From 729df301cdc79520d02567feb0ae2e7be5c414e0 Mon Sep 17 00:00:00 2001 From: Aleksey Bragin Date: Tue, 4 Dec 2007 22:52:05 +0000 Subject: [PATCH] Andrey Korotaev : - Never trust MaximumLength passed from usermode when copying a unicode string (fixes a wide amount of crashes, tested with CdrLabel 4.1). svn path=/trunk/; revision=31010 --- reactos/subsystems/win32/win32k/ntuser/misc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/reactos/subsystems/win32/win32k/ntuser/misc.c b/reactos/subsystems/win32/win32k/ntuser/misc.c index 93ef1d9876f..6d2a58b1aa5 100644 --- a/reactos/subsystems/win32/win32k/ntuser/misc.c +++ b/reactos/subsystems/win32/win32k/ntuser/misc.c @@ -2397,10 +2397,10 @@ IntSafeCopyUnicodeString(PUNICODE_STRING Dest, Src = Dest->Buffer; Dest->Buffer = NULL; + Dest->MaximumLength = Dest->Length; if(Dest->Length > 0 && Src) { - Dest->MaximumLength = Dest->Length; Dest->Buffer = ExAllocatePoolWithTag(PagedPool, Dest->MaximumLength, TAG_STRING); if(!Dest->Buffer) { @@ -2443,6 +2443,7 @@ IntSafeCopyUnicodeStringTerminateNULL(PUNICODE_STRING Dest, Src = Dest->Buffer; Dest->Buffer = NULL; + Dest->MaximumLength = 0; if(Dest->Length > 0 && Src) {