[ros-diffs] [tkreuzer] 66644: [WIN32K] Annotate a number of GDI functions to match public header declarations.

Author: tkreuzer
Date: Tue Mar 10 00:11:29 2015
New Revision: 66644

URL: http://svn.reactos.org/svn/reactos?rev=66644&view=rev
Log:
[WIN32K]
Annotate a number of GDI functions to match public header declarations.

Modified:
    trunk/reactos/win32ss/gdi/eng/clip.c
    trunk/reactos/win32ss/gdi/eng/eng.h
    trunk/reactos/win32ss/gdi/eng/float.c
    trunk/reactos/win32ss/gdi/eng/inteng.h
    trunk/reactos/win32ss/gdi/eng/ldevobj.h
    trunk/reactos/win32ss/gdi/eng/mapping.c
    trunk/reactos/win32ss/gdi/eng/semaphor.c
    trunk/reactos/win32ss/gdi/eng/stubs.c
    trunk/reactos/win32ss/gdi/eng/umpdstubs.c
    trunk/reactos/win32ss/gdi/ntgdi/arc.c
    trunk/reactos/win32ss/gdi/ntgdi/bezier.c
    trunk/reactos/win32ss/gdi/ntgdi/bitblt.c
    trunk/reactos/win32ss/gdi/ntgdi/brush.c
    trunk/reactos/win32ss/gdi/ntgdi/cliprgn.c
    trunk/reactos/win32ss/gdi/ntgdi/cliprgn.h
    trunk/reactos/win32ss/gdi/ntgdi/coord.c
    trunk/reactos/win32ss/gdi/ntgdi/dclife.c
    trunk/reactos/win32ss/gdi/ntgdi/dcobjs.c
    trunk/reactos/win32ss/gdi/ntgdi/dcstate.c
    trunk/reactos/win32ss/gdi/ntgdi/dibobj.c
    trunk/reactos/win32ss/gdi/ntgdi/fillshap.c
    trunk/reactos/win32ss/gdi/ntgdi/freetype.c
    trunk/reactos/win32ss/gdi/ntgdi/gdiobj.c
    trunk/reactos/win32ss/gdi/ntgdi/region.c
    trunk/reactos/win32ss/gdi/ntgdi/region.h
    trunk/reactos/win32ss/gdi/ntgdi/wingl.c

Modified: trunk/reactos/win32ss/gdi/eng/clip.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/eng/clip.c?rev…
==============================================================================
--- trunk/reactos/win32ss/gdi/eng/clip.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/eng/clip.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -241,10 +241,10 @@
 EngDeleteClip(
     _In_ _Post_ptr_invalid_ CLIPOBJ *pco)
 {
-    XCLIPOBJ* Clip = CONTAINING_RECORD(pco, XCLIPOBJ, ClipObj);
-    TRACE("Deleting %p.\n");
-    IntEngFreeClipResources(Clip);
-    EngFreeMem(Clip);
+    XCLIPOBJ* pxco = CONTAINING_RECORD(pco, XCLIPOBJ, ClipObj);
+    TRACE("Deleting %p.\n", pco);
+    IntEngFreeClipResources(pxco);
+    EngFreeMem(pxco);
 }
 
 /*

Modified: trunk/reactos/win32ss/gdi/eng/eng.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/eng/eng.h?rev=…
==============================================================================
--- trunk/reactos/win32ss/gdi/eng/eng.h	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/eng/eng.h	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -11,16 +11,18 @@
 EngAcquireSemaphoreShared(
     IN HSEMAPHORE hsem);
 
