From 31067aaecbc73cab145f8181576165c7bb05ee1d Mon Sep 17 00:00:00 2001
From: Thomas Bluemel <thomas@reactsoft.com>
Date: Sat, 22 Jan 2005 20:53:14 +0000
Subject: [PATCH] RtlCaptureUnicodeString should also check the buffers that
 the UNICODE_STRING structure points to...

svn path=/trunk/; revision=13219
---
 reactos/ntoskrnl/rtl/capture.c | 34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/reactos/ntoskrnl/rtl/capture.c b/reactos/ntoskrnl/rtl/capture.c
index 54c6e525886..8f18a79024b 100644
--- a/reactos/ntoskrnl/rtl/capture.c
+++ b/reactos/ntoskrnl/rtl/capture.c
@@ -58,6 +58,12 @@ RtlCaptureUnicodeString(OUT PUNICODE_STRING Dest,
                    sizeof(UNICODE_STRING),
                    sizeof(ULONG));
       Src = *UnsafeSrc;
+      if(Src.Length > 0)
+      {
+        ProbeForRead(Src.Buffer,
+                     Src.Length,
+                     sizeof(WCHAR));
+      }
     }
     _SEH_HANDLE
     {
@@ -86,20 +92,19 @@ RtlCaptureUnicodeString(OUT PUNICODE_STRING Dest,
    * Initialize the destination string.
    */
   Dest->Length = Src.Length;
-  Dest->MaximumLength = Src.Length + sizeof(WCHAR);
-  Dest->Buffer = ExAllocatePool(PoolType, Dest->MaximumLength);
-  if (Dest->Buffer == NULL)
-  {
-    Dest->Length = Dest->MaximumLength = 0;
-    Dest->Buffer = NULL;
-    return STATUS_INSUFFICIENT_RESOURCES;
-  }
-
-  /*
-   * Copy the source string to kernel space.
-   */
   if(Src.Length > 0)
   {
+    Dest->MaximumLength = Src.Length + sizeof(WCHAR);
+    Dest->Buffer = ExAllocatePool(PoolType, Dest->MaximumLength);
+    if (Dest->Buffer == NULL)
+    {
+      Dest->Length = Dest->MaximumLength = 0;
+      Dest->Buffer = NULL;
+      return STATUS_INSUFFICIENT_RESOURCES;
+    }
+    /*
+     * Copy the source string to kernel space.
+     */
     _SEH_TRY
     {
       RtlCopyMemory(Dest->Buffer, Src.Buffer, Src.Length);
@@ -111,6 +116,11 @@ RtlCaptureUnicodeString(OUT PUNICODE_STRING Dest,
     }
     _SEH_END;
   }
+  else
+  {
+    Dest->MaximumLength = 0;
+    Dest->Buffer = NULL;
+  }
   
   return Status;
 }