From f558f29e5c4fe27367bffc6798a70bba49c1fd03 Mon Sep 17 00:00:00 2001
From: James Tabor <james.tabor@reactos.org>
Date: Tue, 18 Nov 2008 16:07:54 +0000
Subject: [PATCH] - Make our version of SetDIBits safe as SetDIBitsToDevice.

svn path=/trunk/; revision=37439
---
 reactos/dll/win32/gdi32/objects/bitmap.c | 28 +++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/reactos/dll/win32/gdi32/objects/bitmap.c b/reactos/dll/win32/gdi32/objects/bitmap.c
index 6e3a8c11b82..6fcb97fb6ce 100644
--- a/reactos/dll/win32/gdi32/objects/bitmap.c
+++ b/reactos/dll/win32/gdi32/objects/bitmap.c
@@ -585,7 +585,11 @@ SetDIBits(HDC hdc,
           CONST BITMAPINFO *lpbmi,
           UINT fuColorUse)
 {
+  PBITMAPINFO pConvertedInfo;
+  UINT ConvertedInfoSize;
   INT LinesCopied = 0;
+  UINT cjBmpScanSize = 0;
+  PVOID pvSafeBits = (PVOID)lpvBits;
 
 // This needs to be almost the sames as SetDIBitsToDevice
 
@@ -595,14 +599,32 @@ SetDIBits(HDC hdc,
   if ( fuColorUse && fuColorUse != DIB_PAL_COLORS && fuColorUse != DIB_PAL_COLORS+1 )
      return 0;
 
+  pConvertedInfo = ConvertBitmapInfo(lpbmi, fuColorUse,
+                                      &ConvertedInfoSize, FALSE);
+  if (!pConvertedInfo)
+     return 0;
+
+  cjBmpScanSize = DIB_BitmapMaxBitsSize((LPBITMAPINFO)lpbmi, cScanLines);
+
+  if ( lpvBits )
+  {
+     pvSafeBits = RtlAllocateHeap(GetProcessHeap(), 0, cjBmpScanSize);
+     if (pvSafeBits)
+        RtlCopyMemory( pvSafeBits, lpvBits, cjBmpScanSize);
+  }
+
   LinesCopied = NtGdiSetDIBits( hdc,
                                hbmp,
                          uStartScan,
                          cScanLines,
-                            lpvBits,
-                              lpbmi,
+                         pvSafeBits,
+                     pConvertedInfo,
                          fuColorUse);
 
+  if ( lpvBits != pvSafeBits)
+     RtlFreeHeap(RtlGetProcessHeap(), 0, pvSafeBits);
+  if (lpbmi != pConvertedInfo)
+     RtlFreeHeap(RtlGetProcessHeap(), 0, pConvertedInfo);
   return LinesCopied;
 }
 
@@ -725,7 +747,7 @@ SetDIBitsToDevice(
                                                  TRUE,
                                                  NULL);
   }
-  if ( Bits )
+  if ( Bits != pvSafeBits)
      RtlFreeHeap(RtlGetProcessHeap(), 0, pvSafeBits);
   if (lpbmi != pConvertedInfo)
      RtlFreeHeap(RtlGetProcessHeap(), 0, pConvertedInfo);