-BOOL APIENTRY
-IntEngMaskBlt(SURFOBJ *psoDest,
-              SURFOBJ *psoMask,
-              CLIPOBJ *ClipRegion,
-              XLATEOBJ *DestColorTranslation,
-              XLATEOBJ *SourceColorTranslation,
-              RECTL *DestRect,
-              POINTL *pptlMask,
-              BRUSHOBJ *pbo,
-              POINTL *BrushOrigin);
+BOOL
+APIENTRY
+IntEngMaskBlt(
+    _Inout_ SURFOBJ *psoDest,
+    _In_ SURFOBJ *psoMask,
+    _In_ CLIPOBJ *pco,
+    _In_ XLATEOBJ *pxloDest,
+    _In_ XLATEOBJ *pxloSource,
+    _In_ RECTL *prclDest,
+    _In_ POINTL *pptlMask,
+    _In_ BRUSHOBJ *pbo,
+    _In_ POINTL *pptlBrushOrg);
 
 VOID FASTCALL
 IntEngWindowChanged(

Modified: trunk/reactos/win32ss/gdi/eng/float.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/eng/float.c?re…
==============================================================================
--- trunk/reactos/win32ss/gdi/eng/float.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/eng/float.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -15,14 +15,20 @@
 
 /* FUNCTIONS *****************************************************************/
 
+_Check_return_
+_Success_(return)
+_Kernel_float_restored_
+_At_(*pBuffer, _Kernel_requires_resource_held_(EngFloatState)
+               _Kernel_releases_resource_(EngFloatState))
+ENGAPI
 BOOL
 APIENTRY
 EngRestoreFloatingPointState(
-    PVOID Buffer)
+    _In_reads_(_Inexpressible_(statesize)) PVOID pBuffer)
 {
     NTSTATUS Status;
 
-    Status = KeRestoreFloatingPointState((PKFLOATING_SAVE)Buffer);
+    Status = KeRestoreFloatingPointState((PKFLOATING_SAVE)pBuffer);
     if (!NT_SUCCESS(Status))
     {
         return FALSE;
@@ -31,16 +37,24 @@
     return TRUE;
 }
 
+_Check_return_
+_Success_(((pBuffer != NULL && cjBufferSize != 0) && return == 1) ||
+          ((pBuffer == NULL || cjBufferSize == 0) && return > 0))
+_When_(pBuffer != NULL && cjBufferSize != 0 && return == 1,
_Kernel_float_saved_
+    _At_(*pBuffer, _Post_valid_ _Kernel_acquires_resource_(EngFloatState)))
+_On_failure_(_Post_satisfies_(return == 0))
+ENGAPI
 ULONG
 APIENTRY
 EngSaveFloatingPointState(
-    PVOID Buffer,
-    ULONG BufferSize)
+    _At_(*pBuffer, _Kernel_requires_resource_not_held_(EngFloatState))
+    _Out_writes_bytes_opt_(cjBufferSize) PVOID pBuffer,
+    _Inout_ ULONG cjBufferSize)
 {
     KFLOATING_SAVE TempBuffer;
     NTSTATUS Status;
 
-    if ((Buffer == NULL) || (BufferSize == 0))
+    if ((pBuffer == NULL) || (cjBufferSize == 0))
     {
         /* Check for floating point support. */
         Status = KeSaveFloatingPointState(&TempBuffer);
@@ -53,12 +67,12 @@
         return(sizeof(KFLOATING_SAVE));
     }
 
-    if (BufferSize < sizeof(KFLOATING_SAVE))
+    if (cjBufferSize < sizeof(KFLOATING_SAVE))
     {
         return(0);
     }
 
-    Status = KeSaveFloatingPointState((PKFLOATING_SAVE)Buffer);
+    Status = KeSaveFloatingPointState((PKFLOATING_SAVE)pBuffer);
     if (!NT_SUCCESS(Status))
     {
         return FALSE;

Modified: trunk/reactos/win32ss/gdi/eng/inteng.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/eng/inteng.h?r…
==============================================================================
--- trunk/reactos/win32ss/gdi/eng/inteng.h	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/eng/inteng.h	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -138,12 +138,14 @@
                      ULONG iTransColor,
                      ULONG Reserved);
 
