- NtUserSetWindowsHookEx: Don't leak a thread reference in case we are passed a Thread Id

[reactos.git] / reactos / subsystems / win32 / win32k / ntuser / hook.c

diff --git a/reactos/subsystems/win32/win32k/ntuser/hook.c b/reactos/subsystems/win32/win32k/ntuser/hook.c
index 5b508ff..d0ff498 100644 (file)
--- a/reactos/subsystems/win32/win32k/ntuser/hook.c
+++ b/reactos/subsystems/win32/win32k/ntuser/hook.c
@@ -72,9 +72,9 @@ PHOOK FASTCALL IntGetHookObject(HHOOK hHook)
 static PHOOK
 IntAddHook(PETHREAD Thread, int HookId, BOOLEAN Global, PWINSTATION_OBJECT WinStaObj)
 {
-   PW32THREAD W32Thread;
+   PTHREADINFO W32Thread;
    PHOOK Hook;
-   PHOOKTABLE Table = Global ? GlobalHooks : MsqGetHooks(((PW32THREAD)Thread->Tcb.Win32Thread)->MessageQueue);
+   PHOOKTABLE Table = Global ? GlobalHooks : MsqGetHooks(((PTHREADINFO)Thread->Tcb.Win32Thread)->MessageQueue);
    HANDLE Handle;
 
    if (NULL == Table)
@@ -90,7 +90,7 @@ IntAddHook(PETHREAD Thread, int HookId, BOOLEAN Global, PWINSTATION_OBJECT WinSt
       }
       else
       {
-         MsqSetHooks(((PW32THREAD)Thread->Tcb.Win32Thread)->MessageQueue, Table);
+         MsqSetHooks(((PTHREADINFO)Thread->Tcb.Win32Thread)->MessageQueue, Table);
       }
    }
 
@@ -106,7 +106,7 @@ IntAddHook(PETHREAD Thread, int HookId, BOOLEAN Global, PWINSTATION_OBJECT WinSt
 
    if (Thread)
    {
-      W32Thread = ((PW32THREAD)Thread->Tcb.Win32Thread);
+      W32Thread = ((PTHREADINFO)Thread->Tcb.Win32Thread);
       ASSERT(W32Thread != NULL);
       W32Thread->Hooks |= HOOKID_TO_FLAG(HookId);
       if (W32Thread->ThreadInfo != NULL)
@@ -130,7 +130,7 @@ IntGetTable(PHOOK Hook)
       return GlobalHooks;
    }
 
-   return MsqGetHooks(((PW32THREAD)Hook->Thread->Tcb.Win32Thread)->MessageQueue);
+   return MsqGetHooks(((PTHREADINFO)Hook->Thread->Tcb.Win32Thread)->MessageQueue);
 }
 
 /* get the first hook in the chain */
@@ -208,7 +208,7 @@ IntFreeHook(PHOOKTABLE Table, PHOOK Hook, PWINSTATION_OBJECT WinStaObj)
 static VOID
 IntRemoveHook(PHOOK Hook, PWINSTATION_OBJECT WinStaObj, BOOL TableAlreadyLocked)
 {
-   PW32THREAD W32Thread;
+   PTHREADINFO W32Thread;
    PHOOKTABLE Table = IntGetTable(Hook);
 
    ASSERT(NULL != Table);
@@ -217,7 +217,7 @@ IntRemoveHook(PHOOK Hook, PWINSTATION_OBJECT WinStaObj, BOOL TableAlreadyLocked)
       return;
    }
 
-   W32Thread = ((PW32THREAD)Hook->Thread->Tcb.Win32Thread);
+   W32Thread = ((PTHREADINFO)Hook->Thread->Tcb.Win32Thread);
    ASSERT(W32Thread != NULL);
    W32Thread->Hooks &= ~HOOKID_TO_FLAG(Hook->HookId);
    if (W32Thread->ThreadInfo != NULL)
@@ -274,14 +274,14 @@ IntCallLowLevelHook(PHOOK Hook, INT Code, WPARAM wParam, LPARAM lParam)
 
