[tkreuzer] 69748: [WIN32K] Fix parameter handling in NtGdiDoPalette CORE-9435 #resolve

Author: tkreuzer
Date: Sat Oct 31 12:52:01 2015
New Revision: 69748

URL: http://svn.reactos.org/svn/reactos?rev=69748&view=rev
Log:
[WIN32K]
Fix parameter handling in NtGdiDoPalette
CORE-9435 #resolve

Modified:
    trunk/reactos/include/psdk/ntgdi.h
    trunk/reactos/win32ss/gdi/ntgdi/palette.c

Modified: trunk/reactos/include/psdk/ntgdi.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/psdk/ntgdi.h?rev=6…
==============================================================================
--- trunk/reactos/include/psdk/ntgdi.h	[iso-8859-1] (original)
+++ trunk/reactos/include/psdk/ntgdi.h	[iso-8859-1] Sat Oct 31 12:52:01 2015
@@ -439,8 +439,8 @@
     _In_ HGDIOBJ hObj,
     _In_ WORD iStart,
     _In_ WORD cEntries,
-    _When_((iFunc == GdiPalGetEntries) || (iFunc == GdiPalGetSystemEntries),
_Out_writes_bytes_(cEntries*sizeof(PALETTEENTRY)))
-    _When_((iFunc != GdiPalGetEntries) && (iFunc != GdiPalGetSystemEntries),
_In_reads_bytes_(cEntries*sizeof(PALETTEENTRY))) LPVOID pEntries,
+    _When_(bInbound!=0, _In_reads_bytes_(cEntries*sizeof(PALETTEENTRY)))
+    _When_(bInbound==0, _Out_writes_bytes_(cEntries*sizeof(PALETTEENTRY))) LPVOID
pEntries,
     _In_ DWORD iFunc,
     _In_ BOOL bInbound);
 

Modified: trunk/reactos/win32ss/gdi/ntgdi/palette.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/palette.…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/palette.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/palette.c	[iso-8859-1] Sat Oct 31 12:52:01 2015
@@ -1055,39 +1055,38 @@
     return iResult;
 }
 
-W32KAPI
+__kernel_entry
 LONG
 APIENTRY
 NtGdiDoPalette(
-    IN HGDIOBJ hObj,
-    IN WORD iStart,
-    IN WORD cEntries,
-    IN LPVOID pUnsafeEntries,
-    IN DWORD iFunc,
-    IN BOOL bInbound)
+    _In_ HGDIOBJ hObj,
+    _In_ WORD iStart,
+    _In_ WORD cEntries,
+    _When_(bInbound!=0, _In_reads_bytes_(cEntries*sizeof(PALETTEENTRY)))
+    _When_(bInbound==0, _Out_writes_bytes_(cEntries*sizeof(PALETTEENTRY))) LPVOID
pUnsafeEntries,
+    _In_ DWORD iFunc,
+    _In_ BOOL bInbound)
 {
 	LONG ret;
 	LPVOID pEntries = NULL;
-
-	/* FIXME: Handle bInbound correctly */
-
-	if (bInbound &&
-	    (pUnsafeEntries == NULL || cEntries == 0))
-	{
-		return 0;
-	}
+	SIZE_T cjSize;
 
 	if (pUnsafeEntries)
 	{
-		pEntries = ExAllocatePoolWithTag(PagedPool, cEntries * sizeof(PALETTEENTRY),
TAG_PALETTE);
+		if (cEntries == 0)
+			return 0;
+
+		cjSize = cEntries * sizeof(PALETTEENTRY);
+		pEntries = ExAllocatePoolWithTag(PagedPool, cjSize, TAG_PALETTE);
 		if (!pEntries)
 			return 0;
+
 		if (bInbound)
 		{
 			_SEH2_TRY
 			{
-				ProbeForRead(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
-				memcpy(pEntries, pUnsafeEntries, cEntries * sizeof(PALETTEENTRY));
+				ProbeForRead(pUnsafeEntries, cjSize, 1);
+				memcpy(pEntries, pUnsafeEntries, cjSize);
 			}
 			_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 			{
@@ -1099,7 +1098,7 @@
 		else
 		{
 		    /* Zero it out, so we don't accidentally leak kernel data */
-		    RtlZeroMemory(pEntries, cEntries * sizeof(PALETTEENTRY));
+		    RtlZeroMemory(pEntries, cjSize);
 		}
 	}
 
@@ -1137,12 +1136,13 @@
 
 	if (pEntries)
 	{
-		if (!bInbound)
+		if (!bInbound && (ret > 0))
 		{
+			cjSize = min(cEntries, ret) * sizeof(PALETTEENTRY);
 			_SEH2_TRY
 			{
-				ProbeForWrite(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
-				memcpy(pUnsafeEntries, pEntries, cEntries * sizeof(PALETTEENTRY));
+				ProbeForWrite(pUnsafeEntries, cjSize, 1);
+				memcpy(pUnsafeEntries, pEntries, cjSize);
 			}
 			_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 			{