@@ -443,7 +443,7 @@ UserEnumCurrentDisplaySettings(
443
443
{
444
444
/* No device found */
445
445
ERR ("No PDEV found!\n" );
446
- return STATUS_UNSUCCESSFUL ;
446
+ return STATUS_INVALID_PARAMETER_1 ;
447
447
}
448
448
449
449
* ppdm = ppdev -> pdmwDev ;
@@ -474,7 +474,7 @@ UserEnumDisplaySettings(
474
474
{
475
475
/* No device found */
476
476
ERR ("No device found!\n" );
477
- return STATUS_UNSUCCESSFUL ;
477
+ return STATUS_INVALID_PARAMETER_1 ;
478
478
}
479
479
480
480
iFoundMode = 0 ;
@@ -571,13 +571,18 @@ NtUserEnumDisplaySettings(
571
571
572
572
_SEH2_TRY
573
573
{
574
- ProbeForWrite (lpDevMode , sizeof (DEVMODEW ), 1 );
574
+ ProbeForRead (lpDevMode , sizeof (DEVMODEW ), 1 );
575
+
576
+ cbSize = lpDevMode -> dmSize ;
577
+ cbExtra = lpDevMode -> dmDriverExtra ;
578
+
579
+ ProbeForWrite (lpDevMode , cbSize + cbExtra , 1 );
575
580
}
576
581
_SEH2_EXCEPT (EXCEPTION_EXECUTE_HANDLER )
577
582
{
578
583
_SEH2_YIELD (return _SEH2_GetExceptionCode ());
579
584
}
580
- _SEH2_END
585
+ _SEH2_END ;
581
586
582
587
if (lpDevMode -> dmSize != sizeof (DEVMODEW ))
583
588
{
@@ -586,31 +591,30 @@ NtUserEnumDisplaySettings(
586
591
587
592
if (pustrDevice )
588
593
{
589
- if (pustrDevice -> Buffer == NULL || pustrDevice -> Length == 0 )
590
- {
591
- Status = STATUS_INVALID_PARAMETER_1 ;
592
- }
593
-
594
594
/* Initialize destination string */
595
595
RtlInitEmptyUnicodeString (& ustrDevice , awcDevice , sizeof (awcDevice ));
596
596
597
597
_SEH2_TRY
598
598
{
599
599
/* Probe the UNICODE_STRING and the buffer */
600
- ProbeForRead (pustrDevice , sizeof (UNICODE_STRING ), 1 );
601
- ProbeForRead (pustrDevice -> Buffer , pustrDevice -> Length , 1 );
600
+ ProbeForReadUnicodeString (pustrDevice );
601
+
602
+ if (!pustrDevice -> Length || !pustrDevice -> Buffer )
603
+ ExRaiseStatus (STATUS_NO_MEMORY );
604
+
605
+ ProbeForRead (pustrDevice -> Buffer , pustrDevice -> Length , sizeof (UCHAR ));
602
606
603
607
/* Copy the string */
604
608
RtlCopyUnicodeString (& ustrDevice , pustrDevice );
605
609
}
606
610
_SEH2_EXCEPT (EXCEPTION_EXECUTE_HANDLER )
607
611
{
608
- _SEH2_YIELD (return _SEH2_GetExceptionCode () );
612
+ _SEH2_YIELD (return STATUS_INVALID_PARAMETER_1 );
609
613
}
610
- _SEH2_END
614
+ _SEH2_END ;
611
615
612
616
pustrDevice = & ustrDevice ;
613
- }
617
+ }
614
618
615
619
/* Acquire global USER lock */
616
620
UserEnterShared ();
@@ -642,11 +646,6 @@ NtUserEnumDisplaySettings(
642
646
/* Copy some information back */
643
647
_SEH2_TRY
644
648
{
645
- ProbeForRead (lpDevMode , sizeof (DEVMODEW ), 1 );
646
- cbSize = lpDevMode -> dmSize ;
647
- cbExtra = lpDevMode -> dmDriverExtra ;
648
-
649
- ProbeForWrite (lpDevMode , cbSize + cbExtra , 1 );
650
649
/* Output what we got */
651
650
RtlCopyMemory (lpDevMode , pdm , min (cbSize , pdm -> dmSize ));
652
651
@@ -664,13 +663,6 @@ NtUserEnumDisplaySettings(
664
663
}
665
664
_SEH2_END ;
666
665
}
667
- else
668
- {
669
- if (Status == STATUS_UNSUCCESSFUL )
670
- {
671
- Status = STATUS_INVALID_PARAMETER_1 ;
672
- }
673
- }
674
666
675
667
return Status ;
676
668
}
0 commit comments