diff --git a/Sandboxie/core/dll/guimisc.c b/Sandboxie/core/dll/guimisc.c index 5f7336a117..5331796094 100644 --- a/Sandboxie/core/dll/guimisc.c +++ b/Sandboxie/core/dll/guimisc.c @@ -1348,13 +1348,16 @@ _FX LONG Gui_GetRawInputDeviceInfo_impl( req->uiCommand = uiCommand; req->unicode = bUnicode; req->hasData = !!pData; - req->hasSize = !!pcbSize; if (lenData) memcpy(reqData, pData, lenData); + // GetRawInputDeviceInfoA accesses pcbSize without testing it for being not NULL + // hence if the caller passes NULL we use a dummy value so that we dont crash the helper service if (pcbSize) req->cbSize = *pcbSize; + else + req->cbSize = 0; rpl = Gui_CallProxy(req, reqSize, sizeof(*rpl)); diff --git a/Sandboxie/core/svc/GuiServer.cpp b/Sandboxie/core/svc/GuiServer.cpp index 97904923d5..c373287e5c 100644 --- a/Sandboxie/core/svc/GuiServer.cpp +++ b/Sandboxie/core/svc/GuiServer.cpp @@ -3532,11 +3532,10 @@ ULONG GuiServer::GetRawInputDeviceInfoSlave(SlaveArgs *args) return STATUS_INFO_LENGTH_MISMATCH; LPVOID reqData = req->hasData ? (BYTE*)req + sizeof(GUI_GET_RAW_INPUT_DEVICE_INFO_REQ) : NULL; - PUINT pcbSize = req->hasSize ? &req->cbSize : NULL; ULONG lenData = 0; - if (reqData && pcbSize) { - lenData = *pcbSize; + if (reqData && req->cbSize > 0) { + lenData = req->cbSize; if (req->uiCommand == RIDI_DEVICENAME && req->unicode) { lenData *= sizeof(WCHAR); } @@ -3544,15 +3543,14 @@ ULONG GuiServer::GetRawInputDeviceInfoSlave(SlaveArgs *args) SetLastError(ERROR_SUCCESS); if (req->unicode) { - rpl->retval = GetRawInputDeviceInfoW((HANDLE)req->hDevice, req->uiCommand, reqData, pcbSize); + rpl->retval = GetRawInputDeviceInfoW((HANDLE)req->hDevice, req->uiCommand, reqData, &req->cbSize); } else { - rpl->retval = GetRawInputDeviceInfoA((HANDLE)req->hDevice, req->uiCommand, reqData, pcbSize); + rpl->retval = GetRawInputDeviceInfoA((HANDLE)req->hDevice, req->uiCommand, reqData, &req->cbSize); } rpl->error = GetLastError(); - if (pcbSize) - rpl->cbSize = *pcbSize; + rpl->cbSize = req->cbSize; if (lenData) { rpl->hasData = TRUE; diff --git a/Sandboxie/core/svc/GuiWire.h b/Sandboxie/core/svc/GuiWire.h index 0dcef76cf5..8ba10f8815 100644 --- a/Sandboxie/core/svc/GuiWire.h +++ b/Sandboxie/core/svc/GuiWire.h @@ -697,7 +697,6 @@ struct tagGUI_GET_RAW_INPUT_DEVICE_INFO_REQ UINT uiCommand; BOOLEAN unicode; BOOLEAN hasData; - BOOLEAN hasSize; UINT cbSize; };