Index: ntoskrnl/lpc/connect.c
===================================================================
--- ntoskrnl/lpc/connect.c	(revision 63442)
+++ ntoskrnl/lpc/connect.c	(working copy)
@@ -100,6 +100,9 @@
     LARGE_INTEGER SectionOffset;
     PTOKEN Token;
     PTOKEN_USER TokenUserInfo;
+    SECURITY_QUALITY_OF_SERVICE CapturedQos;
+    PORT_VIEW CapturedClientView;
+    REMOTE_PORT_VIEW CapturedServerView;
     PAGED_CODE();
     LPCTRACE(LPC_CONNECT_DEBUG,
              "Name: %wZ. Qos: %p. Views: %p/%p. Sid: %p\n",
@@ -109,25 +112,109 @@
              ServerView,
              ServerSid);
 
-    /* Validate client view */
-    if ((ClientView) && (ClientView->Length != sizeof(PORT_VIEW)))
+    /* Check if the call comes from user mode */
+    if (PreviousMode != KernelMode)
     {
-        /* Fail */
-        return STATUS_INVALID_PARAMETER;
+        _SEH2_TRY
+        {
+            /* Probe the PortHandle */
+            ProbeForWriteHandle(PortHandle);
+
+            /* Probe and capture the QoS */
+            ProbeForRead(Qos, sizeof(SECURITY_QUALITY_OF_SERVICE), sizeof(ULONG));
+            RtlCopyMemory(&CapturedQos, Qos, sizeof(SECURITY_QUALITY_OF_SERVICE));
+            Qos = &CapturedQos;
+
+            if (ClientView)
+            {
+                /* Probe the ClientView */
+                ProbeForWrite(ClientView, sizeof(PORT_VIEW), sizeof(ULONG));
+
+                if (ClientView->Length != sizeof(PORT_VIEW))
+                {
+                    /* Fail */
+                    _SEH2_YIELD(return STATUS_INVALID_PARAMETER);
+                }
+
+                /* Capture the ClientView */
+                RtlCopyMemory(&CapturedClientView,
+                              ClientView,
+                              sizeof(PORT_VIEW));
+            }
+
+            if (ServerSid)
+            {
+                /* Probe the ServerSid */
+                ProbeForRead(ServerSid, RtlLengthSid(ServerSid), sizeof(ULONG));
+            }
+
+            if (ServerView)
+            {
+                /* Probe the ServerView */
+                ProbeForWrite(ServerView, sizeof(REMOTE_PORT_VIEW), sizeof(ULONG));
+
+                if (ServerView->Length != sizeof(REMOTE_PORT_VIEW))
+                {
+                    /* Fail */
+                    _SEH2_YIELD(return STATUS_INVALID_PARAMETER);
+                }
+
+                /* Capture the ServerView */
+                RtlCopyMemory(&CapturedServerView,
+                              ServerView,
+                              sizeof(REMOTE_PORT_VIEW));
+            }
+
+            /* Probe the MaxMessageLength */
+            if (MaxMessageLength) ProbeForWriteUlong(MaxMessageLength);
+
+            /* Check if caller sent connection information length */
+            if (ConnectionInformationLength)
+            {
+                /* Probe it first */
+                ProbeForWriteUlong(ConnectionInformationLength);
+
+                /* Retrieve the input length */
+                ConnectionInfoLength = *ConnectionInformationLength;
+            }
+
+            if (ConnectionInformation)
+            {
+                /* Probe the ConnectionInformation */
+                ProbeForWrite(ConnectionInformation,
+                              ConnectionInfoLength,
+                              sizeof(ULONG));
+            }
+        }
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+        {
+            /* Return the exception code */
+            _SEH2_YIELD(return _SEH2_GetExceptionCode());
+        }
+        _SEH2_END;
     }
-
-    /* Validate server view */
-    if ((ServerView) && (ServerView->Length != sizeof(REMOTE_PORT_VIEW)))
+    else
     {
-        /* Fail */
-        return STATUS_INVALID_PARAMETER;
-    }
+        /* Validate client view */
+        if ((ClientView) && (ClientView->Length != sizeof(PORT_VIEW)))
+        {
+            /* Fail */
+            return STATUS_INVALID_PARAMETER;
+        }
 
-    /* Check if caller sent connection information length */
-    if (ConnectionInformationLength)
-    {
-        /* Retrieve the input length */
-        ConnectionInfoLength = *ConnectionInformationLength;
+        /* Validate server view */
+        if ((ServerView) && (ServerView->Length != sizeof(REMOTE_PORT_VIEW)))
+        {
+            /* Fail */
+            return STATUS_INVALID_PARAMETER;
+        }
+
+        /* Check if caller sent connection information length */
+        if (ConnectionInformationLength)
+        {
+            /* Retrieve the input length */
+            ConnectionInfoLength = *ConnectionInformationLength;
+        }
     }
 
     /* Get the port */
@@ -167,12 +254,20 @@
             /* Check for success */
             if (NT_SUCCESS(Status))
             {
-                /* Compare the SIDs */
-                if (!RtlEqualSid(ServerSid, TokenUserInfo->User.Sid))
+                _SEH2_TRY
                 {
-                    /* Fail */
-                    Status = STATUS_SERVER_SID_MISMATCH;
+                    /* Compare the SIDs */
+                    if (!RtlEqualSid(ServerSid, TokenUserInfo->User.Sid))
+                    {
+                        /* Fail */
+                        Status = STATUS_SERVER_SID_MISMATCH;
+                    }
                 }
+                _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+                {
+                    Status = _SEH2_GetExceptionCode();
+                }
+                _SEH2_END;
 
