From 9f0e740e7a6f51ab90aaf05c6b33e7c4e05fee4e Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Sun, 21 Dec 2008 02:27:44 +0000
Subject: [PATCH] revert 38201 and 38203 due to regressions

svn path=/trunk/; revision=38215
---
 .../win32/win32k/objects/freetype.c           | 86 ++++++-------------
 1 file changed, 26 insertions(+), 60 deletions(-)

diff --git a/reactos/subsystems/win32/win32k/objects/freetype.c b/reactos/subsystems/win32/win32k/objects/freetype.c
index d10d3ebf05c..af696751373 100644
--- a/reactos/subsystems/win32/win32k/objects/freetype.c
+++ b/reactos/subsystems/win32/win32k/objects/freetype.c
@@ -3135,8 +3135,6 @@ NtGdiExtTextOutW(
     BOOL DoBreak = FALSE;
     LPCWSTR String, SafeString = NULL;
     HPALETTE hDestPalette;
-    PVOID TmpBuffer = NULL;
-    ULONG TmpBufSize, StringSize, DxSize = 0;
 
     // TODO: Write test-cases to exactly match real Windows in different
     // bad parameters (e.g. does Windows check the DC or the RECT first?).
@@ -3162,74 +3160,45 @@ NtGdiExtTextOutW(
         SetLastWin32Error(ERROR_INVALID_PARAMETER);
         goto fail;
     }
-
-    Status = STATUS_SUCCESS;
     if (Count > 0)
     {
-        TmpBufSize = StringSize = Count * sizeof(WCHAR);
-        if (UnsafeDx)
+        SafeString = ExAllocatePoolWithTag(PagedPool, Count * sizeof(WCHAR), TAG_GDITEXT);
+        if (!SafeString)
         {
-            /* If ETO_PDY is specified, we have pairs of INTs */
-            DxSize = Count * sizeof(INT) * (fuOptions & ETO_PDY ? 2 : 1);
-            TmpBufSize += DxSize;
-        }
-
-        /* Allocate a temp buffer for the string and the Dx values */
-        TmpBuffer = ExAllocatePoolWithTag(PagedPool, TmpBufSize, TAG_GDITEXT);
-        SafeString = TmpBuffer;
-        if (!TmpBuffer)
-        {
-            SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);
             goto fail;
         }
-
-        /* Probe and copy user mode data to the temp buffer */
-        _SEH2_TRY
-        {
-            if (UnsafeString)
-            {
-                ProbeForRead(UnsafeString, StringSize, 1);
-                memcpy((PVOID)SafeString, UnsafeString, StringSize);
-            }
-
-            if (UnsafeDx)
-            {
-                ProbeForRead(UnsafeDx, DxSize, 1);
-                Dx = (INT*)((ULONG_PTR)TmpBuffer + StringSize);
-                memcpy(Dx, UnsafeString, DxSize);
-            }
-
-        }
-        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
-        {
-            Status = _SEH2_GetExceptionCode();
-        }
-        _SEH2_END
-        if (!NT_SUCCESS(Status))
+        Status = MmCopyFromCaller(SafeString, UnsafeString, Count * sizeof(WCHAR));
+        if (! NT_SUCCESS(Status))
         {
             goto fail;
         }
     }
     String = SafeString;
 
-    if (lprc)
+    if (NULL != UnsafeDx && Count > 0)
     {
-        _SEH2_TRY
+        Dx = ExAllocatePoolWithTag(PagedPool, Count * sizeof(INT), TAG_GDITEXT);
+        if (NULL == Dx)
         {
-            ProbeForRead(lprc, sizeof(RECT), 1);
-            memcpy(&SpecifiedDestRect, lprc, sizeof(RECT));
+            goto fail;
         }
-        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
-        {
-            Status = _SEH2_GetExceptionCode();
-        }
-        _SEH2_END
+        Status = MmCopyFromCaller(Dx, UnsafeDx, Count * sizeof(INT));
         if (!NT_SUCCESS(Status))
         {
             goto fail;
         }
     }
 
+    if (lprc)
+    {
+        Status = MmCopyFromCaller(&SpecifiedDestRect, lprc, sizeof(RECT));
+        if (!NT_SUCCESS(Status))
+        {
+            SetLastWin32Error(ERROR_INVALID_PARAMETER);
+            goto fail;
+        }
+    }
+
     if (PATH_IsPathOpen(dc->DcLevel))
     {
         if (!PATH_ExtTextOut( dc,
@@ -3669,14 +3638,7 @@ NtGdiExtTextOutW(
         }
         else
         {
-            if (fuOptions & ETO_PDY)
-            {
-                TextLeft += Dx[i*2] << 6;
-            }
-            else
-            {
-                TextLeft += Dx[i] << 6;
-            }
+            TextLeft += Dx[i] << 6;
 //         DbgPrint("new TextLeft2: %d\n", TextLeft);
         }
         previous = glyph_index;
@@ -3730,9 +3692,13 @@ fail:
         BRUSHOBJ_UnlockBrush(BrushFg);
         NtGdiDeleteObject(hBrushFg);
     }
-    if (TmpBuffer)
+    if (NULL != SafeString)
     {
-        ExFreePoolWithTag(TmpBuffer, TAG_GDITEXT);
+        ExFreePoolWithTag((void*)SafeString, TAG_GDITEXT);
+    }
+    if (NULL != Dx)
+    {
+        ExFreePoolWithTag(Dx, TAG_GDITEXT);
     }
     DC_UnlockDc(dc);