Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-05-25 20:18:22 +00:00
Code Issues Projects Releases Packages Wiki Activity

[WIN32K]

Browse source 
- Pass size in bytes to UnsafeSetBitmapBits from NtGdiCreateBitmap
- In NtGdiSetBitmapBits check for stock bitmap and non-API bitmap.

svn path=/trunk/; revision=66616
This commit is contained in:
Timo Kreuzer 2015-03-08 23:36:36 +00:00
parent d52f661e5f
commit ebd0c06809
1 changed files with 22 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
reactos/win32ss/gdi/ntgdi/bitmaps.c
View file

@ -53,6 +53,8 @@ UnsafeSetBitmapBits(
PUCHAR pjDst, pjSrc; PUCHAR pjDst, pjSrc;
LONG lDeltaDst, lDeltaSrc; LONG lDeltaDst, lDeltaSrc;
ULONG nWidth, nHeight, cBitsPixel; ULONG nWidth, nHeight, cBitsPixel;
NT_ASSERT(psurf->flags & API_BITMAP);
NT_ASSERT(psurf->SurfObj.iBitmapFormat <= BMF_32BPP);
nWidth = psurf->SurfObj.sizlBitmap.cx; nWidth = psurf->SurfObj.sizlBitmap.cx;
nHeight = psurf->SurfObj.sizlBitmap.cy; nHeight = psurf->SurfObj.sizlBitmap.cy;
@ -63,8 +65,10 @@ UnsafeSetBitmapBits(
pjSrc = pvBits; pjSrc = pvBits;
lDeltaDst = psurf->SurfObj.lDelta; lDeltaDst = psurf->SurfObj.lDelta;
lDeltaSrc = WIDTH_BYTES_ALIGN16(nWidth, cBitsPixel); lDeltaSrc = WIDTH_BYTES_ALIGN16(nWidth, cBitsPixel);
NT_ASSERT(lDeltaSrc <= abs(lDeltaDst));
if (cjBits && (cjBits < (lDeltaSrc * nHeight))) /* Make sure the buffer is large enough*/
if (cjBits < (lDeltaSrc * nHeight))
return 0; return 0;
while (nHeight--) while (nHeight--)
@ -227,7 +231,7 @@ NtGdiCreateBitmap(
_SEH2_TRY _SEH2_TRY
{ {
ProbeForRead(pUnsafeBits, (SIZE_T)cjSize, 1); ProbeForRead(pUnsafeBits, (SIZE_T)cjSize, 1);
UnsafeSetBitmapBits(psurf, 0, pUnsafeBits); UnsafeSetBitmapBits(psurf, cjSize, pUnsafeBits);
} }
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{ {
@ -568,6 +572,11 @@ NtGdiSetBitmapBits(
return 0; return 0;
} }
if (GDI_HANDLE_IS_STOCKOBJ(hBitmap))
{
return 0;
}
psurf = SURFACE_ShareLockSurface(hBitmap); psurf = SURFACE_ShareLockSurface(hBitmap);
if (psurf == NULL) if (psurf == NULL)
{ {
@ -575,6 +584,17 @@ NtGdiSetBitmapBits(
return 0; return 0;
} }
if (((psurf->flags & API_BITMAP) == 0) ||
(psurf->SurfObj.iBitmapFormat > BMF_32BPP))
{
DPRINT1("Invalid bitmap: iBitmapFormat = %lu, flags = 0x%lx\n",
psurf->SurfObj.iBitmapFormat,
psurf->flags);
EngSetLastError(ERROR_INVALID_HANDLE);
SURFACE_ShareUnlockSurface(psurf);
return 0;
}
_SEH2_TRY _SEH2_TRY
{ {
ProbeForRead(pUnsafeBits, Bytes, sizeof(WORD)); ProbeForRead(pUnsafeBits, Bytes, sizeof(WORD));