This commit is contained in:
DavidXanatos 2024-10-01 10:59:15 +02:00
parent c01c2843ac
commit 23f4078fd3
3 changed files with 9 additions and 9 deletions

View File

@ -1348,13 +1348,16 @@ _FX LONG Gui_GetRawInputDeviceInfo_impl(
req->uiCommand = uiCommand;
req->unicode = bUnicode;
req->hasData = !!pData;
req->hasSize = !!pcbSize;
if (lenData)
memcpy(reqData, pData, lenData);
// GetRawInputDeviceInfoA accesses pcbSize without testing it for being not NULL
// hence if the caller passes NULL we use a dummy value so that we dont crash the helper service
if (pcbSize)
req->cbSize = *pcbSize;
else
req->cbSize = 0;
rpl = Gui_CallProxy(req, reqSize, sizeof(*rpl));

View File

@ -3532,11 +3532,10 @@ ULONG GuiServer::GetRawInputDeviceInfoSlave(SlaveArgs *args)
return STATUS_INFO_LENGTH_MISMATCH;
LPVOID reqData = req->hasData ? (BYTE*)req + sizeof(GUI_GET_RAW_INPUT_DEVICE_INFO_REQ) : NULL;
PUINT pcbSize = req->hasSize ? &req->cbSize : NULL;
ULONG lenData = 0;
if (reqData && pcbSize) {
lenData = *pcbSize;
if (reqData && req->cbSize > 0) {
lenData = req->cbSize;
if (req->uiCommand == RIDI_DEVICENAME && req->unicode) {
lenData *= sizeof(WCHAR);
}
@ -3544,15 +3543,14 @@ ULONG GuiServer::GetRawInputDeviceInfoSlave(SlaveArgs *args)
SetLastError(ERROR_SUCCESS);
if (req->unicode) {
rpl->retval = GetRawInputDeviceInfoW((HANDLE)req->hDevice, req->uiCommand, reqData, pcbSize);
rpl->retval = GetRawInputDeviceInfoW((HANDLE)req->hDevice, req->uiCommand, reqData, &req->cbSize);
}
else {
rpl->retval = GetRawInputDeviceInfoA((HANDLE)req->hDevice, req->uiCommand, reqData, pcbSize);
rpl->retval = GetRawInputDeviceInfoA((HANDLE)req->hDevice, req->uiCommand, reqData, &req->cbSize);
}
rpl->error = GetLastError();
if (pcbSize)
rpl->cbSize = *pcbSize;
rpl->cbSize = req->cbSize;
if (lenData) {
rpl->hasData = TRUE;

View File

@ -697,7 +697,6 @@ struct tagGUI_GET_RAW_INPUT_DEVICE_INFO_REQ
UINT uiCommand;
BOOLEAN unicode;
BOOLEAN hasData;
BOOLEAN hasSize;
UINT cbSize;
};