1.14.10

sandboxie-plus · Oct 1, 2024 · 23f4078 · 23f4078
1 parent c01c284
commit 23f4078
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 9 deletions.
diff --git a/Sandboxie/core/dll/guimisc.c b/Sandboxie/core/dll/guimisc.c
@@ -1348,13 +1348,16 @@ _FX LONG Gui_GetRawInputDeviceInfo_impl(
     req->uiCommand = uiCommand;
     req->unicode = bUnicode;
     req->hasData = !!pData;
-    req->hasSize = !!pcbSize;
 
     if (lenData)
         memcpy(reqData, pData, lenData);
 
+    // GetRawInputDeviceInfoA accesses pcbSize without testing it for being not NULL 
+    // hence if the caller passes NULL we use a dummy value so that we dont crash the helper service
     if (pcbSize)
         req->cbSize = *pcbSize;
+    else
+        req->cbSize = 0;
 
     rpl = Gui_CallProxy(req, reqSize, sizeof(*rpl));
 

diff --git a/Sandboxie/core/svc/GuiServer.cpp b/Sandboxie/core/svc/GuiServer.cpp
@@ -3532,27 +3532,25 @@ ULONG GuiServer::GetRawInputDeviceInfoSlave(SlaveArgs *args)
         return STATUS_INFO_LENGTH_MISMATCH;
 
     LPVOID reqData = req->hasData ? (BYTE*)req + sizeof(GUI_GET_RAW_INPUT_DEVICE_INFO_REQ) : NULL;
-    PUINT pcbSize = req->hasSize ? &req->cbSize : NULL;
 
     ULONG lenData = 0;
-    if (reqData && pcbSize) {
-        lenData = *pcbSize;
+    if (reqData && req->cbSize > 0) {
+        lenData = req->cbSize;
         if (req->uiCommand == RIDI_DEVICENAME && req->unicode) {
             lenData *= sizeof(WCHAR);
         }
     }
 
     SetLastError(ERROR_SUCCESS);
     if (req->unicode) {
-        rpl->retval = GetRawInputDeviceInfoW((HANDLE)req->hDevice, req->uiCommand, reqData, pcbSize);
+        rpl->retval = GetRawInputDeviceInfoW((HANDLE)req->hDevice, req->uiCommand, reqData, &req->cbSize);
     }
     else {
-        rpl->retval = GetRawInputDeviceInfoA((HANDLE)req->hDevice, req->uiCommand, reqData, pcbSize);
+        rpl->retval = GetRawInputDeviceInfoA((HANDLE)req->hDevice, req->uiCommand, reqData, &req->cbSize);
     }
     rpl->error = GetLastError();
 
-    if (pcbSize) 
-		rpl->cbSize = *pcbSize;
+    rpl->cbSize = req->cbSize;
 
     if (lenData) {
 		rpl->hasData = TRUE;

diff --git a/Sandboxie/core/svc/GuiWire.h b/Sandboxie/core/svc/GuiWire.h
@@ -697,7 +697,6 @@ struct tagGUI_GET_RAW_INPUT_DEVICE_INFO_REQ
     UINT uiCommand;
     BOOLEAN unicode;
     BOOLEAN hasData;
-    BOOLEAN hasSize;
     UINT cbSize;
 };