MmCopyToCaller( ) fails if destination points to an address in kmode

reactos/subsys/win32k/include

diff -u -r1.1.4.12 -r1.1.4.13
--- internal.h	24 Sep 2004 18:35:40 -0000	1.1.4.12
+++ internal.h	27 Sep 2004 03:37:53 -0000	1.1.4.13
@@ -945,6 +945,7 @@

 DWORD          INTERNAL_CALL IntRemoveWndProcHandle(WNDPROC Handle);
 DWORD          INTERNAL_CALL IntRemoveProcessWndProcHandles(HANDLE ProcessID);
 DWORD          INTERNAL_CALL IntAddWndProcHandle(WNDPROC WindowProc, BOOL IsUnicode);

+INT            INTERNAL_CALL UnsafeIntNtGdiGetRgnBox ( HRGN hRgn, LPRECT pRect );

 
 /* WINPOS *********************************************************************/
 

reactos/subsys/win32k/ntuser

diff -u -r1.84.2.5 -r1.84.2.6
--- painting.c	27 Sep 2004 01:38:36 -0000	1.84.2.5
+++ painting.c	27 Sep 2004 03:37:54 -0000	1.84.2.6
@@ -16,7 +16,7 @@

  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *

- *  $Id: painting.c,v 1.84.2.5 2004/09/27 01:38:36 royce Exp $

+ *  $Id: painting.c,v 1.84.2.6 2004/09/27 03:37:54 royce Exp $

  *
  *  COPYRIGHT:        See COPYING in the top level directory
  *  PROJECT:          ReactOS kernel

@@ -675,6 +675,7 @@

 HDC INTERNAL_CALL
 IntBeginPaint(PWINDOW_OBJECT Window, PAINTSTRUCT* lPs)
 {

+   DPRINT1("IntBeginPaint(0x%x,0x%x)\n", Window, lPs );

    ASSERT(Window);
 
    #if 0

@@ -683,6 +684,7 @@

 
    if (!(lPs->hdc = IntGetDCEx(Window, 0, DCX_INTERSECTUPDATE | DCX_WINDOWPAINT | DCX_USESTYLE)))
    {

+      DPRINT1("IntGetDCEx() failed\n");

       return NULL;
    }
 

@@ -691,10 +693,14 @@

    {
       MsqDecPaintCountQueue(Window->MessageQueue);
       IntValidateParent(Window, Window->UpdateRegion);

-      NtGdiGetRgnBox(Window->UpdateRegion, &lPs->rcPaint);

+      UnsafeIntNtGdiGetRgnBox(Window->UpdateRegion, &lPs->rcPaint);
+      DPRINT1("UnsafeIntNtGdiGetRgnBox() result: 0x%x,0x%x,0x%x,0x%x\n",
+         lPs->rcPaint.left, lPs->rcPaint.top, lPs->rcPaint.right, lPs->rcPaint.bottom );

       NtGdiOffsetRect(&lPs->rcPaint,
          Window->WindowRect.left - Window->ClientRect.left,
          Window->WindowRect.top - Window->ClientRect.top);

+      DPRINT1("NtGdiOffsetRect() result: 0x%x,0x%x,0x%x,0x%x\n",
+         lPs->rcPaint.left, lPs->rcPaint.top, lPs->rcPaint.right, lPs->rcPaint.bottom );

       GDIOBJ_SetOwnership(Window->UpdateRegion, PsGetCurrentProcess());
       NtGdiDeleteObject(Window->UpdateRegion);
       Window->UpdateRegion = NULL;

@@ -702,6 +708,8 @@

    else
    {
       IntGetClientRect(Window, &lPs->rcPaint);

+      DPRINT1("IntGetClientRect() returned 0x%x,0x%x,0x%x,0x%x\n",
+         lPs->rcPaint.left, lPs->rcPaint.top, lPs->rcPaint.right, lPs->rcPaint.bottom );

    }
    IntUnLockWindowUpdate(Window);
 

@@ -884,7 +892,7 @@

 
       if (lprcUpdate)
       {

-         NtGdiGetRgnBox(hRgn, lprcUpdate);

+         UnsafeIntNtGdiGetRgnBox(hRgn, lprcUpdate);

 
          /* Put the lprcUpdate in logical coordinate */
          NtGdiDPtoLP(hDC, (LPPOINT)lprcUpdate, 2);

reactos/subsys/win32k/objects

diff -u -r1.62.2.2 -r1.62.2.3
--- region.c	14 Sep 2004 01:00:45 -0000	1.62.2.2
+++ region.c	27 Sep 2004 03:37:54 -0000	1.62.2.3
@@ -113,7 +113,7 @@

  * the y-x-banding that's so nice to have...
  */
 

-/* $Id: region.c,v 1.62.2.2 2004/09/14 01:00:45 weiden Exp $ */

+/* $Id: region.c,v 1.62.2.3 2004/09/27 03:37:54 royce Exp $ */

 #include <w32k.h>
 #include <win32k/float.h>
 

@@ -2313,33 +2313,51 @@

   return 0; //if invalid region return zero
 }
 

+INT INTERNAL_CALL
+UnsafeIntNtGdiGetRgnBox (
+	HRGN   hRgn,
+	LPRECT pRect )
+{
+	PROSRGNDATA Rgn;
+	DWORD ret;
+
+	if (!(Rgn = RGNDATA_LockRgn(hRgn)))
+	{
+		DPRINT1("RGNDATA_LockRgn() failed\n");
+		return ERROR;
+	}
+	ret = UnsafeIntGetRgnBox ( Rgn, pRect );
+	RGNDATA_UnlockRgn(Rgn);
+#ifndef NDEBUG
+	if (ERROR == ret)
+		DPRINT1("UnsafeIntGetRgnBox() failed\n");
+#endif/*NDEBUG*/
+	return ret;
+}

 
 INT STDCALL

-NtGdiGetRgnBox(HRGN  hRgn,
-	      LPRECT  pRect)

+NtGdiGetRgnBox (
+	HRGN   hRgn,
+	LPRECT pRect)

 {

-  PROSRGNDATA  Rgn;
-  RECT SafeRect;
-  DWORD ret;
-
-  if (!(Rgn = RGNDATA_LockRgn(hRgn)))
-    {
-      return ERROR;
-    }

+	RECT SafeRect;
+	DWORD ret;

-  ret = UnsafeIntGetRgnBox(Rgn, &SafeRect);
-  RGNDATA_UnlockRgn(Rgn);
-  if (ERROR == ret)
-    {
-      return ret;
-    }

+	ret = UnsafeIntNtGdiGetRgnBox(hRgn, &SafeRect);
+	if (ERROR == ret)
+	{
+		DPRINT1("UnsafeIntNtGdiGetRgnBox() failed\n");
+		return ret;
+	}

-  if (!NT_SUCCESS(MmCopyToCaller(pRect, &SafeRect, sizeof(RECT))))
-    {
-      return ERROR;
-    }

+	if (!NT_SUCCESS(MmCopyToCaller(pRect, &SafeRect, sizeof(RECT))))
+	{
+		DPRINT1("MmCopyToCaller() failed\n");
+		KeRosDumpStackFrames(NULL,10);
+		return ERROR;
+	}

-  return ret;

+	return ret;

 }
 
 BOOL