-BOOL APIENTRY
-IntEngPaint(IN SURFOBJ *Surface,
-            IN CLIPOBJ *ClipRegion,
-            IN BRUSHOBJ *Brush,
-            IN POINTL *BrushOrigin,
-            IN MIX Mix);
+BOOL
+APIENTRY
+IntEngPaint(
+    _In_ SURFOBJ *pso,
+    _In_ CLIPOBJ *pco,
+    _In_ BRUSHOBJ *pbo,
+    _In_ POINTL *pptlBrushOrg,
+    _In_ __in_data_source(USER_MODE) MIX mix);
 
 ULONG APIENTRY
 IntEngSetPointerShape(

Modified: trunk/reactos/win32ss/gdi/eng/ldevobj.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/eng/ldevobj.h?…
==============================================================================
--- trunk/reactos/win32ss/gdi/eng/ldevobj.h	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/eng/ldevobj.h	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -43,8 +43,8 @@
 PLDEVOBJ
 APIENTRY
 EngLoadImageEx(
-    LPWSTR pwszDriverName,
-    ULONG ldevtype);
+    _In_z_ LPWSTR pwszDriverName,
+    _In_ ULONG ldevtype);
 
 PLDEVOBJ
 NTAPI

Modified: trunk/reactos/win32ss/gdi/eng/mapping.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/eng/mapping.c?…
==============================================================================
--- trunk/reactos/win32ss/gdi/eng/mapping.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/eng/mapping.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -381,6 +381,12 @@
                           FILE_NON_DIRECTORY_FILE,
                           NULL,
                           0);
+    if (!NT_SUCCESS(Status))
+    {
+        DPRINT1("Failed to open file, hFile=%p, Status=0x%x\n", hFile,
Status);
+        EngFreeMem(pFileView);
+        return NULL;
+    }
 
     Status = ZwQueryInformationFile(hFile,
                                     &IoStatusBlock,

Modified: trunk/reactos/win32ss/gdi/eng/semaphor.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/eng/semaphor.c…
==============================================================================
--- trunk/reactos/win32ss/gdi/eng/semaphor.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/eng/semaphor.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -17,7 +17,7 @@
 
     if (!NT_SUCCESS(ExInitializeResourceLite(psem)))
     {
-        ExFreePoolWithTag ( psem, GDITAG_SEMAPHORE );
+        ExFreePoolWithTag(psem, GDITAG_SEMAPHORE );
         return NULL;
     }
 

Modified: trunk/reactos/win32ss/gdi/eng/stubs.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/eng/stubs.c?re…
==============================================================================
--- trunk/reactos/win32ss/gdi/eng/stubs.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/eng/stubs.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -423,11 +423,13 @@
 /*
  * @unimplemented
  */
+_Ret_opt_bytecount_(*pcjFile)
+ENGAPI
 PVOID
 APIENTRY
 FONTOBJ_pvTrueTypeFontFile(
-    IN FONTOBJ  *FontObj,
-    IN ULONG    *FileSize)
+    _In_ FONTOBJ *pfo,
+    _Out_ ULONG *pcjFile)
 {
     UNIMPLEMENTED;
     return NULL;
@@ -729,12 +731,14 @@
 /*
  * @unimplemented
  */
+_Ret_opt_bytecount_(*pcjTable)
+ENGAPI
 PBYTE
 APIENTRY
 FONTOBJ_pjOpenTypeTablePointer(
-    IN FONTOBJ *FontObj,
-    IN ULONG Tag,
-    OUT ULONG *Table)
+    _In_ FONTOBJ *pfo,
+    _In_ ULONG ulTag,
+    _Out_ ULONG *pcjTable)
 {
     UNIMPLEMENTED;
     return NULL;
@@ -1628,11 +1632,14 @@
     return FALSE;
 }
 
