[gschneider] 42464: IntChangeDisplaySettings: set last error before leaving the function NtUserChangeDisplaySettings: copy devmode only if passed, use SEH with buffer probing over CopyFromCaller

Author: gschneider
Date: Fri Aug  7 14:10:59 2009
New Revision: 42464
URL: http://svn.reactos.org/svn/reactos?rev=42464&view=rev
Log:
IntChangeDisplaySettings: set last error before leaving the function
NtUserChangeDisplaySettings: copy devmode only if passed, use SEH with buffer probing over
CopyFromCaller
Modified:
    trunk/reactos/subsystems/win32/win32k/ntuser/display.c
    trunk/reactos/subsystems/win32/win32k/objects/device.c
Modified: trunk/reactos/subsystems/win32/win32k/ntuser/display.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/nt…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/ntuser/display.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/win32k/ntuser/display.c [iso-8859-1] Fri Aug  7
14:10:59 2009
@@ -121,7 +121,8 @@
    DWORD dwflags,
    LPVOID lParam)
 {
-   NTSTATUS Status;
+   NTSTATUS Status = STATUS_SUCCESS;
+   LPDEVMODEW lpSafeDevMode = NULL;
    DEVMODEW DevMode;
    PUNICODE_STRING pSafeDeviceName = NULL;
    UNICODE_STRING SafeDeviceName;
@@ -147,23 +148,32 @@
    }
    /* Copy devmode */
-   Status = MmCopyFromCaller(&DevMode.dmSize, &lpDevMode->dmSize, sizeof
(DevMode.dmSize));
-   if (!NT_SUCCESS(Status))
+   if (lpDevMode != NULL)
    {
-      SetLastNtError(Status);
-      return DISP_CHANGE_BADPARAM;
-   }
-   DevMode.dmSize = min(sizeof (DevMode), DevMode.dmSize);
-   Status = MmCopyFromCaller(&DevMode, lpDevMode, DevMode.dmSize);
-   if (!NT_SUCCESS(Status))
-   {
-      SetLastNtError(Status);
-      return DISP_CHANGE_BADPARAM;
-   }
-   if (DevMode.dmDriverExtra > 0)
-   {
-      DbgPrint("(%s:%i) WIN32K: %s lpDevMode->dmDriverExtra is IGNORED!\n",
__FILE__, __LINE__, __FUNCTION__);
-      DevMode.dmDriverExtra = 0;
+      _SEH2_TRY
+      {
+          ProbeForRead(lpDevMode, sizeof(DevMode.dmSize), 1);
+          DevMode.dmSize = lpDevMode->dmSize;
+          DevMode.dmSize = min(sizeof(DevMode), DevMode.dmSize);
+          ProbeForRead(lpDevMode, DevMode.dmSize, 1);
+          RtlCopyMemory(&DevMode, lpDevMode, DevMode.dmSize);
+      }
+      _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+      {
+          Status = _SEH2_GetExceptionCode();
+      }
+      _SEH2_END
+      if (!NT_SUCCESS(Status))
+      {
+         SetLastNtError(Status);
+         return DISP_CHANGE_BADPARAM;
+      }
+      if (DevMode.dmDriverExtra > 0)
+      {
+         DPRINT1("lpDevMode->dmDriverExtra is IGNORED!\n");
+         DevMode.dmDriverExtra = 0;
+      }
+      lpSafeDevMode = &DevMode;
    }
    /* Copy the device name */
@@ -179,7 +189,7 @@
    }
    /* Call internal function */
-   Ret = IntChangeDisplaySettings(pSafeDeviceName, &DevMode, dwflags, lParam);
+   Ret = IntChangeDisplaySettings(pSafeDeviceName, lpSafeDevMode, dwflags, lParam);
    if (pSafeDeviceName != NULL)
       RtlFreeUnicodeString(pSafeDeviceName);
Modified: trunk/reactos/subsystems/win32/win32k/objects/device.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/ob…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/objects/device.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/win32k/objects/device.c [iso-8859-1] Fri Aug  7
14:10:59 2009
@@ -1229,8 +1229,8 @@
     {
         /* Dynamically change graphics mode */
         DPRINT1("flag 0 UNIMPLEMENTED\n");
+        SetLastWin32Error(ERROR_CALL_NOT_IMPLEMENTED);
         return DISP_CHANGE_FAILED;
-        SetLastWin32Error(ERROR_CALL_NOT_IMPLEMENTED);
     }
     if ((dwflags & CDS_TEST) == CDS_TEST)