From ccb97ad07de5549ab6d68cfcb49c5bace68382ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Herm=C3=A8s=20B=C3=A9lusca-Ma=C3=AFto?=
 <hermes.belusca-maito@reactos.org>
Date: Wed, 11 Feb 2015 20:12:30 +0000
Subject: [PATCH] [WIN32K]: Fix an insecure user buffer reading/writing. Caught
 by Thomas Faber, thanks! CORE-8322

svn path=/trunk/; revision=66223
---
 reactos/win32ss/user/ntuser/ntstubs.c | 32 ++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/reactos/win32ss/user/ntuser/ntstubs.c b/reactos/win32ss/user/ntuser/ntstubs.c
index cec29f60c60..db2c62756d9 100644
--- a/reactos/win32ss/user/ntuser/ntstubs.c
+++ b/reactos/win32ss/user/ntuser/ntstubs.c
@@ -790,6 +790,8 @@ NtUserSetInformationThread(IN HANDLE ThreadHandle,
     {
         case UserThreadInitiateShutdown:
         {
+            ULONG CapturedFlags = 0;
+
             ERR("Shutdown initiated\n");
 
             if (ThreadInformationLength != sizeof(ULONG))
@@ -798,7 +800,33 @@ NtUserSetInformationThread(IN HANDLE ThreadHandle,
                 break;
             }
 
-            Status = UserInitiateShutdown(Thread, (PULONG)ThreadInformation);
+            /* Capture the caller value */
+            Status = STATUS_SUCCESS;
+            _SEH2_TRY
+            {
+                ProbeForWrite(ThreadInformation, sizeof(CapturedFlags), sizeof(PVOID));
+                CapturedFlags = *(PULONG)ThreadInformation;
+            }
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+            {
+                Status = _SEH2_GetExceptionCode();
+            }
+            _SEH2_END;
+
+            if (NT_SUCCESS(Status))
+                Status = UserInitiateShutdown(Thread, &CapturedFlags);
+
+            /* Return the modified value to the caller */
+            _SEH2_TRY
+            {
+                *(PULONG)ThreadInformation = CapturedFlags;
+            }
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+            {
+                Status = _SEH2_GetExceptionCode();
+            }
+            _SEH2_END;
+
             break;
         }
 
@@ -814,6 +842,7 @@ NtUserSetInformationThread(IN HANDLE ThreadHandle,
                 break;
             }
 
+            /* Capture the caller value */
             Status = STATUS_SUCCESS;
             _SEH2_TRY
             {
@@ -844,6 +873,7 @@ NtUserSetInformationThread(IN HANDLE ThreadHandle,
                 break;
             }
 
+            /* Capture the caller value */
             Status = STATUS_SUCCESS;
             _SEH2_TRY
             {