From fddcf6191779407c8ca1519046b6a21424be2f4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Gardou?= <jerome.gardou@reactos.org>
Date: Tue, 17 Feb 2015 20:41:51 +0000
Subject: [PATCH] [WIN32SS/NTGDI]  - Reject bits data early in SetBitmapBits
 when it's clear that they can't fit in the destination bitmap. Fixes ugly
 Office 2007 rulers showing garbage.

svn path=/trunk/; revision=66342
---
 reactos/win32ss/gdi/ntgdi/bitmaps.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/reactos/win32ss/gdi/ntgdi/bitmaps.c b/reactos/win32ss/gdi/ntgdi/bitmaps.c
index 2ded5a86e34..42dc6030b1b 100644
--- a/reactos/win32ss/gdi/ntgdi/bitmaps.c
+++ b/reactos/win32ss/gdi/ntgdi/bitmaps.c
@@ -11,7 +11,8 @@
 #define NDEBUG
 #include <debug.h>
 
-void
+static
+int
 NTAPI
 UnsafeSetBitmapBits(
     PSURFACE psurf,
@@ -32,6 +33,9 @@ UnsafeSetBitmapBits(
     lDeltaDst = psurf->SurfObj.lDelta;
     lDeltaSrc = WIDTH_BYTES_ALIGN16(nWidth, cBitsPixel);
 
+    if (cjBits && (cjBits < (lDeltaSrc * nHeight)))
+        return 0;
+
     while (nHeight--)
     {
         /* Copy one line */
@@ -40,6 +44,7 @@ UnsafeSetBitmapBits(
         pjDst += lDeltaDst;
     }
 
+    return 1;
 }
 
 HBITMAP
@@ -538,9 +543,8 @@ NtGdiSetBitmapBits(
 
     _SEH2_TRY
     {
-        ProbeForRead(pUnsafeBits, Bytes, 1);
-        UnsafeSetBitmapBits(psurf, Bytes, pUnsafeBits);
-        ret = 1;
+        ProbeForRead(pUnsafeBits, Bytes, sizeof(WORD));
+        ret = UnsafeSetBitmapBits(psurf, Bytes, pUnsafeBits);
     }
     _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
     {