From b5c06d7dbde2cfefe2d3906945e68b288f521441 Mon Sep 17 00:00:00 2001
From: Thomas Bluemel <thomas@reactsoft.com>
Date: Wed, 14 Apr 2004 23:40:43 +0000
Subject: [PATCH] better handling of invalid strings in
 IntSafeCopyUnicodeString()

svn path=/trunk/; revision=9146
---
 reactos/subsys/win32k/ntuser/misc.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/reactos/subsys/win32k/ntuser/misc.c b/reactos/subsys/win32k/ntuser/misc.c
index 30d47200a06..93aab84ce8d 100644
--- a/reactos/subsys/win32k/ntuser/misc.c
+++ b/reactos/subsys/win32k/ntuser/misc.c
@@ -1,4 +1,4 @@
-/* $Id: misc.c,v 1.60 2004/04/14 23:17:56 weiden Exp $
+/* $Id: misc.c,v 1.61 2004/04/14 23:40:43 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -931,10 +931,16 @@ IntSafeCopyUnicodeString(PUNICODE_STRING Dest,
     return Status;
   }
   
-  if(Dest->Length > 0)
+  if(Dest->Length > 0x4000)
+  {
+    return STATUS_UNSUCCESSFUL;
+  }
+  
+  Src = Dest->Buffer;
+  Dest->Buffer = NULL;
+  
+  if(Dest->Length > 0 && Src)
   {
-    Src = Dest->Buffer;
-    
     Dest->Buffer = ExAllocatePoolWithTag(NonPagedPool, Dest->Length, TAG_STRING);
     if(!Dest->Buffer)
     {