Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-08-03 21:36:11 +00:00
Code Issues Projects Releases Packages Wiki Activity

[WIN32K]

Browse source 
Pass cjMaxBits parameter from GreCreateDIBitmapInternal to IntCreateDIBitmap and check the image size before creating the bitmap.
Should fix crash when hitting about tab in Office2000 WinWord.
CORE-10583 #comment please retest

svn path=/trunk/; revision=70412
This commit is contained in:
Timo Kreuzer 2015-12-23 14:55:34 +00:00
parent 251805da99
commit 88d5b185b0
1 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
reactos/win32ss/gdi/ntgdi/dibobj.c
View file

@ -248,6 +248,7 @@ IntSetDIBits(
UINT StartScan, UINT StartScan,
UINT ScanLines, UINT ScanLines,
CONST VOID *Bits, CONST VOID *Bits,
ULONG cjMaxBits,
CONST BITMAPINFO *bmi, CONST BITMAPINFO *bmi,
UINT ColorUse) UINT ColorUse)
{ {
@ -261,6 +262,11 @@ IntSetDIBits(
if (!bmi) return 0; if (!bmi) return 0;
if (bmi->bmiHeader.biSizeImage > cjMaxBits)
{
return 0;
}
SourceBitmap = GreCreateBitmapEx(bmi->bmiHeader.biWidth, SourceBitmap = GreCreateBitmapEx(bmi->bmiHeader.biWidth,
ScanLines, ScanLines,
0, 0,
@ -1316,6 +1322,7 @@ IntCreateDIBitmap(
ULONG compression, ULONG compression,
DWORD init, DWORD init,
LPBYTE bits, LPBYTE bits,
ULONG cjMaxBits,
PBITMAPINFO data, PBITMAPINFO data,
DWORD coloruse) DWORD coloruse)
{ {
@ -1390,7 +1397,7 @@ IntCreateDIBitmap(
if ((NULL != handle) && (CBM_INIT & init)) if ((NULL != handle) && (CBM_INIT & init))
{ {
IntSetDIBits(Dc, handle, 0, height, bits, data, coloruse); IntSetDIBits(Dc, handle, 0, height, bits, cjMaxBits, data, coloruse);
} }
return handle; return handle;
@ -1529,7 +1536,7 @@ GreCreateDIBitmapInternal(
planes = 0; planes = 0;
compression = 0; compression = 0;
} }
Bmp = IntCreateDIBitmap(Dc, cx, cy, planes, bpp, compression, fInit, pjInit, pbmi, iUsage); Bmp = IntCreateDIBitmap(Dc, cx, cy, planes, bpp, compression, fInit, pjInit, cjMaxBits, pbmi, iUsage);
DC_UnlockDc(Dc); DC_UnlockDc(Dc);
if(!hDc) if(!hDc)