Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-06-30 18:01:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

[NTUSER] Security: Follow-up of #4595 (#4598)

Browse source 
Improve security. CORE-11700
This commit is contained in:
Katayama Hirofumi MZ 2022-08-08 21:23:49 +09:00 committed by GitHub
parent f7d068e2bd
commit d519b11a28
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
win32ss/user/ntuser/kbdlayout.c
View file

@ -654,7 +654,8 @@ NtUserGetKeyboardLayoutName(
BOOL bRet = FALSE; BOOL bRet = FALSE;
PKL pKl; PKL pKl;
PTHREADINFO pti; PTHREADINFO pti;
UNICODE_STRING ustrTemp; UNICODE_STRING ustrNameSafe;
NTSTATUS Status;
UserEnterShared(); UserEnterShared();
@ -667,25 +668,33 @@ NtUserGetKeyboardLayoutName(
_SEH2_TRY _SEH2_TRY
{ {
ProbeForWriteUnicodeString(pustrName); ProbeForWriteUnicodeString(pustrName);
ProbeForWrite(pustrName->Buffer, pustrName->MaximumLength, 1); ustrNameSafe = *pustrName;
ProbeForWrite(ustrNameSafe.Buffer, ustrNameSafe.MaximumLength, 1);
if (IS_IME_HKL(pKl->hkl)) if (IS_IME_HKL(pKl->hkl))
{ {
RtlIntegerToUnicodeString((ULONG)(ULONG_PTR)pKl->hkl, 16, pustrName); Status = RtlIntegerToUnicodeString((ULONG)(ULONG_PTR)pKl->hkl, 16, &ustrNameSafe);
} }
else else
{ {
if (pustrName->MaximumLength < KL_NAMELENGTH * sizeof(WCHAR)) if (ustrNameSafe.MaximumLength < KL_NAMELENGTH * sizeof(WCHAR))
{ {
EngSetLastError(ERROR_INVALID_PARAMETER); EngSetLastError(ERROR_INVALID_PARAMETER);
goto cleanup; goto cleanup;
} }
RtlInitUnicodeString(&ustrTemp, pKl->spkf->awchKF); /* FIXME: Do not use awchKF */
RtlCopyUnicodeString(pustrName, &ustrTemp); /* FIXME: Do not use awchKF */
ustrNameSafe.Length = 0;
Status = RtlAppendUnicodeToString(&ustrNameSafe, pKl->spkf->awchKF);
} }
if (NT_SUCCESS(Status))
{
*pustrName = ustrNameSafe;
bRet = TRUE; bRet = TRUE;
} }
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{ {
SetLastNtError(_SEH2_GetExceptionCode()); SetLastNtError(_SEH2_GetExceptionCode());