Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-01-01 03:54:02 +00:00
Code Issues Projects Releases Packages Wiki Activity

[WIN32K]

Browse source 
Pass cjMaxBits parameter from GreCreateDIBitmapInternal to IntCreateDIBitmap and check the image size before creating the bitmap.
Should fix crash when hitting about tab in Office2000 WinWord.
CORE-10583 #comment please retest

svn path=/trunk/; revision=70412
This commit is contained in:
Timo Kreuzer 2015-12-23 14:55:34 +00:00
parent 251805da99
commit 88d5b185b0
1 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
reactos/win32ss/gdi/ntgdi/dibobj.c
View file

@ -248,6 +248,7 @@ IntSetDIBits(
UINT StartScan,
UINT ScanLines,
CONST VOID *Bits,
ULONG cjMaxBits,
CONST BITMAPINFO *bmi,
UINT ColorUse)
{
@ -261,6 +262,11 @@ IntSetDIBits(
if (!bmi) return 0;
if (bmi->bmiHeader.biSizeImage > cjMaxBits)
{
return 0;
}
SourceBitmap = GreCreateBitmapEx(bmi->bmiHeader.biWidth,
ScanLines,
0,
@ -1316,6 +1322,7 @@ IntCreateDIBitmap(
ULONG compression,
DWORD init,
LPBYTE bits,
ULONG cjMaxBits,
PBITMAPINFO data,
DWORD coloruse)
{
@ -1390,7 +1397,7 @@ IntCreateDIBitmap(
if ((NULL != handle) && (CBM_INIT & init))
{
IntSetDIBits(Dc, handle, 0, height, bits, data, coloruse);
IntSetDIBits(Dc, handle, 0, height, bits, cjMaxBits, data, coloruse);
}
return handle;
@ -1529,7 +1536,7 @@ GreCreateDIBitmapInternal(
planes = 0;
compression = 0;
}
Bmp = IntCreateDIBitmap(Dc, cx, cy, planes, bpp, compression, fInit, pjInit, pbmi, iUsage);
Bmp = IntCreateDIBitmap(Dc, cx, cy, planes, bpp, compression, fInit, pjInit, cjMaxBits, pbmi, iUsage);
DC_UnlockDc(Dc);
if(!hDc)