+_Must_inspect_result_
+_Ret_opt_bytecap_(cjSize)
+ENGAPI
 PVOID
 APIENTRY
 EngFntCacheAlloc(
-    IN ULONG FastCheckSum,
-    IN ULONG ulSize)
+    _In_ ULONG ulFastCheckSum,
+    _In_ ULONG cjSize)
 {
     UNIMPLEMENTED;
     return NULL;

Modified: trunk/reactos/win32ss/gdi/eng/umpdstubs.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/eng/umpdstubs.…
==============================================================================
--- trunk/reactos/win32ss/gdi/eng/umpdstubs.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/eng/umpdstubs.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -3,653 +3,709 @@
 
 #define UNIMPLEMENTED DbgPrint("(%s:%i) WIN32K: %s UNIMPLEMENTED\n", __FILE__,
__LINE__, __FUNCTION__ )
 
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiUMPDEngFreeUserMem(
-    IN KERNEL_PVOID *ppv)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ KERNEL_PVOID *ppv)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiSetPUMPDOBJ(
-    IN HUMPD humpd,
-    IN BOOL bStoreID,
-    OUT HUMPD *phumpd,
-    OUT BOOL *pbWOW64)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_opt_ HUMPD humpd,
+    _In_ BOOL bStoreID,
+    _Inout_opt_ HUMPD *phumpd,
+    _Out_opt_ BOOL *pbWOW64)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 HANDLE
 APIENTRY
 NtGdiBRUSHOBJ_hGetColorTransform(
-   IN BRUSHOBJ *pbo)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ BRUSHOBJ *pbo)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 PVOID
 APIENTRY
 NtGdiBRUSHOBJ_pvAllocRbrush(
-    IN BRUSHOBJ *pbo,
-    IN ULONG cj)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ BRUSHOBJ *pbo,
+    _In_ ULONG cj)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 PVOID
 APIENTRY
 NtGdiBRUSHOBJ_pvGetRbrush(
-    IN BRUSHOBJ *pbo)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ BRUSHOBJ *pbo)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 ULONG
 APIENTRY
 NtGdiBRUSHOBJ_ulGetBrushColor(
-    BRUSHOBJ *pbo)
-{
-    UNIMPLEMENTED;
-    return 0;
-}
-
+    _In_ BRUSHOBJ *pbo)
+{
+    UNIMPLEMENTED;
+    return 0;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiBRUSHOBJ_DeleteRbrush(
-    IN BRUSHOBJ *pbo,
-    IN BRUSHOBJ *pboB)
-{
-    UNIMPLEMENTED;
-    return 0;
-}
-
+    _In_opt_ BRUSHOBJ *pbo,
+    _In_opt_ BRUSHOBJ *pboB)
+{
+    UNIMPLEMENTED;
+    return 0;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiCLIPOBJ_bEnum(
-    IN CLIPOBJ *pco,
-    IN ULONG cj,
-    OUT ULONG *pv)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ CLIPOBJ *pco,
+    _In_ ULONG cj,
+    _Out_writes_bytes_(cj) ULONG *pul)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 ULONG
 APIENTRY
 NtGdiCLIPOBJ_cEnumStart(
-    IN CLIPOBJ *pco,
-    IN BOOL bAll,
-    IN ULONG iType,
-    IN ULONG iDirection,
-    IN ULONG cLimit)
-{
-    UNIMPLEMENTED;
-    return 0;
-}
-
+    _In_ CLIPOBJ *pco,
+    _In_ BOOL bAll,
+    _In_ ULONG iType,
+    _In_ ULONG iDirection,
+    _In_ ULONG cLimit)
+{
+    UNIMPLEMENTED;
