From 7b95fcf93d5ec38edd442492ec66459175f81106 Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Tue, 12 Dec 2017 12:44:44 +0100
Subject: [PATCH] [NTOS:KD] Avoid _alloca inside SEH, as it's apparently
 incompatible with PSEH. CORE-14103

---
 ntoskrnl/kd/kdio.c      |  5 +++--
 ntoskrnl/kd64/kdprint.c | 10 +++++-----
 ntoskrnl/kdbg/kdb_cli.c | 10 ++++++----
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/ntoskrnl/kd/kdio.c b/ntoskrnl/kd/kdio.c
index 205842056ff..50e4d8168f2 100644
--- a/ntoskrnl/kd/kdio.c
+++ b/ntoskrnl/kd/kdio.c
@@ -574,17 +574,18 @@ KdpPrintString(
     PLIST_ENTRY CurrentEntry;
     PKD_DISPATCH_TABLE CurrentTable;
     PCHAR String;
+    CHAR StringBuffer[512];
 
     if (!KdpDebugMode.Value) return 0;
 
-    Length = min(Length, 512);
+    Length = min(Length, sizeof(StringBuffer));
 
     if (ExGetPreviousMode() != KernelMode)
     {
         _SEH2_TRY
         {
             ProbeForRead(UnsafeString, Length, 1);
-            String = _alloca(Length);
+            String = StringBuffer;
             RtlCopyMemory(String, UnsafeString, Length);
         }
         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
diff --git a/ntoskrnl/kd64/kdprint.c b/ntoskrnl/kd64/kdprint.c
index 71a681d6e7d..7604a255ab4 100644
--- a/ntoskrnl/kd64/kdprint.c
+++ b/ntoskrnl/kd64/kdprint.c
@@ -220,14 +220,15 @@ KdpPrompt(IN LPSTR PromptString,
 {
     STRING PromptBuffer, ResponseBuffer;
     BOOLEAN Enable, Resend;
-    PVOID CapturedPrompt;
+    CHAR CapturedPrompt[512];
+    CHAR SafeResponseBuffer[512];
     PCHAR SafeResponseString;
 
     /* Normalize the lengths */
     PromptLength = min(PromptLength,
-                       512);
+                       sizeof(CapturedPrompt));
     MaximumResponseLength = min(MaximumResponseLength,
-                                512);
+                                sizeof(SafeResponseBuffer));
 
     /* Check if we need to verify the string */
     if (PreviousMode != KernelMode)
@@ -241,7 +242,6 @@ KdpPrompt(IN LPSTR PromptString,
                          1);
 
             /* Capture prompt */
-            CapturedPrompt = _alloca(PromptLength);
             KdpMoveMemory(CapturedPrompt,
                           PromptString,
                           PromptLength);
@@ -251,7 +251,7 @@ KdpPrompt(IN LPSTR PromptString,
             ProbeForWrite(ResponseString,
                           MaximumResponseLength,
                           1);
-            SafeResponseString = _alloca(MaximumResponseLength);
+            SafeResponseString = SafeResponseBuffer;
         }
         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
         {
diff --git a/ntoskrnl/kdbg/kdb_cli.c b/ntoskrnl/kdbg/kdb_cli.c
index a2829e40cab..f5e71bd369b 100644
--- a/ntoskrnl/kdbg/kdb_cli.c
+++ b/ntoskrnl/kdbg/kdb_cli.c
@@ -3675,12 +3675,14 @@ KdpPrompt(
     KIRQL OldIrql;
     PCHAR InString;
     PCHAR OutString;
+    CHAR InStringBuffer[512];
+    CHAR OutStringBuffer[512];
 
     /* Normalize the lengths */
     InStringLength = min(InStringLength,
-                         512);
+                         sizeof(InStringBuffer));
     OutStringLength = min(OutStringLength,
-                          512);
+                          sizeof(OutStringBuffer));
 
     /* Check if we need to verify the string */
     if (PreviousMode != KernelMode)
@@ -3694,7 +3696,7 @@ KdpPrompt(
                          1);
 
             /* Capture prompt */
-            InString = _alloca(InStringLength);
+            InString = InStringBuffer;
             RtlCopyMemory(InString,
                           UnsafeInString,
                           InStringLength);
@@ -3703,7 +3705,7 @@ KdpPrompt(
             ProbeForWrite(UnsafeOutString,
                           OutStringLength,
                           1);
-            OutString = _alloca(OutStringLength);
+            OutString = OutStringBuffer;
         }
         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
         {
-- 
2.17.1