From c1dd858adcc42b3109c421b12c673758557421d0 Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Wed, 25 Apr 2012 19:25:48 +0000
Subject: [PATCH] [WIN32K] Make sure a bitmap is compatible with the dc before
 selecting it.

svn path=/trunk/; revision=56425
---
 reactos/win32ss/gdi/ntgdi/dcobjs.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/reactos/win32ss/gdi/ntgdi/dcobjs.c b/reactos/win32ss/gdi/ntgdi/dcobjs.c
index 6b9c2653e62..52611258760 100644
--- a/reactos/win32ss/gdi/ntgdi/dcobjs.c
+++ b/reactos/win32ss/gdi/ntgdi/dcobjs.c
@@ -265,6 +265,7 @@ NtGdiSelectBitmap(
     PSURFACE psurfNew, psurfOld;
     HRGN hVisRgn;
     HDC hdcOld;
+    ULONG cBitsPixel;
     ASSERT_NOGDILOCKS();
 
     /* Verify parameters */
@@ -329,6 +330,18 @@ NtGdiSelectBitmap(
             return NULL;
         }
 
+        /* Check if the bitmap is compatile with the dc */
+        cBitsPixel = gajBitsPerFormat[psurfNew->SurfObj.iBitmapFormat];
+        if ((cBitsPixel != 1) &&
+            (cBitsPixel != pdc->ppdev->gdiinfo.cBitsPixel) &&
+            (psurfNew->hSecure == NULL))
+        {
+            /* Dereference the bitmap, unlock the DC and fail. */
+            SURFACE_ShareUnlockSurface(psurfNew);
+            DC_UnlockDc(pdc);
+            return NULL;
+        }
+
         /* Set the bitmap's hdc and check if it was set before */
         hdcOld = InterlockedCompareExchangePointer((PVOID*)&psurfNew->hdc, hdc, 0);
         if (hdcOld != NULL)
@@ -346,7 +359,7 @@ NtGdiSelectBitmap(
         pdc->dclevel.sizl = psurfNew->SurfObj.sizlBitmap;
 
         /* Check if the bitmap is a dibsection */
-        if(psurfNew->hSecure)
+        if (psurfNew->hSecure)
         {
             /* Set DIBSECTION attribute */
             pdc->pdcattr->ulDirty_ |= DC_DIBSECTION;