+    return 0;
+}
+
+__kernel_entry
 PATHOBJ*
 APIENTRY
 NtGdiCLIPOBJ_ppoGetPath(
-    CLIPOBJ *pco)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ CLIPOBJ *pco)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngAssociateSurface(
-    IN HSURF hsurf,
-    IN HDEV hdev,
-    IN ULONG flHooks)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ HSURF hsurf,
+    _In_ HDEV hdev,
+    _In_ FLONG flHooks)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngCheckAbort(
-    IN SURFOBJ *pso)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *pso)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 FD_GLYPHSET*
 APIENTRY
 NtGdiEngComputeGlyphSet(
-    INT nCodePage,
-    INT nFirstChar,
-    INT cChars)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ INT nCodePage,
+    _In_ INT nFirstChar,
+    _In_ INT cChars)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngCopyBits(
-    SURFOBJ *psoDest,
-    SURFOBJ *psoSrc,
-    CLIPOBJ *pco,
-    XLATEOBJ *pxlo,
-    RECTL *prclDest,
-    POINTL *pptlSrc)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *psoDst,
+    _In_ SURFOBJ *psoSrc,
+    _In_opt_ CLIPOBJ *pco,
+    _In_opt_ XLATEOBJ *pxlo,
+    _In_ RECTL *prclDst,
+    _In_ POINTL *pptlSrc)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 HBITMAP
 APIENTRY
 NtGdiEngCreateBitmap(
-    IN SIZEL sizl,
-    IN LONG lWidth,
-    IN ULONG iFormat,
-    IN ULONG fl,
-    IN PVOID pvBits)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ SIZEL sizl,
+    _In_ LONG lWidth,
+    _In_ ULONG iFormat,
+    _In_ FLONG fl,
+    _In_opt_ PVOID pvBits)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 CLIPOBJ*
 APIENTRY
-NtGdiEngCreateClip(VOID)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+NtGdiEngCreateClip(
+    VOID)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 HBITMAP
 APIENTRY
 NtGdiEngCreateDeviceBitmap(
-    IN DHSURF dhsurf,
-    IN SIZEL sizl,
-    IN ULONG iFormatCompat)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ DHSURF dhsurf,
+    _In_ SIZEL sizl,
+    _In_ ULONG iFormatCompat)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 HSURF
 APIENTRY
 NtGdiEngCreateDeviceSurface(
-    IN DHSURF dhsurf,
-    IN SIZEL sizl,
-    IN ULONG iFormatCompat)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ DHSURF dhsurf,
+    _In_ SIZEL sizl,
+    _In_ ULONG iFormatCompat)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 HPALETTE
 APIENTRY
 NtGdiEngCreatePalette(
-    IN ULONG iMode,
-    IN ULONG cColors,
-    IN ULONG *pulColors,
-    IN ULONG flRed,
-    IN ULONG flGreen,
-    IN ULONG flBlue)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ ULONG iMode,
+    _In_ ULONG cColors,
+    _In_ ULONG *pulColors,
+    _In_ FLONG flRed,
+    _In_ FLONG flGreen,
+    _In_ FLONG flBlue)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 NTSTATUS
 APIENTRY
 NtGdiEngDeleteClip(
-    CLIPOBJ *pco)
+    _In_ CLIPOBJ*pco)
 {
     UNIMPLEMENTED;
     return STATUS_NOT_IMPLEMENTED;
 }
 
