[gadamopoulos] 49962: [win32k] - In FNID_SENDMESSAGECALLBACK use SEH before accesing the user-mode buffer

Author: gadamopoulos
Date: Mon Dec  6 12:07:05 2010
New Revision: 49962

URL: http://svn.reactos.org/svn/reactos?rev=49962&view=rev
Log:
[win32k]
- In FNID_SENDMESSAGECALLBACK use SEH before accesing the user-mode buffer

Modified:
    trunk/reactos/subsystems/win32/win32k/ntuser/message.c

Modified: trunk/reactos/subsystems/win32/win32k/ntuser/message.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/nt…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/ntuser/message.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/win32k/ntuser/message.c [iso-8859-1] Mon Dec  6
12:07:05 2010
@@ -2175,14 +2175,23 @@
         break;
     case FNID_SENDMESSAGECALLBACK:
         {
-            PCALL_BACK_INFO CallBackInfo = (PCALL_BACK_INFO)ResultInfo;
+            CALL_BACK_INFO CallBackInfo;
             ULONG_PTR uResult;
-
-            if (!CallBackInfo)
-                break;
+            
+            _SEH2_TRY
+            {
+                ProbeForRead((PVOID)ResultInfo, sizeof(CALL_BACK_INFO), 1);
+                RtlCopyMemory(&CallBackInfo, (PVOID)ResultInfo,
sizeof(CALL_BACK_INFO));
+            }
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+            {
+                Ret = FALSE;
+                _SEH2_YIELD(break);
+            }
+            _SEH2_END;
 
             if (!co_IntSendMessageWithCallBack(hWnd, Msg, wParam, lParam,
-                        CallBackInfo->CallBack, CallBackInfo->Context,
&uResult))
+                        CallBackInfo.CallBack, CallBackInfo.Context, &uResult))
             {
                 DPRINT1("Callback failure!\n");
             }