From 64e2bc0bcdb2d5055f95857aacee678b00695b2e Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Sun, 12 Oct 2014 11:35:11 +0000
Subject: [PATCH] [NTDLL:DBG] - Use NtReadVirtualMemory instead of
 dereferencing a pointer from a different process in
 DbgUiConvertStateChangeStructure. CORE-8622 #resolve

svn path=/trunk/; revision=64690
---
 reactos/dll/ntdll/dbg/dbgui.c | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/reactos/dll/ntdll/dbg/dbgui.c b/reactos/dll/ntdll/dbg/dbgui.c
index e745374eb6a..4aaa947fb98 100644
--- a/reactos/dll/ntdll/dbg/dbgui.c
+++ b/reactos/dll/ntdll/dbg/dbgui.c
@@ -66,6 +66,9 @@ DbgUiConvertStateChangeStructure(IN PDBGUI_WAIT_STATE_CHANGE WaitStateChange,
     THREAD_BASIC_INFORMATION ThreadBasicInfo;
     LPDEBUG_EVENT DebugEvent = Win32DebugEvent;
     HANDLE ThreadHandle;
+    HANDLE ProcessHandle;
+    PTEB Teb;
+    PVOID Pointer;
 
     /* Write common data */
     DebugEvent->dwProcessId = (DWORD)WaitStateChange->
@@ -256,13 +259,31 @@ DbgUiConvertStateChangeStructure(IN PDBGUI_WAIT_STATE_CHANGE WaitStateChange,
                 NtClose(ThreadHandle);
             }
 
-            /* Check if we got thread information */
+            /* If we got thread information, open the process */
             if (NT_SUCCESS(Status))
             {
-                /* Save the image name from the TIB */
-                DebugEvent->u.LoadDll.lpImageName =
-                    ((PTEB)ThreadBasicInfo.TebBaseAddress)->
-                    NtTib.ArbitraryUserPointer;
+                Status = NtOpenProcess(&ProcessHandle,
+                                       PROCESS_VM_READ,
+                                       &ObjectAttributes,
+                                       &WaitStateChange->AppClientId);
+            }
+
+            if (NT_SUCCESS(Status))
+            {
+                /* Read the image name from the TIB */
+                Teb = ThreadBasicInfo.TebBaseAddress;
+                Status = NtReadVirtualMemory(ProcessHandle,
+                                             &Teb->NtTib.ArbitraryUserPointer,
+                                             &Pointer,
+                                             sizeof(Pointer),
+                                             NULL);
+                NtClose(ProcessHandle);
+            }
+
+            if (NT_SUCCESS(Status))
+            {
+                /* If everything was successful, set the image name */
+                DebugEvent->u.LoadDll.lpImageName = Pointer;
             }
             else
             {