From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Wed, 27 Oct 2010 17:08:40 +0000 (+0000)
Subject: [WIN32K]
X-Git-Tag: backups/baikalnet@57446~74
X-Git-Url: https://git.reactos.org/?p=reactos.git;a=commitdiff_plain;h=72f80d0c80ef4bf49e8cd6ee6d5296e90479b679

[WIN32K]
Fix possible NULL pointer dereferences. Spotted by Amine Khaldi.

svn path=/trunk/; revision=49309
---

diff --git a/reactos/subsystems/win32/win32k/ntuser/keyboard.c b/reactos/subsystems/win32/win32k/ntuser/keyboard.c
index 62b2d7d9042..04be007a32d 100644
--- a/reactos/subsystems/win32/win32k/ntuser/keyboard.c
+++ b/reactos/subsystems/win32/win32k/ntuser/keyboard.c
@@ -941,6 +941,12 @@ W32kKeyProcessMessage(LPMSG Msg,
          VscVkTable = KeyboardLayout->pVSCtoVK_E1;
       }
 
+      if (!VscVkTable)
+      {
+          DPRINT1("somethings wrong, Prefix=0x%x", Prefix);
+          return;
+      }
+
       RawVk = 0xff;
       while (VscVkTable->Vsc)
       {
diff --git a/reactos/subsystems/win32/win32k/ntuser/message.c b/reactos/subsystems/win32/win32k/ntuser/message.c
index afec69e5cd1..319e599d859 100644
--- a/reactos/subsystems/win32/win32k/ntuser/message.c
+++ b/reactos/subsystems/win32/win32k/ntuser/message.c
@@ -2492,18 +2492,23 @@ NtUserMessageCall(
    UserEnterExclusive();
 
    /* Validate input */
-   if (hWnd && (hWnd != INVALID_HANDLE_VALUE) && !(Window = UserGetWindowObject(hWnd)))
+   if (hWnd && (hWnd != INVALID_HANDLE_VALUE))
    {
-      UserLeave();
-      return FALSE;
+      Window = UserGetWindowObject(hWnd);
+      if (!Window)
+      {
+        UserLeave();
+        return FALSE;
+      }
    }
+
    switch(dwType)
    {
       case FNID_DEFWINDOWPROC:
-         UserRefObjectCo(Window, &Ref);
+         if (Window) UserRefObjectCo(Window, &Ref);
          lResult = IntDefWindowProc(Window, Msg, wParam, lParam, Ansi);
          Ret = TRUE;
-         UserDerefObjectCo(Window);
+         if (Window) UserDerefObjectCo(Window);
       break;
       case FNID_SENDNOTIFYMESSAGE:
          Ret = UserSendNotifyMessage(hWnd, Msg, wParam, lParam);