    /* FIXME should get timeout from
     * HKEY_CURRENT_USER\Control Panel\Desktop\LowLevelHooksTimeout */
-   Status = co_MsqSendMessage(((PW32THREAD)Hook->Thread->Tcb.Win32Thread)->MessageQueue,
+   Status = co_MsqSendMessage(((PTHREADINFO)Hook->Thread->Tcb.Win32Thread)->MessageQueue,
                                     (HWND) Code,
                                    Hook->HookId,
                                          wParam,
                                          lParam,
                                            5000,
                                            TRUE,
-                                           TRUE,
+                                     MSQ_ISHOOK,
                                        &uResult);
 
    return NT_SUCCESS(Status) ? uResult : 0;
@@ -295,8 +295,8 @@ FASTCALL
 co_HOOK_CallHooks(INT HookId, INT Code, WPARAM wParam, LPARAM lParam)
 {
    PHOOK Hook, SaveHook;
-   PW32THREAD Win32Thread;
-   PW32CLIENTINFO ClientInfo;
+   PTHREADINFO pti;
+   PCLIENTINFO ClientInfo;
    PHOOKTABLE Table;
    LRESULT Result;
    PWINSTATION_OBJECT WinStaObj;
@@ -304,14 +304,14 @@ co_HOOK_CallHooks(INT HookId, INT Code, WPARAM wParam, LPARAM lParam)
 
    ASSERT(WH_MINHOOK <= HookId && HookId <= WH_MAXHOOK);
 
-   Win32Thread = PsGetCurrentThreadWin32Thread();
-   if (NULL == Win32Thread)
+   pti = PsGetCurrentThreadWin32Thread();
+   if (!pti)
    {
       Table = NULL;
    }
    else
    {
-      Table = MsqGetHooks(Win32Thread->MessageQueue);
+      Table = MsqGetHooks(pti->MessageQueue);
    }
 
    if (NULL == Table || ! (Hook = IntGetFirstValidHook(Table, HookId)))
@@ -361,7 +361,7 @@ co_HOOK_CallHooks(INT HookId, INT Code, WPARAM wParam, LPARAM lParam)
    }
    else
    {
-      IntReleaseHookChain(MsqGetHooks(PsGetCurrentThreadWin32Thread()->MessageQueue), HookId, WinStaObj);
+      IntReleaseHookChain(MsqGetHooks(pti->MessageQueue), HookId, WinStaObj);
       IntReleaseHookChain(GlobalHooks, HookId, WinStaObj);
       ObDereferenceObject(WinStaObj);
    }
@@ -450,7 +450,7 @@ IntCallDebugHook(
 
    if (lParam)
    {
-      _SEH_TRY
+      _SEH2_TRY
       {
           ProbeForRead((PVOID)lParam,
                        sizeof(DEBUGHOOKINFO),
@@ -459,11 +459,11 @@ IntCallDebugHook(
                   (PVOID)lParam,
                   sizeof(DEBUGHOOKINFO));
       }
-      _SEH_HANDLE
+      _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
       {
           BadChk = TRUE;
       }
-      _SEH_END;
+      _SEH2_END;
       if (BadChk)
       {
           DPRINT1("HOOK WH_DEBUG read from lParam ERROR!\n");
@@ -529,7 +529,7 @@ IntCallDebugHook(
 
    if (HooklParam)
    {
-      _SEH_TRY
+      _SEH2_TRY
       {
           ProbeForRead((PVOID)Debug.lParam,
                                       Size,
@@ -538,11 +538,11 @@ IntCallDebugHook(
                 (PVOID)Debug.lParam,
                                Size);
       }
-      _SEH_HANDLE
+      _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
       {
           BadChk = TRUE;
       }
-      _SEH_END;
+      _SEH2_END;
       if (BadChk)
       {
           DPRINT1("HOOK WH_DEBUG read from Debug.lParam ERROR!\n");
@@ -553,7 +553,7 @@ IntCallDebugHook(
 
    if (HooklParam) Debug.lParam = (LPARAM)HooklParam;
    lResult = co_HOOK_CallHookNext(Hook, Code, wParam, (LPARAM)&Debug);
-   if (HooklParam) ExFreePool(HooklParam);
+   if (HooklParam) ExFreePoolWithTag(HooklParam, TAG_HOOK);
    return lResult;
 }
 
@@ -579,7 +579,7 @@ UserCallNextHookEx(
      MOUSEHOOKSTRUCTEX Mouse;
      if (lParam)
      {
-        _SEH_TRY
+        _SEH2_TRY
         {
            ProbeForRead((PVOID)lParam,
                         sizeof(MOUSEHOOKSTRUCTEX),
@@ -588,11 +588,11 @@ UserCallNextHookEx(
                    (PVOID)lParam,
                    sizeof(MOUSEHOOKSTRUCTEX));
         }
-        _SEH_HANDLE
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
         {
            BadChk = TRUE;
         }
-        _SEH_END;
+        _SEH2_END;
         if (BadChk)
         {
             DPRINT1("HOOK WH_MOUSE read from lParam ERROR!\n");
@@ -612,7 +612,7 @@ UserCallNextHookEx(
          MSLLHOOKSTRUCT Mouse;
          if (lParam)
          {
-            _SEH_TRY
+            _SEH2_TRY
             {
                 ProbeForRead((PVOID)lParam,
                              sizeof(MSLLHOOKSTRUCT),
@@ -621,11 +621,11 @@ UserCallNextHookEx(
                         (PVOID)lParam,
                         sizeof(MSLLHOOKSTRUCT));
             }
-            _SEH_HANDLE
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
             {
                BadChk = TRUE;
             }
-            _SEH_END;
+            _SEH2_END;
             if (BadChk)
             {
                 DPRINT1("HOOK WH_MOUSE_LL read from lParam ERROR!\n");
@@ -643,7 +643,7 @@ UserCallNextHookEx(
          KBDLLHOOKSTRUCT Keyboard;
          if (lParam)
          {
-            _SEH_TRY
+            _SEH2_TRY
             {
                 ProbeForRead((PVOID)lParam,
                              sizeof(KBDLLHOOKSTRUCT),
@@ -652,11 +652,11 @@ UserCallNextHookEx(
                         (PVOID)lParam,
                         sizeof(KBDLLHOOKSTRUCT));
             }
-            _SEH_HANDLE
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
             {
                BadChk = TRUE;
             }
-            _SEH_END;
+            _SEH2_END;
             if (BadChk)
             {
                 DPRINT1("HOOK WH_KEYBORD_LL read from lParam ERROR!\n");
@@ -676,7 +676,7 @@ UserCallNextHookEx(
          MSG Msg;
          if (lParam)
          {
-            _SEH_TRY
+            _SEH2_TRY
             {
                ProbeForRead((PVOID)lParam,
                                sizeof(MSG),
@@ -685,11 +685,11 @@ UserCallNextHookEx(
                      (PVOID)lParam,
                        sizeof(MSG));
             }
-            _SEH_HANDLE
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
             {
               BadChk = TRUE;
             }
-            _SEH_END;
+            _SEH2_END;
             if (BadChk)
             {
                DPRINT1("HOOK WH_XMESSAGEX read from lParam ERROR!\n");
@@ -700,7 +700,7 @@ UserCallNextHookEx(
             lResult = co_HOOK_CallHookNext(Hook, Code, wParam, (LPARAM)&Msg);
             if (lParam && (Hook->HookId == WH_GETMESSAGE))
             {
-               _SEH_TRY
+               _SEH2_TRY
                {
                   ProbeForWrite((PVOID)lParam,
                                   sizeof(MSG),
@@ -709,11 +709,11 @@ UserCallNextHookEx(
                                          &Msg,
                                   sizeof(MSG));
                }
-               _SEH_HANDLE
+               _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
                {
                  BadChk = TRUE;
                }
-               _SEH_END;
