Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-07-30 16:18:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

[WIN32K]

Browse source 
- Do not acccess unsafe bits outside of PSEH

svn path=/branches/reactos-yarotows/; revision=48685
This commit is contained in:
Jérôme Gardou 2010-09-01 22:36:00 +00:00
parent a87737f098
commit 1a45c42898
1 changed files with 31 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
subsystems/win32/win32k/objects/dibobj.c
View file

@ -1219,11 +1219,27 @@ NtGdiCreateDIBitmapInternal(
IN HANDLE hcmXform)
{
NTSTATUS Status = STATUS_SUCCESS;
PBYTE safeBits = NULL;
HBITMAP hbmResult = NULL;
if(pjInit && (fInit == CBM_INIT))
{
safeBits = ExAllocatePoolWithTag(PagedPool, cjMaxBits, TAG_DIB);
if(!safeBits)
{
SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);
return NULL;
}
}
_SEH2_TRY
{
if(pbmi) ProbeForRead(pbmi, cjMaxInitInfo, 1);
if(pjInit && (fInit == CBM_INIT)) ProbeForRead(pjInit, cjMaxBits, 1);
if(pjInit && (fInit == CBM_INIT))
{
ProbeForRead(pjInit, cjMaxBits, 1);
RtlCopyMemory(safeBits, pjInit, cjMaxBits);
}
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
@ -1234,18 +1250,22 @@ NtGdiCreateDIBitmapInternal(
if(!NT_SUCCESS(Status))
{
SetLastNtError(Status);
return NULL;
goto cleanup;
}
return GreCreateDIBitmapInternal(hDc,
cx,
cy,
fInit,
pjInit,
pbmi,
iUsage,
fl,
hcmXform);
hbmResult = GreCreateDIBitmapInternal(hDc,
cx,
cy,
fInit,
safeBits,
pbmi,
iUsage,
fl,
hcmXform);
cleanup:
ExFreePoolWithTag(safeBits, TAG_DIB);
return hbmResult;
}
HBITMAP