From b73c53c40c9acb5605dd157a2edfe792df5ad4d4 Mon Sep 17 00:00:00 2001
From: Magnus Olsen <magnus@greatlord.com>
Date: Fri, 27 May 2005 14:22:06 +0000
Subject: [PATCH] fix memmory coruption in EnumDisplaySettingsExA do not alloc
 memmory with heap.

svn path=/trunk/; revision=15542
---
 reactos/lib/user32/misc/display.c | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

diff --git a/reactos/lib/user32/misc/display.c b/reactos/lib/user32/misc/display.c
index dc2e5101ed2..bca76e76544 100644
--- a/reactos/lib/user32/misc/display.c
+++ b/reactos/lib/user32/misc/display.c
@@ -200,15 +200,7 @@ EnumDisplaySettingsExA(
 {
   BOOL rc;
   UNICODE_STRING DeviceName;
-  LPDEVMODEW lpDevModeW;
-
-  lpDevModeW = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY,
-                         sizeof(DEVMODEW) + lpDevMode->dmDriverExtra);
-  if ( lpDevModeW == NULL )
-    {
-      SetLastError ( ERROR_OUTOFMEMORY );
-      return FALSE;
-    }
+  DEVMODEW lpDevModeW;
 
   if ( !RtlCreateUnicodeStringFromAsciiz ( &DeviceName, (PCSZ)lpszDeviceName ) )
     {
@@ -216,16 +208,16 @@ EnumDisplaySettingsExA(
       return FALSE;
     }
 
-  lpDevModeW->dmSize = sizeof(DEVMODEW);
-  lpDevModeW->dmDriverExtra = 0;
-
-  rc = NtUserEnumDisplaySettings ( &DeviceName, iModeNum, lpDevModeW,
+  memset(&lpDevModeW,0,sizeof(DEVMODEW));
+  lpDevModeW.dmSize = sizeof(DEVMODEW);
+ 
+  rc = NtUserEnumDisplaySettings ( &DeviceName, iModeNum, &lpDevModeW,
                                    dwFlags );
 
-  RosRtlDevModeW2A ( lpDevMode, lpDevModeW );
+  RosRtlDevModeW2A ( lpDevMode, &lpDevModeW );
 
   RtlFreeUnicodeString ( &DeviceName );
-  HeapFree ( GetProcessHeap(), 0, lpDevModeW );
+
 
   return rc;
 }