Author: mjmartin
Date: Sat May 1 15:32:38 2010
New Revision: 47075
URL: http://svn.reactos.org/svn/reactos?rev=47075&view=rev
Log:
[win32k]
- Only call ExFreePool.. if Buffer is not NULL, which can occur if the Unicode String MessageNameUnsafe coming from user mode is incorrect. Fixes a bugcheck when using OllyDbg V2.0.
Modified:
trunk/reactos/subsystems/win32/win32k/ntuser/window.c
Modified: trunk/reactos/subsystems/win32/win32k/ntuser/window.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/nt…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/ntuser/window.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/win32k/ntuser/window.c [iso-8859-1] Sat May 1 15:32:38 2010
@@ -4268,8 +4268,8 @@
}
Ret = (UINT)IntAddAtom(SafeMessageName.Buffer);
-
- ExFreePoolWithTag(SafeMessageName.Buffer, TAG_STRING);
+ if (SafeMessageName.Buffer)
+ ExFreePoolWithTag(SafeMessageName.Buffer, TAG_STRING);
RETURN( Ret);
CLEANUP:
Author: mjmartin
Date: Sat May 1 14:02:23 2010
New Revision: 47073
URL: http://svn.reactos.org/svn/reactos?rev=47073&view=rev
Log:
[win32k]
- Revert the hack done in 47059 to apply a better solution.
- co_IntCreateWindowEx: Add the WNDS2_WMCREATEMSGPROCESSED flag to state2 member of WND after sending the WM_CREATE message.
- By setting this flag it can be examined elsewhere to determine if the window was created successfully.
- co_UserDestroyWindow: Examine above mentioned flag to make sure the windows was created before calling hook procedure to inform of destroying window.
Modified:
trunk/reactos/subsystems/win32/win32k/ntuser/window.c
Modified: trunk/reactos/subsystems/win32/win32k/ntuser/window.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/nt…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/ntuser/window.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/win32k/ntuser/window.c [iso-8859-1] Sat May 1 14:02:23 2010
@@ -2333,6 +2333,11 @@
IntNotifyWinEvent(EVENT_OBJECT_CREATE, Window->Wnd, OBJID_WINDOW, 0);
+ /* By setting the flag below it can be examined to determine if the window
+ was created successfully and a valid pwnd was passed back to caller since
+ from here the function has to succeed. */
+ Window->Wnd->state2 |= WNDS2_WMCREATEMSGPROCESSED;
+
/* Send move and size messages. */
if (!(Window->state & WINDOWOBJECT_NEED_SIZE))
{
@@ -2468,23 +2473,7 @@
CLEANUP:
if (!_ret_ && Window && Window->Wnd && ti)
- {
- ULONG SavedHooks;
- /* HACK: co_UserDestroyWindow will call CBT proc with code HCBT_DESTROYWND.
- Applications can choke on this as a hwnd was never returned from this call */
- /* Save the flags */
- SavedHooks = ((PTHREADINFO)PsGetCurrentThreadWin32Thread())->fsHooks;
-
- /* Temporary remove the flag */
- ((PTHREADINFO)PsGetCurrentThreadWin32Thread())->fsHooks &= ~HOOKID_TO_FLAG(WH_CBT);
-
- /* Destroy the window */
co_UserDestroyWindow(Window);
-
- /* Restore the flag */
- ((PTHREADINFO)PsGetCurrentThreadWin32Thread())->fsHooks = SavedHooks;
- }
-
// UserFreeWindowInfo(ti, Window);
if (Window)
{
@@ -2649,8 +2638,8 @@
return FALSE;
}
- /* Call hooks */
- if (ISITHOOKED(WH_CBT))
+ /* If window was created successfully and it is hooked */
+ if ((Wnd->state2 & WNDS2_WMCREATEMSGPROCESSED) && (ISITHOOKED(WH_CBT)))
{
if (co_HOOK_CallHooks(WH_CBT, HCBT_DESTROYWND, (WPARAM) hWnd, 0)) return FALSE;
}
Author: janderwald
Date: Sat May 1 11:55:16 2010
New Revision: 47069
URL: http://svn.reactos.org/svn/reactos?rev=47069&view=rev
Log:
[WIN32K]
<bug>
- The timer implementation uses a bitmap to store window-less timers. As an optimization to find the first free index, it uses the variable "HintIndex" which points to the first timer index. In order to find the next free index, the RtlFindClearBitsAndSet function is used. When a new timer is allocated, the "HintIndex" variable is increased, which increases the search offset. Now if more than NUM_WINDOW_LESS_TIMERS (1024) timers are allocated, no more timers can be allocated because RtlFindClearBitsAndSet will claim no more index are available, because the free indexes are below the search offset.
</bug>
<fix>
Everytime a timer gets freed, store the freed index in "HintIndex". As a result the timer implementation will always find a free timer index (when there is one)
</fix>
Modified:
trunk/reactos/subsystems/win32/win32k/ntuser/timer.c
Modified: trunk/reactos/subsystems/win32/win32k/ntuser/timer.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/nt…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/ntuser/timer.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/win32k/ntuser/timer.c [iso-8859-1] Sat May 1 11:55:16 2010
@@ -526,6 +526,8 @@
ASSERT(RtlAreBitsSet(&WindowLessTimersBitMap, IDEvent - 1, 1));
RtlClearBits(&WindowLessTimersBitMap, IDEvent - 1, 1);
+ HintIndex = IDEvent - 1;
+
IntUnlockWindowlessTimerBitmap();
}