+               _SEH2_END;
                if (BadChk)
                {
                   DPRINT1("HOOK WH_GETMESSAGE write to lParam ERROR!\n");
@@ -738,7 +738,7 @@ UserCallNextHookEx(
                DPRINT1("HOOK HCBT_MOVESIZE\n");
                if (lParam)
                {
-                  _SEH_TRY
+                  _SEH2_TRY
                   {
                       ProbeForRead((PVOID)lParam,
                                     sizeof(RECT),
@@ -747,11 +747,11 @@ UserCallNextHookEx(
                            (PVOID)lParam,
                             sizeof(RECT));
                   }
-                  _SEH_HANDLE
+                  _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
                   {
                      BadChk = TRUE;
                   }
-                  _SEH_END;
+                  _SEH2_END;
                   if (BadChk)
                   {
                       DPRINT1("HOOK HCBT_MOVESIZE read from lParam ERROR!\n");
@@ -770,7 +770,7 @@ UserCallNextHookEx(
                DPRINT1("HOOK HCBT_ACTIVATE\n");
                if (lParam)
                {
-                  _SEH_TRY
+                  _SEH2_TRY
                   {
                       ProbeForRead((PVOID)lParam,
                                    sizeof(CBTACTIVATESTRUCT),
@@ -779,11 +779,11 @@ UserCallNextHookEx(
                              (PVOID)lParam,
                              sizeof(CBTACTIVATESTRUCT));
                   }
-                  _SEH_HANDLE
+                  _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
                   {
                      BadChk = TRUE;
                   }
-                  _SEH_END;
+                  _SEH2_END;
                   if (BadChk)
                   {
                       DPRINT1("HOOK HCBT_ACTIVATE read from lParam ERROR!\n");
@@ -811,7 +811,7 @@ UserCallNextHookEx(
          EVENTMSG EventMsg;
          if (lParam)
          {
-            _SEH_TRY
+            _SEH2_TRY
             {
                 ProbeForRead((PVOID)lParam,
                              sizeof(EVENTMSG),
@@ -820,11 +820,11 @@ UserCallNextHookEx(
                         (PVOID)lParam,
                         sizeof(EVENTMSG));
             }
-            _SEH_HANDLE
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
             {
                BadChk = TRUE;
             }
-            _SEH_END;
+            _SEH2_END;
             if (BadChk)
             {
                 DPRINT1("HOOK WH_JOURNAL read from lParam ERROR!\n");
@@ -835,7 +835,7 @@ UserCallNextHookEx(
             lResult = co_HOOK_CallHookNext(Hook, Code, wParam, (LPARAM)(lParam ? &EventMsg : NULL));
             if (lParam)
             {
-               _SEH_TRY
+               _SEH2_TRY
                {
                   ProbeForWrite((PVOID)lParam,
                                   sizeof(EVENTMSG),
@@ -844,11 +844,11 @@ UserCallNextHookEx(
                                          &EventMsg,
                                   sizeof(EVENTMSG));
                }
-               _SEH_HANDLE
+               _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
                {
                  BadChk = TRUE;
                }
-               _SEH_END;
+               _SEH2_END;
                if (BadChk)
                {
                   DPRINT1("HOOK WH_JOURNAL write to lParam ERROR!\n");
@@ -878,7 +878,7 @@ UserCallNextHookEx(
 }
 
