From 4bfbd2cfaf6edda5f5f0b8140b90becd5c6f19af Mon Sep 17 00:00:00 2001 From: Thomas Bluemel Date: Fri, 22 Jul 2005 20:51:36 +0000 Subject: [PATCH] probe the pointers in _MmCopyFromCaller and _MmCopyToCaller. There's no need to check the processor mode since it's always just used to copy from/to user memory svn path=/trunk/; revision=16690 --- reactos/subsys/win32k/include/mmcopy.h | 3 ++- reactos/subsys/win32k/misc/copy.c | 18 ++++++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/reactos/subsys/win32k/include/mmcopy.h b/reactos/subsys/win32k/include/mmcopy.h index c779ead8b25..b917696622a 100644 --- a/reactos/subsys/win32k/include/mmcopy.h +++ b/reactos/subsys/win32k/include/mmcopy.h @@ -4,8 +4,9 @@ #include NTSTATUS _MmCopyFromCaller( PVOID Target, PVOID Source, UINT Bytes ); +NTSTATUS _MmCopyToCaller( PVOID Target, PVOID Source, UINT Bytes ); #define MmCopyFromCaller(x,y,z) _MmCopyFromCaller((PCHAR)(x),(PCHAR)(y),(UINT)(z)) -#define MmCopyToCaller(x,y,z) MmCopyFromCaller(x,y,z) +#define MmCopyToCaller(x,y,z) _MmCopyToCaller((PCHAR)(x),(PCHAR)(y),(UINT)(z)) #endif/*NDK_MMCOPY_H*/ diff --git a/reactos/subsys/win32k/misc/copy.c b/reactos/subsys/win32k/misc/copy.c index 3de5a355d73..288c2dcc7d6 100644 --- a/reactos/subsys/win32k/misc/copy.c +++ b/reactos/subsys/win32k/misc/copy.c @@ -2,9 +2,23 @@ NTSTATUS _MmCopyFromCaller( PVOID Target, PVOID Source, UINT Bytes ) { NTSTATUS Status = STATUS_SUCCESS; - + _SEH_TRY { - RtlCopyMemory(Target,Source,Bytes); + ProbeForRead(Source,Bytes,1); + RtlCopyMemory(Target,Source,Bytes); + } _SEH_HANDLE { + Status = _SEH_GetExceptionCode(); + } _SEH_END; + + return Status; +} + +NTSTATUS _MmCopyToCaller( PVOID Target, PVOID Source, UINT Bytes ) { + NTSTATUS Status = STATUS_SUCCESS; + + _SEH_TRY { + ProbeForWrite(Target,Bytes,1); + RtlCopyMemory(Target,Source,Bytes); } _SEH_HANDLE { Status = _SEH_GetExceptionCode(); } _SEH_END;