From e7f345e0a2be13c5a501365f45f776ee2e13c51f Mon Sep 17 00:00:00 2001
From: Filip Navara <filip.navara@gmail.com>
Date: Tue, 7 Jun 2005 16:26:14 +0000
Subject: [PATCH] Fix buffer size checks for IOCTL_VIDEO_SET_COLOR_REGISTERS.

svn path=/trunk/; revision=15829
---
 reactos/drivers/video/miniport/vbe/vbemp.c | 2 +-
 reactos/drivers/video/miniport/vga/vgamp.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/reactos/drivers/video/miniport/vbe/vbemp.c b/reactos/drivers/video/miniport/vbe/vbemp.c
index f0f50a2933f..2b678fdec62 100644
--- a/reactos/drivers/video/miniport/vbe/vbemp.c
+++ b/reactos/drivers/video/miniport/vbe/vbemp.c
@@ -480,7 +480,7 @@ VBEStartIO(
          if (RequestPacket->InputBufferLength < sizeof(VIDEO_CLUT) ||
              RequestPacket->InputBufferLength <
              (((PVIDEO_CLUT)RequestPacket->InputBuffer)->NumEntries * sizeof(ULONG)) +
-             sizeof(VIDEO_CLUT))
+             FIELD_OFFSET(VIDEO_CLUT, LookupTable))
          {
             RequestPacket->StatusBlock->Status = ERROR_INSUFFICIENT_BUFFER;
             return TRUE;
diff --git a/reactos/drivers/video/miniport/vga/vgamp.c b/reactos/drivers/video/miniport/vga/vgamp.c
index 22178703b25..fcc26424096 100644
--- a/reactos/drivers/video/miniport/vga/vgamp.c
+++ b/reactos/drivers/video/miniport/vga/vgamp.c
@@ -223,7 +223,7 @@ VGAStartIO(PVOID DeviceExtension,
       if (RequestPacket->InputBufferLength < sizeof(VIDEO_CLUT) ||
           RequestPacket->InputBufferLength <
           (((PVIDEO_CLUT)RequestPacket->InputBuffer)->NumEntries * sizeof(ULONG)) +
-          sizeof(VIDEO_CLUT))
+          FIELD_OFFSET(VIDEO_CLUT, LookupTable))
       {
         RequestPacket->StatusBlock->Status = ERROR_INSUFFICIENT_BUFFER;
         return TRUE;