 LRESULT
-STDCALL
+APIENTRY
 NtUserCallNextHookEx(
    int Code,
    WPARAM wParam,
@@ -886,7 +886,7 @@ NtUserCallNextHookEx(
    BOOL Ansi)
 {
    PHOOK HookObj, NextObj;
-   PW32CLIENTINFO ClientInfo;
+   PCLIENTINFO ClientInfo;
    PWINSTATION_OBJECT WinStaObj;
    NTSTATUS Status;
    DECLARE_RETURN(LRESULT);
@@ -940,7 +940,7 @@ CLEANUP:
 }
 
 HHOOK
-STDCALL
+APIENTRY
 NtUserSetWindowsHookAW(
    int idHook, 
    HOOKPROC lpfn,
@@ -952,7 +952,7 @@ NtUserSetWindowsHookAW(
 }
 
 HHOOK
-STDCALL
+APIENTRY
 NtUserSetWindowsHookEx(
    HINSTANCE Mod,
    PUNICODE_STRING UnsafeModuleName,
@@ -962,7 +962,7 @@ NtUserSetWindowsHookEx(
    BOOL Ansi)
 {
    PWINSTATION_OBJECT WinStaObj;
-   PW32CLIENTINFO ClientInfo;
+   PCLIENTINFO ClientInfo;
    BOOLEAN Global;
    PETHREAD Thread;
    PHOOK Hook;
@@ -974,12 +974,18 @@ NtUserSetWindowsHookEx(
    DPRINT("Enter NtUserSetWindowsHookEx\n");
    UserEnterExclusive();
 
-   if (HookId < WH_MINHOOK || WH_MAXHOOK < HookId || NULL == HookProc)
+   if (HookId < WH_MINHOOK || WH_MAXHOOK < HookId )
    {
       SetLastWin32Error(ERROR_INVALID_PARAMETER);
       RETURN( NULL);
    }
 
+   if (!HookProc)
+   {
+      SetLastWin32Error(ERROR_INVALID_FILTER_PROC);
+      RETURN( NULL);
+   }
+
    ClientInfo = GetWin32ClientInfo();
 
    if (ThreadId)  /* thread-local hook */
@@ -1029,7 +1035,7 @@ NtUserSetWindowsHookEx(
       }
       else if (NULL ==  Mod)
       {
-         SetLastWin32Error(ERROR_INVALID_PARAMETER);
+         SetLastWin32Error(ERROR_HOOK_NEEDS_HMOD);
          RETURN( NULL);
       }
       else
@@ -1039,10 +1045,7 @@ NtUserSetWindowsHookEx(
       Global = TRUE;
    }
 
-   /* We only (partially) support local WH_CBT hooks and
-    * WH_KEYBOARD_LL, WH_MOUSE_LL and WH_GETMESSAGE hooks for now 
-    */
-   if  (Global ||
+   if ( ( Global && (HookId != WH_KEYBOARD_LL || HookId != WH_MOUSE_LL) ) ||
         WH_DEBUG == HookId ||
         WH_JOURNALPLAYBACK == HookId ||
         WH_JOURNALRECORD == HookId)
@@ -1128,7 +1131,7 @@ NtUserSetWindowsHookEx(
                                 ModuleName.MaximumLength);
       if (! NT_SUCCESS(Status))
       {
-            ExFreePool(Hook->ModuleName.Buffer);
+         ExFreePoolWithTag(Hook->ModuleName.Buffer, TAG_HOOK);
          UserDereferenceObject(Hook);
          IntRemoveHook(Hook, WinStaObj, FALSE);
          if (NULL != Thread)
@@ -1140,9 +1143,12 @@ NtUserSetWindowsHookEx(
          RETURN( NULL);
       }
       Hook->ModuleName.Length = ModuleName.Length;
+      /* make proc relative to the module base */
+      Hook->Proc = (void *)((char *)HookProc - (char *)Mod);
    }
+   else
+     Hook->Proc = HookProc;
 
-   Hook->Proc = HookProc;
    Hook->Ansi = Ansi;
    Handle = Hook->Self;
 
@@ -1150,6 +1156,11 @@ NtUserSetWindowsHookEx(
    ClientInfo->phkCurrent = 0;
    
    UserDereferenceObject(Hook);
+
+   if (NULL != Thread)
+   {
+      ObDereferenceObject(Thread);
+   }
    ObDereferenceObject(WinStaObj);
 
    RETURN( Handle);
@@ -1162,7 +1173,7 @@ CLEANUP:
 
 
 BOOL
-STDCALL
+APIENTRY
 NtUserUnhookWindowsHookEx(
    HHOOK Hook)
 {