mirror of
https://github.com/reactos/reactos.git
synced 2025-06-09 11:20:39 +00:00
- Patch by Jeffrey Morlan: Fix bounds checking and change NtGdiDoPalette to use a temporary kmode buffer. See Bug 3383.
svn path=/trunk/; revision=34934
This commit is contained in:
parent
4c985ce93a
commit
a9cd7fec76
1 changed files with 70 additions and 53 deletions
|
@ -436,18 +436,16 @@ IntGetSystemPaletteEntries(HDC hDC,
|
||||||
{
|
{
|
||||||
if (pe != NULL)
|
if (pe != NULL)
|
||||||
{
|
{
|
||||||
UINT CopyEntries;
|
if (StartIndex >= palGDI->NumColors)
|
||||||
|
Entries = 0;
|
||||||
if (StartIndex + Entries < palGDI->NumColors)
|
else if (Entries > palGDI->NumColors - StartIndex)
|
||||||
CopyEntries = StartIndex + Entries;
|
Entries = palGDI->NumColors - StartIndex;
|
||||||
else
|
|
||||||
CopyEntries = palGDI->NumColors - StartIndex;
|
|
||||||
|
|
||||||
memcpy(pe,
|
memcpy(pe,
|
||||||
palGDI->IndexedColors + StartIndex,
|
palGDI->IndexedColors + StartIndex,
|
||||||
CopyEntries * sizeof(pe[0]));
|
Entries * sizeof(pe[0]));
|
||||||
|
|
||||||
Ret = CopyEntries;
|
Ret = Entries;
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
|
@ -837,6 +835,7 @@ NtGdiDoPalette(
|
||||||
IN BOOL bInbound)
|
IN BOOL bInbound)
|
||||||
{
|
{
|
||||||
LONG ret;
|
LONG ret;
|
||||||
|
LPVOID pEntries = NULL;
|
||||||
|
|
||||||
/* FIXME: Handle bInbound correctly */
|
/* FIXME: Handle bInbound correctly */
|
||||||
|
|
||||||
|
@ -846,58 +845,76 @@ NtGdiDoPalette(
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (pUnsafeEntries)
|
||||||
|
{
|
||||||
|
pEntries = ExAllocatePool(PagedPool, cEntries * sizeof(PALETTEENTRY));
|
||||||
|
if (!pEntries)
|
||||||
|
return 0;
|
||||||
|
if (bInbound)
|
||||||
|
{
|
||||||
_SEH_TRY
|
_SEH_TRY
|
||||||
{
|
{
|
||||||
|
ProbeForRead(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
|
||||||
|
memcpy(pEntries, pUnsafeEntries, cEntries * sizeof(PALETTEENTRY));
|
||||||
|
}
|
||||||
|
_SEH_HANDLE
|
||||||
|
{
|
||||||
|
ExFreePool(pEntries);
|
||||||
|
_SEH_YIELD(return 0);
|
||||||
|
}
|
||||||
|
_SEH_END
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = 0;
|
||||||
switch(iFunc)
|
switch(iFunc)
|
||||||
{
|
{
|
||||||
case GdiPalAnimate:
|
case GdiPalAnimate:
|
||||||
ProbeForRead(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
|
if (pEntries)
|
||||||
ret = IntAnimatePalette((HPALETTE)hObj, iStart, cEntries, pUnsafeEntries);
|
ret = IntAnimatePalette((HPALETTE)hObj, iStart, cEntries, pEntries);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case GdiPalSetEntries:
|
case GdiPalSetEntries:
|
||||||
ProbeForRead(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
|
if (pEntries)
|
||||||
ret = IntSetPaletteEntries((HPALETTE)hObj, iStart, cEntries, pUnsafeEntries);
|
ret = IntSetPaletteEntries((HPALETTE)hObj, iStart, cEntries, pEntries);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case GdiPalGetEntries:
|
case GdiPalGetEntries:
|
||||||
if (pUnsafeEntries)
|
ret = IntGetPaletteEntries((HPALETTE)hObj, iStart, cEntries, pEntries);
|
||||||
{
|
|
||||||
ProbeForWrite(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
|
|
||||||
}
|
|
||||||
ret = IntGetPaletteEntries((HPALETTE)hObj, iStart, cEntries, pUnsafeEntries);
|
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case GdiPalGetSystemEntries:
|
case GdiPalGetSystemEntries:
|
||||||
if (pUnsafeEntries)
|
ret = IntGetSystemPaletteEntries((HDC)hObj, iStart, cEntries, pEntries);
|
||||||
{
|
|
||||||
ProbeForWrite(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
|
|
||||||
}
|
|
||||||
ret = IntGetSystemPaletteEntries((HDC)hObj, iStart, cEntries, pUnsafeEntries);
|
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case GdiPalSetColorTable:
|
case GdiPalSetColorTable:
|
||||||
ProbeForRead(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
|
if (pEntries)
|
||||||
ret = IntSetDIBColorTable((HDC)hObj, iStart, cEntries, (RGBQUAD*)pUnsafeEntries);
|
ret = IntSetDIBColorTable((HDC)hObj, iStart, cEntries, (RGBQUAD*)pEntries);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case GdiPalGetColorTable:
|
case GdiPalGetColorTable:
|
||||||
if (pUnsafeEntries)
|
if (pEntries)
|
||||||
|
ret = IntGetDIBColorTable((HDC)hObj, iStart, cEntries, (RGBQUAD*)pEntries);
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (pEntries)
|
||||||
|
{
|
||||||
|
if (!bInbound)
|
||||||
|
{
|
||||||
|
_SEH_TRY
|
||||||
{
|
{
|
||||||
ProbeForWrite(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
|
ProbeForWrite(pUnsafeEntries, cEntries * sizeof(PALETTEENTRY), 1);
|
||||||
}
|
memcpy(pUnsafeEntries, pEntries, cEntries * sizeof(PALETTEENTRY));
|
||||||
ret = IntGetDIBColorTable((HDC)hObj, iStart, cEntries, (RGBQUAD*)pUnsafeEntries);
|
|
||||||
break;
|
|
||||||
|
|
||||||
default:
|
|
||||||
ret = 0;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
_SEH_HANDLE
|
_SEH_HANDLE
|
||||||
{
|
{
|
||||||
ret = 0;
|
ret = 0;
|
||||||
}
|
}
|
||||||
_SEH_END
|
_SEH_END
|
||||||
|
}
|
||||||
|
ExFreePool(pEntries);
|
||||||
|
}
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue