Index: win32ss/gdi/ntgdi/bitmaps.c
===================================================================
--- win32ss/gdi/ntgdi/bitmaps.c	(revision 73512)
+++ win32ss/gdi/ntgdi/bitmaps.c	(working copy)
@@ -435,6 +435,7 @@
     HBITMAP hBitmap,
     LPSIZE psizDim)
 {
+    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
     PSURFACE psurfBmp;
     BOOL bResult = TRUE;
 
@@ -441,6 +442,19 @@
     if (hBitmap == NULL)
         return FALSE;
 
+    if (PreviousMode != KernelMode)
+    {
+        _SEH2_TRY
+        {
+            ProbeForWrite(psizDim, sizeof(*psizDim), 1);
+        }
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+        {
+            _SEH2_YIELD(return FALSE);
+        }
+        _SEH2_END
+    }
+
     /* Lock the bitmap */
     psurfBmp = SURFACE_ShareLockSurface(hBitmap);
     if (psurfBmp == NULL)
@@ -452,7 +466,6 @@
     /* Use SEH to copy the data to the caller */
     _SEH2_TRY
     {
-        ProbeForWrite(psizDim, sizeof(SIZE), 1);
         *psizDim = psurfBmp->sizlDim;
     }
     _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)