ShowFlag != WasVisible || Cmd == SW_SHOWNA) && Cmd != SW_SHOWMAXIMIZED && !(Swp & SWP_STATECHANGED))
    {
-      co_IntSendMessageNoWait(Wnd->head.h, WM_SHOWWINDOW, ShowFlag, 0);      
+      co_IntSendMessageNoWait(Wnd->head.h, WM_SHOWWINDOW, ShowFlag, 0);
 #if 0 // Fix wine msg test_SetParent:WmSetParentSeq_1:2
       if (!(Wnd->state2 & WNDS2_WIN31COMPAT)) // <------------- XP sets this bit!
          co_IntSendMessageNoWait(Wnd->head.h, WM_SETVISIBLE, ShowFlag, 0);
@@ -2517,7 +2518,7 @@ co_WinPosSearchChildren(
     }
 
     /* not minimized and check if point is inside the window */
-    if (!(ScopeWin->style & WS_MINIMIZE) && 
+    if (!(ScopeWin->style & WS_MINIMIZE) &&
          RECTL_bPointInRect(&ScopeWin->rcClient, Point->x, Point->y) )
     {
         UserReferenceObject(ScopeWin);

reactos/win32ss/user/ntuser/winsta.c

@@ -669,7 +669,7 @@ NtUserGetObjectInformation(
    DWORD nLength,
    PDWORD nLengthNeeded)
 {
-   PWINSTATION_OBJECT WinStaObject = NULL;
+   PWINSTATION_OBJECT WinStaObject;
    PDESKTOP DesktopObject = NULL;
    NTSTATUS Status;
    PVOID pvData = NULL;
@@ -702,6 +702,7 @@ NtUserGetObjectInformation(
    {
       /* try desktop */
       TRACE("Trying to open desktop %p\n", hObject);
+      WinStaObject = NULL;
       Status = IntValidateDesktopHandle(
                   hObject,
                   UserMode,
@@ -934,7 +935,7 @@ UserSetProcessWindowStation(HWINSTA hWindowStation)
    ppi->prpwinsta = NewWinSta;
    ppi->hwinsta = hWindowStation;
    ppi->amwinsta = hWindowStation != NULL ? ObjectHandleInfo.GrantedAccess : 0;
-   TRACE("WS : Granted Access %p\n",ppi->amwinsta);
+   TRACE("WS : Granted Access 0x%08lx\n",ppi->amwinsta);
 
    if (RtlAreAllAccessesGranted(ppi->amwinsta, WINSTA_READSCREEN))
    {
@@ -1133,10 +1134,11 @@ BuildWindowStationNameList(
       /* Need a larger buffer, check how large exactly */
       Status = ZwQueryDirectoryObject(DirectoryHandle, NULL, 0, FALSE, TRUE, &Context,
                                       &ReturnLength);
-      if (STATUS_BUFFER_TOO_SMALL == Status)
+      if (!NT_SUCCESS(Status))
       {
+         ERR("ZwQueryDirectoryObject failed\n");
          ObDereferenceObject(DirectoryHandle);
-         return STATUS_NO_MEMORY;
+         return Status;
       }
 
       BufferSize = ReturnLength;