From 36d8294a792d02870516b9f06d49d346de7aa8ea Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Sat, 31 Oct 2015 19:37:36 +0000
Subject: [PATCH] [WIN32K] Restore saved DCs, when changing the DC owner.
 Otherwise there could be saved DCs with references to process owned
 resources, causing GDI object leaks. Fixes assertion when closing iWisoft
 Video Converter Also don't copy lSaveDepth and hdcSafe in DC_vCopyState,
 those must be handled manually. CORE-10435 #resolve

svn path=/trunk/; revision=69759
---
 reactos/win32ss/gdi/ntgdi/dclife.c  | 5 ++++-
 reactos/win32ss/gdi/ntgdi/dcstate.c | 7 ++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/reactos/win32ss/gdi/ntgdi/dclife.c b/reactos/win32ss/gdi/ntgdi/dclife.c
index f96e051dbf9..d18fec4510e 100644
--- a/reactos/win32ss/gdi/ntgdi/dclife.c
+++ b/reactos/win32ss/gdi/ntgdi/dclife.c
@@ -392,13 +392,16 @@ DC_vCleanup(PVOID ObjectBody)
     if(pdc->dclevel.pSurface)
         SURFACE_ShareUnlockSurface(pdc->dclevel.pSurface);
 
-    PDEVOBJ_vRelease(pdc->ppdev) ;
+    PDEVOBJ_vRelease(pdc->ppdev);
 }
 
 VOID
 NTAPI
 DC_vSetOwner(PDC pdc, ULONG ulOwner)
 {
+    /* Delete saved DCs */
+    DC_vRestoreDC(pdc, 1);
+
     if (pdc->dclevel.hPath)
     {
         GreSetObjectOwner(pdc->dclevel.hPath, ulOwner);
diff --git a/reactos/win32ss/gdi/ntgdi/dcstate.c b/reactos/win32ss/gdi/ntgdi/dcstate.c
index ba029519780..419753ede1b 100644
--- a/reactos/win32ss/gdi/ntgdi/dcstate.c
+++ b/reactos/win32ss/gdi/ntgdi/dcstate.c
@@ -28,8 +28,6 @@ DC_vCopyState(PDC pdcSrc, PDC pdcDst, BOOL To)
 
     /* Copy DC level */
     pdcDst->dclevel.pColorSpace     = pdcSrc->dclevel.pColorSpace;
-    pdcDst->dclevel.lSaveDepth      = pdcSrc->dclevel.lSaveDepth;
-    pdcDst->dclevel.hdcSave         = pdcSrc->dclevel.hdcSave;
     pdcDst->dclevel.laPath          = pdcSrc->dclevel.laPath;
     pdcDst->dclevel.ca              = pdcSrc->dclevel.ca;
     pdcDst->dclevel.mxWorldToDevice = pdcSrc->dclevel.mxWorldToDevice;
@@ -131,7 +129,7 @@ DC_vRestoreDC(
     HDC hdcSave;
     PDC pdcSave;
 
-    ASSERT(iSaveLevel > 0);
+    NT_ASSERT(iSaveLevel > 0);
     DPRINT("DC_vRestoreDC(%p, %ld)\n", pdc->BaseObject.hHmgr, iSaveLevel);
 
     /* Loop the save levels */
@@ -146,6 +144,7 @@ DC_vRestoreDC(
             /* Could not get ownership. That's bad! */
             DPRINT1("Could not get ownership of saved DC (%p) for hdc %p!\n",
                     hdcSave, pdc->BaseObject.hHmgr);
+            NT_ASSERT(FALSE);
             return;// FALSE;
         }
 
@@ -156,6 +155,7 @@ DC_vRestoreDC(
             /* WTF? Internal error! */
             DPRINT1("Could not lock the saved DC (%p) for dc %p!\n",
                     hdcSave, pdc->BaseObject.hHmgr);
+            NT_ASSERT(FALSE);
             return;// FALSE;
         }
 
@@ -300,6 +300,7 @@ NtGdiSaveDC(
     if (pdcSave->dclevel.hPath) pdcSave->dclevel.flPath |= DCPATH_SAVE;
 
     /* Set new dc as save dc */
+    pdcSave->dclevel.hdcSave = pdc->dclevel.hdcSave;
     pdc->dclevel.hdcSave = hdcSave;
 
     /* Increase save depth, return old value */