[jimtabor] 62494: [Win32k] - Patch by Maxim Andreyanov : CreateWindowEx have to set error when menu handle is invalid. - See CORE-7980.

Author: jimtabor
Date: Fri Mar 14 02:39:18 2014
New Revision: 62494

URL: http://svn.reactos.org/svn/reactos?rev=62494&view=rev
Log:
[Win32k]
- Patch by Maxim Andreyanov : CreateWindowEx have to set error when menu handle is
invalid.
- See CORE-7980.

Modified:
    trunk/reactos/win32ss/user/ntuser/object.c
    trunk/reactos/win32ss/user/ntuser/object.h
    trunk/reactos/win32ss/user/ntuser/window.c

Modified: trunk/reactos/win32ss/user/ntuser/object.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/object…
==============================================================================
--- trunk/reactos/win32ss/user/ntuser/object.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/ntuser/object.c	[iso-8859-1] Fri Mar 14 02:39:18 2014
@@ -554,6 +554,47 @@
    if (handle) return (PWND)UserGetObjectNoErr(gHandleTable, handle, type);
    return NULL;
 }
+
+PVOID FASTCALL ValidateHandle(HANDLE handle, HANDLE_TYPE type)
+{
+  PVOID pObj;
+  DWORD dwError = 0;
+  if (handle) 
+  {
+      pObj = UserGetObjectNoErr(gHandleTable, handle, type);
+      if (!pObj)
+      {
+          switch (type)
+          {  
+              case TYPE_WINDOW:
+                  dwError = ERROR_INVALID_WINDOW_HANDLE;
+                  break;
+              case TYPE_MENU:
+                  dwError = ERROR_INVALID_MENU_HANDLE;
+                  break;
+              case TYPE_CURSOR:
+                  dwError = ERROR_INVALID_CURSOR_HANDLE;
+                  break;
+              case TYPE_SETWINDOWPOS:
+                  dwError = ERROR_INVALID_DWP_HANDLE;
+                  break;
+              case TYPE_HOOK:
+                  dwError = ERROR_INVALID_HOOK_HANDLE;
+                  break;
+              case TYPE_ACCELTABLE:
+                  dwError = ERROR_INVALID_ACCEL_HANDLE;
+                  break;
+              default:
+                  dwError = ERROR_INVALID_HANDLE;
+                  break;
+          }
+          EngSetLastError(dwError);
+          return NULL;
+      }
+      return pObj;
+  }
+  return NULL;
+}
       
 /*
  * NtUserValidateHandleSecure

Modified: trunk/reactos/win32ss/user/ntuser/object.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/object…
==============================================================================
--- trunk/reactos/win32ss/user/ntuser/object.h	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/ntuser/object.h	[iso-8859-1] Fri Mar 14 02:39:18 2014
@@ -19,6 +19,7 @@
 void DbgUserDumpHandleTable();
 VOID FASTCALL UserSetObjectOwner(PVOID obj, HANDLE_TYPE type, PVOID owner);
 HANDLE FASTCALL ValidateHandleNoErr(HANDLE handle, HANDLE_TYPE type);
+PVOID FASTCALL ValidateHandle(HANDLE handle, HANDLE_TYPE type);
 
 static __inline VOID
 UserRefObjectCo(PVOID obj, PUSER_REFERENCE_ENTRY UserReferenceEntry)

Modified: trunk/reactos/win32ss/user/ntuser/window.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/window…
==============================================================================
--- trunk/reactos/win32ss/user/ntuser/window.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/ntuser/window.c	[iso-8859-1] Fri Mar 14 02:39:18 2014
@@ -2571,6 +2571,16 @@
 
     ASSERT(plstrWindowName);
 
+    if ( (dwStyle & (WS_POPUP|WS_CHILD)) != WS_CHILD) 
+    {
+        /* check hMenu is valid handle */
+        if (hMenu && !ValidateHandle(hMenu, TYPE_MENU))
+        {
+            /* error is set in ValidateHandle */
+            return NULL;
+        }
+    } 
+
     /* Copy the window name to kernel mode */
     Status = ProbeAndCaptureLargeString(&lstrWindowName, plstrWindowName);
     if (!NT_SUCCESS(Status))