                 /* Free token information */
                 ExFreePool(TokenUserInfo);
@@ -253,7 +348,7 @@
     if (ClientView)
     {
         /* Get the section handle */
-        Status = ObReferenceObjectByHandle(ClientView->SectionHandle,
+        Status = ObReferenceObjectByHandle(CapturedClientView.SectionHandle,
                                            SECTION_MAP_READ |
                                            SECTION_MAP_WRITE,
                                            MmSectionObjectType,
@@ -268,7 +363,7 @@
         }
 
         /* Set the section offset */
-        SectionOffset.QuadPart = ClientView->SectionOffset;
+        SectionOffset.QuadPart = CapturedClientView.SectionOffset;
 
         /* Map it */
         Status = MmMapViewOfSection(SectionToMap,
@@ -277,13 +372,13 @@
                                     0,
                                     0,
                                     &SectionOffset,
-                                    &ClientView->ViewSize,
+                                    &CapturedClientView.ViewSize,
                                     ViewUnmap,
                                     0,
                                     PAGE_READWRITE);
 
         /* Update the offset */
-        ClientView->SectionOffset = SectionOffset.LowPart;
+        CapturedClientView.SectionOffset = SectionOffset.LowPart;
 
         /* Check for failure */
         if (!NT_SUCCESS(Status))
@@ -295,7 +390,7 @@
         }
 
         /* Update the base */
-        ClientView->ViewBase = ClientPort->ClientSectionBase;
+        CapturedClientView.ViewBase = ClientPort->ClientSectionBase;
 
         /* Reference and remember the process */
         ClientPort->MappingProcess = PsGetCurrentProcess();
@@ -332,11 +427,11 @@
     if (ClientView)
     {
         /* Set the view size */
-        Message->Request.ClientViewSize = ClientView->ViewSize;
+        Message->Request.ClientViewSize = CapturedClientView.ViewSize;
 
         /* Copy the client view and clear the server view */
         RtlCopyMemory(&ConnectMessage->ClientView,
-                      ClientView,
+                      &CapturedClientView,
                       sizeof(PORT_VIEW));
         RtlZeroMemory(&ConnectMessage->ServerView, sizeof(REMOTE_PORT_VIEW));
     }
@@ -361,10 +456,19 @@
     /* Check if we have connection information */
     if (ConnectionInformation)
     {
-        /* Copy it in */
-        RtlCopyMemory(ConnectMessage + 1,
-                      ConnectionInformation,
-                      ConnectionInfoLength);
+        _SEH2_TRY
+        {
+            /* Copy it in */
+            RtlCopyMemory(ConnectMessage + 1,
+                          ConnectionInformation,
+                          ConnectionInfoLength);
+        }
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+        {
+            Status = _SEH2_GetExceptionCode();
+            _SEH2_YIELD(goto Cleanup);
+        }
+        _SEH2_END;
     }
 
     /* Acquire the port lock */
@@ -453,14 +557,23 @@
             /* Check if we had a length pointer */
             if (ConnectionInformationLength)
             {
-                /* Return the length */
-                *ConnectionInformationLength = ConnectionInfoLength;
+                _SEH2_TRY
+                {
+                    /* Return the length */
+                    *ConnectionInformationLength = ConnectionInfoLength;
+
+                    /* Return the connection information */
+                    RtlCopyMemory(ConnectionInformation,
+                                  ConnectMessage + 1,
+                                  ConnectionInfoLength );
+                }
+                _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+                {
+                    Status = _SEH2_GetExceptionCode();
+                    _SEH2_YIELD(goto Cleanup);
+                }
+                _SEH2_END;
             }
-
-            /* Return the connection information */
-            RtlCopyMemory(ConnectionInformation,
-                          ConnectMessage + 1,
-                          ConnectionInfoLength );
         }
 
         /* Make sure we had a connected port */
@@ -486,24 +599,50 @@
                          PortMessageLength);
 
                 /* Check if maximum length was requested */
-                if (MaxMessageLength) *MaxMessageLength = PortMessageLength;
+                if (MaxMessageLength)
+                {
+                    _SEH2_TRY
+                    {
+                        *MaxMessageLength = PortMessageLength;
+                    }
+                    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+                    {
+                        Status = _SEH2_GetExceptionCode();
+                    }
+                    _SEH2_END;
+                }
 
                 /* Check if we had a client view */
                 if (ClientView)
                 {
-                    /* Copy it back */
-                    RtlCopyMemory(ClientView,
-                                  &ConnectMessage->ClientView,
-                                  sizeof(PORT_VIEW));
+                    _SEH2_TRY
+                    {
+                        /* Copy it back */
+                        RtlCopyMemory(ClientView,
+                                      &ConnectMessage->ClientView,
+                                      sizeof(PORT_VIEW));
+                    }
+                    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+                    {
+                    }
+                    _SEH2_END;
                 }
 
                 /* Check if we had a server view */
                 if (ServerView)
                 {
-                    /* Copy it back */
-                    RtlCopyMemory(ServerView,
-                                  &ConnectMessage->ServerView,
-                                  sizeof(REMOTE_PORT_VIEW));
+                    _SEH2_TRY
+                    {
+                        /* Copy it back */
+                        RtlCopyMemory(ServerView,
+                                      &ConnectMessage->ServerView,
+                                      sizeof(REMOTE_PORT_VIEW));
+                    }
+                    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+                    {
+                        Status = _SEH2_GetExceptionCode();
+                    }
+                    _SEH2_END;
                 }
             }
         }
