[weiden] 38572: Copying the string in NtUserDefSetText () must be protected with SEH, probing alone is not sufficient.

Author: weiden
Date: Sun Jan  4 16:20:19 2009
New Revision: 38572

URL: http://svn.reactos.org/svn/reactos?rev=38572&view=rev
Log:
Copying the string in NtUserDefSetText () must be protected with SEH, probing alone is not sufficient.

Modified:
    trunk/reactos/subsystems/win32/win32k/ntuser/window.c

Modified: trunk/reactos/subsystems/win32/win32k/ntuser/window.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/ntu...
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/ntuser/window.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/win32k/ntuser/window.c [iso-8859-1] Sun Jan  4 16:20:19 2009
@@ -4577,11 +4577,20 @@
       {
          ASSERT(Wnd->WindowName.Buffer != NULL);

-         Wnd->WindowName.Length = SafeText.Length;
-         Wnd->WindowName.Buffer[SafeText.Length / sizeof(WCHAR)] = L'\0';
-         RtlCopyMemory(Wnd->WindowName.Buffer,
-                              SafeText.Buffer,
-                              SafeText.Length);
+         _SEH2_TRY
+         {
+            Wnd->WindowName.Length = SafeText.Length;
+            Wnd->WindowName.Buffer[SafeText.Length / sizeof(WCHAR)] = L'\0';
+            RtlCopyMemory(Wnd->WindowName.Buffer,
+                          SafeText.Buffer,
+                          SafeText.Length);
+         }
+         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+         {
+            Ret = FALSE;
+            SetLastNtError(_SEH2_GetExceptionCode());
+         }
+         _SEH2_END;
       }
       else
       {
@@ -4598,12 +4607,23 @@
                                                    SafeText.Length + sizeof(UNICODE_NULL));
          if (Wnd->WindowName.Buffer != NULL)
          {
-            Wnd->WindowName.Buffer[SafeText.Length / sizeof(WCHAR)] = L'\0';
-            RtlCopyMemory(Wnd->WindowName.Buffer,
-                                 SafeText.Buffer,
-                                 SafeText.Length);
-            Wnd->WindowName.MaximumLength = SafeText.Length + sizeof(UNICODE_NULL);
-            Wnd->WindowName.Length = SafeText.Length;
+            _SEH2_TRY
+            {
+               Wnd->WindowName.Buffer[SafeText.Length / sizeof(WCHAR)] = L'\0';
+               RtlCopyMemory(Wnd->WindowName.Buffer,
+                             SafeText.Buffer,
+                             SafeText.Length);
+               Wnd->WindowName.MaximumLength = SafeText.Length + sizeof(UNICODE_NULL);
+               Wnd->WindowName.Length = SafeText.Length;
+            }
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+            {
+                Wnd->WindowName.Buffer = NULL;
+                DesktopHeapFree(Wnd->pdesktop, Wnd->WindowName.Buffer);
+                Ret = FALSE;
+                SetLastNtError(_SEH2_GetExceptionCode());
+            }
+            _SEH2_END;
          }
          else
          {