From ecc146295928f7b23bff87b03303db4c4e66086b Mon Sep 17 00:00:00 2001
From: Thomas Bluemel <thomas@reactsoft.com>
Date: Sun, 13 Feb 2005 13:03:44 +0000
Subject: [PATCH] fixed returning the reference to the token in
 SeCopyClientToken() and probe pointer when neccessary

svn path=/trunk/; revision=13524
---
 reactos/ntoskrnl/se/token.c | 40 +++++++++++++++++++++++++++++++------
 1 file changed, 34 insertions(+), 6 deletions(-)

diff --git a/reactos/ntoskrnl/se/token.c b/reactos/ntoskrnl/se/token.c
index 048e8dfc332..c0cbb4ed869 100644
--- a/reactos/ntoskrnl/se/token.c
+++ b/reactos/ntoskrnl/se/token.c
@@ -131,13 +131,32 @@ SepDuplicateToken(PTOKEN Token,
 		  KPROCESSOR_MODE PreviousMode,
 		  PTOKEN* NewAccessToken)
 {
-  NTSTATUS Status;
   ULONG uLength;
   ULONG i;
-  
   PVOID EndMem;
-
   PTOKEN AccessToken;
+  NTSTATUS Status;
+  
+  if(PreviousMode != KernelMode)
+  {
+    Status = STATUS_SUCCESS;
+    _SEH_TRY
+    {
+      ProbeForWrite(NewAccessToken,
+                    sizeof(TOKEN),
+                    sizeof(ULONG));
+    }
+    _SEH_HANDLE
+    {
+      Status = _SEH_GetExceptionCode();
+    }
+    _SEH_END;
+    
+    if(!NT_SUCCESS(Status))
+    {
+      return Status;
+    }
+  }
 
   Status = ObCreateObject(PreviousMode,
 			  SepTokenObjectType,
@@ -244,8 +263,17 @@ SepDuplicateToken(PTOKEN Token,
 
   if ( NT_SUCCESS(Status) )
     {
-      *NewAccessToken = AccessToken;
-      return(STATUS_SUCCESS);
+      _SEH_TRY
+      {
+        *NewAccessToken = AccessToken;
+        Status = STATUS_SUCCESS;
+      }
+      _SEH_HANDLE
+      {
+        Status = _SEH_GetExceptionCode();
+      }
+      _SEH_END;
+      return Status;
     }
 
   ObDereferenceObject(AccessToken);
@@ -320,7 +348,7 @@ SeCopyClientToken(PACCESS_TOKEN Token,
 				TokenImpersonation,
 				Level,
 				PreviousMode,
-			    (PTOKEN*)&NewToken);
+			        (PTOKEN*)NewToken);
    
    return(Status);
 }