[tkreuzer] 28028: probe and copy hdc from usermode PAINTSTRUCT using SEH

Author: tkreuzer
Date: Mon Jul 30 05:39:26 2007
New Revision: 28028

URL: http://svn.reactos.org/svn/reactos?rev=28028&view=rev
Log:
probe and copy hdc from usermode PAINTSTRUCT using SEH

Modified:
    trunk/reactos/subsystems/win32/win32k/ntuser/painting.c

Modified: trunk/reactos/subsystems/win32/win32k/ntuser/painting.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/nt…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/ntuser/painting.c (original)
+++ trunk/reactos/subsystems/win32/win32k/ntuser/painting.c Mon Jul 30 05:39:26 2007
@@ -870,11 +870,13 @@
  */
 
 BOOL STDCALL
-NtUserEndPaint(HWND hWnd, CONST PAINTSTRUCT* lPs)
-{
+NtUserEndPaint(HWND hWnd, CONST PAINTSTRUCT* pUnsafePs)
+{
+   NTSTATUS Status = STATUS_SUCCESS;
    PWINDOW_OBJECT Window;
    DECLARE_RETURN(BOOL);
    USER_REFERENCE_ENTRY Ref;
+   HDC hdc = NULL;
 
    DPRINT("Enter NtUserEndPaint\n");
    UserEnterExclusive();
@@ -884,7 +886,22 @@
       RETURN(FALSE);
    }
 
-   UserReleaseDC(Window, lPs->hdc, TRUE);
+   _SEH_TRY
+   {
+      ProbeForRead(pUnsafePs, sizeof(*pUnsafePs), 1);
+      hdc = pUnsafePs->hdc;
+   }
+   _SEH_HANDLE
+   {
+      Status = _SEH_GetExceptionCode();
+   }
+   _SEH_END
+   if (!NT_SUCCESS(Status))
+   {
+      RETURN(FALSE);
+   }
+
+   UserReleaseDC(Window, hdc, TRUE);
 
    UserRefObjectCo(Window, &Ref);
    co_UserShowCaret(Window);