From e04ce16d15fbc6d9cd77143dfec6db92b3086f93 Mon Sep 17 00:00:00 2001
From: David Welch <welch@cwcom.net>
Date: Tue, 9 Mar 2004 21:21:39 +0000
Subject: [PATCH] - Fixed check for an out of range index in
 {Get/Set}{Class/Window}Long (signed vs. unsigned arithmetic). Fixes crash in
 'user32_test win'.

svn path=/trunk/; revision=8614
---
 reactos/subsys/win32k/ntuser/class.c  | 6 +++---
 reactos/subsys/win32k/ntuser/window.c | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/reactos/subsys/win32k/ntuser/class.c b/reactos/subsys/win32k/ntuser/class.c
index e64f891d0ae..4420c6ded7a 100644
--- a/reactos/subsys/win32k/ntuser/class.c
+++ b/reactos/subsys/win32k/ntuser/class.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: class.c,v 1.48 2004/02/24 13:27:03 weiden Exp $
+/* $Id: class.c,v 1.49 2004/03/09 21:21:39 dwelch Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -433,7 +433,7 @@ IntGetClassLong(struct _WINDOW_OBJECT *WindowObject, ULONG Offset, BOOL Ansi)
   if ((int)Offset >= 0)
     {
       DPRINT("GetClassLong(%x, %d)\n", WindowObject->Self, Offset);
-      if (Offset > WindowObject->Class->cbClsExtra - sizeof(LONG))
+      if ((Offset + sizeof(LONG)) > WindowObject->Class->cbClsExtra)
 	{
 	  SetLastWin32Error(ERROR_INVALID_PARAMETER);
 	  return 0;
@@ -514,7 +514,7 @@ IntSetClassLong(PWINDOW_OBJECT WindowObject, ULONG Offset, LONG dwNewLong, BOOL
   if ((int)Offset >= 0)
     {
       DPRINT("SetClassLong(%x, %d, %x)\n", WindowObject->Self, Offset, dwNewLong);
-      if (Offset > WindowObject->Class->cbClsExtra - sizeof(LONG))
+      if ((Offset + sizeof(LONG)) > WindowObject->Class->cbClsExtra)
 	{
 	  SetLastWin32Error(ERROR_INVALID_PARAMETER);
 	  return;
diff --git a/reactos/subsys/win32k/ntuser/window.c b/reactos/subsys/win32k/ntuser/window.c
index af5f1e1cf07..931a7cc18b6 100644
--- a/reactos/subsys/win32k/ntuser/window.c
+++ b/reactos/subsys/win32k/ntuser/window.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: window.c,v 1.197 2004/02/27 22:21:32 weiden Exp $
+/* $Id: window.c,v 1.198 2004/03/09 21:21:39 dwelch Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -2674,7 +2674,7 @@ NtUserGetWindowLong(HWND hWnd, DWORD Index, BOOL Ansi)
 
    if ((INT)Index >= 0)
    {
-      if (Index > WindowObject->ExtraDataSize - sizeof(LONG))
+      if ((Index + sizeof(LONG)) > WindowObject->ExtraDataSize)
       {
          SetLastWin32Error(ERROR_INVALID_PARAMETER);
          return 0;
@@ -2774,7 +2774,7 @@ NtUserSetWindowLong(HWND hWnd, DWORD Index, LONG NewValue, BOOL Ansi)
 
    if ((INT)Index >= 0)
    {
-      if (Index > WindowObject->ExtraDataSize - sizeof(LONG))
+      if ((Index + sizeof(LONG)) > WindowObject->ExtraDataSize)
       {
          SetLastWin32Error(ERROR_INVALID_PARAMETER);
          IntReleaseWindowObject(WindowObject);