[ADVAPI32] Do not call the classic service handler function with an event control code

Author: EricKohl

dll/win32/advapi32/service/sctrl.c

@@ -551,6 +551,7 @@ ScControlService(PACTIVE_SERVICE lpService,
                  PSCM_CONTROL_PACKET ControlPacket)
 {
     DWORD dwError = ERROR_SUCCESS;
+    DWORD dwControl;
     DWORD dwEventType = 0;
     PVOID pEventData = NULL;
 
@@ -566,29 +567,39 @@ ScControlService(PACTIVE_SERVICE lpService,
     /* Set service tag */
     NtCurrentTeb()->SubProcessTag = UlongToPtr(lpService->dwServiceTag);
 
+    dwControl = ControlPacket->dwControl;
+
     if (lpService->HandlerFunction)
     {
-        _SEH2_TRY
+        if (((dwControl >= SERVICE_CONTROL_STOP) && (dwControl <= SERVICE_CONTROL_NETBINDDISABLE)) ||
+            ((dwControl >= 128) && (dwControl <= 255)))
         {
-            (lpService->HandlerFunction)(ControlPacket->dwControl);
+            _SEH2_TRY
+            {
+                (lpService->HandlerFunction)(dwControl);
+            }
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+            {
+                dwError = ERROR_EXCEPTION_IN_SERVICE;
+            }
+            _SEH2_END;
         }
-        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+        else
         {
-            dwError = ERROR_EXCEPTION_IN_SERVICE;
+            dwError = ERROR_INVALID_SERVICE_CONTROL;
         }
-        _SEH2_END;
     }
     else if (lpService->HandlerFunctionEx)
     {
-        if (ControlPacket->dwControl == SERVICE_CONTROL_DEVICEEVENT)
+        if (dwControl == SERVICE_CONTROL_DEVICEEVENT)
         {
             dwEventType = *(LPDWORD)((ULONG_PTR)ControlPacket + sizeof(SCM_CONTROL_PACKET));
             pEventData = (PVOID)((ULONG_PTR)ControlPacket + sizeof(SCM_CONTROL_PACKET) + sizeof(DWORD));
         }
 
         _SEH2_TRY
         {
-            (lpService->HandlerFunctionEx)(ControlPacket->dwControl,
+            (lpService->HandlerFunctionEx)(dwControl,
                                            dwEventType,
                                            pEventData,
                                            lpService->HandlerContext);