Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-06-16 02:48:28 +00:00
Code Issues Projects Releases Packages Wiki Activity

- Patch by Jeffrey Morlan: Fix bounds checking and change NtGdiDoPalette to use a temporary kmode buffer. See Bug 3383.

Browse source 
svn path=/trunk/; revision=34934
This commit is contained in:
James Tabor 2008-07-29 18:11:18 +00:00
parent 4c985ce93a
commit a9cd7fec76
1 changed files with 70 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

81
reactos/subsystems/win32/win32k/objects/color.c
View file

@ -436,18 +436,16 @@ IntGetSystemPaletteEntries(HDC hDC,
{ {
if (pe != NULL) if (pe != NULL)
{ {
UINT CopyEntries; if (StartIndex >= palGDI->NumColors)
Entries = 0;
if (StartIndex + Entries < palGDI->NumColors) else if (Entries > palGDI->NumColors - StartIndex)
CopyEntries = StartIndex + Entries; Entries = palGDI->NumColors - StartIndex;
else
CopyEntries = palGDI->NumColors - StartIndex;
memcpy(pe, memcpy(pe,
palGDI->IndexedColors + StartIndex, palGDI->IndexedColors + StartIndex,
CopyEntries * sizeof(pe[0])); Entries * sizeof(pe[0]));
Ret = CopyEntries; Ret = Entries;
} }
else else
{ {
@ -837,6 +835,7 @@ NtGdiDoPalette(
IN BOOL bInbound) IN BOOL bInbound)
{ {
LONG ret; LONG ret;
LPVOID pEntries = NULL;
/* FIXME: Handle bInbound correctly */ /* FIXME: Handle bInbound correctly */
@ -846,58 +845,76 @@ NtGdiDoPalette(
return 0; return 0;
} }
if (pUnsafeEntries)
{
pEntries = ExAllocatePool(PagedPool, cEntries * sizeof(PALETTEENTRY));
if (!pEntries)
return 0;
if (bInbound)
{
_SEH_TRY _SEH_TRY
{ {
ProbeForRead(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
memcpy(pEntries, pUnsafeEntries, cEntries * sizeof(PALETTEENTRY));
}
_SEH_HANDLE
{
ExFreePool(pEntries);
_SEH_YIELD(return 0);
}
_SEH_END
}
}
ret = 0;
switch(iFunc) switch(iFunc)
{ {
case GdiPalAnimate: case GdiPalAnimate:
ProbeForRead(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1); if (pEntries)
ret = IntAnimatePalette((HPALETTE)hObj, iStart, cEntries, pUnsafeEntries); ret = IntAnimatePalette((HPALETTE)hObj, iStart, cEntries, pEntries);
break; break;
case GdiPalSetEntries: case GdiPalSetEntries:
ProbeForRead(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1); if (pEntries)
ret = IntSetPaletteEntries((HPALETTE)hObj, iStart, cEntries, pUnsafeEntries); ret = IntSetPaletteEntries((HPALETTE)hObj, iStart, cEntries, pEntries);
break; break;
case GdiPalGetEntries: case GdiPalGetEntries:
if (pUnsafeEntries) ret = IntGetPaletteEntries((HPALETTE)hObj, iStart, cEntries, pEntries);
{
ProbeForWrite(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
}
ret = IntGetPaletteEntries((HPALETTE)hObj, iStart, cEntries, pUnsafeEntries);
break; break;
case GdiPalGetSystemEntries: case GdiPalGetSystemEntries:
if (pUnsafeEntries) ret = IntGetSystemPaletteEntries((HDC)hObj, iStart, cEntries, pEntries);
{
ProbeForWrite(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
}
ret = IntGetSystemPaletteEntries((HDC)hObj, iStart, cEntries, pUnsafeEntries);
break; break;
case GdiPalSetColorTable: case GdiPalSetColorTable:
ProbeForRead(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1); if (pEntries)
ret = IntSetDIBColorTable((HDC)hObj, iStart, cEntries, (RGBQUAD*)pUnsafeEntries); ret = IntSetDIBColorTable((HDC)hObj, iStart, cEntries, (RGBQUAD*)pEntries);
break; break;
case GdiPalGetColorTable: case GdiPalGetColorTable:
if (pUnsafeEntries) if (pEntries)
ret = IntGetDIBColorTable((HDC)hObj, iStart, cEntries, (RGBQUAD*)pEntries);
break;
}
if (pEntries)
{
if (!bInbound)
{
_SEH_TRY
{ {
ProbeForWrite(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1); ProbeForWrite(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
} memcpy(pUnsafeEntries, pEntries, cEntries * sizeof(PALETTEENTRY));
ret = IntGetDIBColorTable((HDC)hObj, iStart, cEntries, (RGBQUAD*)pUnsafeEntries);
break;
default:
ret = 0;
}
} }
_SEH_HANDLE _SEH_HANDLE
{ {
ret = 0; ret = 0;
} }
_SEH_END _SEH_END
}
ExFreePool(pEntries);
}
return ret; return ret;
} }