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngDeletePalette(
-    IN HPALETTE hpal)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ HPALETTE hPal)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 NTSTATUS
 APIENTRY
 NtGdiEngDeletePath(
-    IN PATHOBJ *ppo)
+    _In_ PATHOBJ *ppo)
 {
     UNIMPLEMENTED;
     return STATUS_NOT_IMPLEMENTED;
 }
 
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngDeleteSurface(
-    IN HSURF hsurf)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ HSURF hsurf)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngEraseSurface(
-    SURFOBJ *pso,
-    RECTL *prcl,
-    ULONG iColor)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *pso,
+    _In_ RECTL *prcl,
+    _In_ ULONG iColor)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngFillPath(
-    SURFOBJ *pso,
-    PATHOBJ *ppo,
-    CLIPOBJ *pco,
-    BRUSHOBJ *pbo,
-    POINTL *pptlBrushOrg,
-    MIX mix,
-    FLONG flOptions)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *pso,
+    _In_ PATHOBJ *ppo,
+    _In_ CLIPOBJ *pco,
+    _In_ BRUSHOBJ *pbo,
+    _In_ POINTL *pptlBrushOrg,
+    _In_ MIX mix,
+    _In_ FLONG flOptions)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngGradientFill(
-    SURFOBJ *psoDest,
-    CLIPOBJ *pco,
-    XLATEOBJ *pxlo,
-    TRIVERTEX *pVertex,
-    ULONG nVertex,
-    PVOID pMesh,
-    ULONG nMesh,
-    RECTL *prclExtents,
-    POINTL *pptlDitherOrg,
-    ULONG ulMode)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *psoDest,
+    _In_ CLIPOBJ *pco,
+    _In_ XLATEOBJ *pxlo,
+    _In_reads_(nVertex) TRIVERTEX *pVertex,
+    _In_ ULONG nVertex,
+    _In_ /* _In_reads_(nMesh) */ PVOID pMesh,
+    _In_ ULONG nMesh,
+    _In_ RECTL *prclExtents,
+    _In_ POINTL *pptlDitherOrg,
+    _In_ ULONG ulMode)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngLineTo(
-    IN SURFOBJ *pso,
-    IN CLIPOBJ *pco,
-    IN BRUSHOBJ *pbo,
-    IN LONG x1,
-    IN LONG y1,
-    IN LONG x2,
-    IN LONG y2,
-    IN RECTL *prclBounds,
-    IN MIX mix)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *pso,
+    _In_ CLIPOBJ *pco,
+    _In_ BRUSHOBJ *pbo,
+    _In_ LONG x1,
+    _In_ LONG y1,
+    _In_ LONG x2,
+    _In_ LONG y2,
+    _In_ RECTL *prclBounds,
+    _In_ MIX mix)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngMarkBandingSurface(
-    HSURF hsurf)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ HSURF hsurf)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngPaint(
-    IN SURFOBJ *pso,
-    IN CLIPOBJ *pco,
-    IN BRUSHOBJ *pbo,
-    IN POINTL *pptlBrushOrg,
-    IN MIX  mix)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *pso,
+    _In_ CLIPOBJ *pco,
+    _In_ BRUSHOBJ *pbo,
+    _In_ POINTL *pptlBrushOrg,
+    _In_ MIX mix)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngPlgBlt(
-    SURFOBJ *psoTrg,
-    SURFOBJ *psoSrc,
-    SURFOBJ *psoMsk,
-    CLIPOBJ *pco,
-    XLATEOBJ *pxlo,
-    COLORADJUSTMENT *pca,
-    POINTL *pptlBrushOrg,
-    POINTFIX *pptfx,
-    RECTL *prcl,
-    POINTL *pptl,
-    ULONG iMode)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *psoTrg,
+    _In_ SURFOBJ *psoSrc,
+    _In_opt_ SURFOBJ *psoMsk,
+    _In_ CLIPOBJ *pco,
+    _In_opt_ XLATEOBJ *pxlo,
+    _In_ COLORADJUSTMENT *pca,
+    _In_ POINTL *pptlBrushOrg,
+    _In_ POINTFIX *pptfx,
+    _In_ RECTL *prcl,
+    _In_opt_ POINTL *pptl,
+    _In_ ULONG iMode)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngStretchBltROP(
-    SURFOBJ *psoDest,
-    SURFOBJ *psoSrc,
-    SURFOBJ *psoMask,
-    CLIPOBJ *pco,
-    XLATEOBJ *pxlo,
-    COLORADJUSTMENT *pca,
-    POINTL *pptlHTOrg,
-    RECTL *prclDest,
-    RECTL *prclSrc,
-    POINTL *pptlMask,
-    ULONG iMode,
-    BRUSHOBJ *pbo,
-    DWORD rop4)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *psoTrg,
+    _In_ SURFOBJ *psoSrc,
+    _In_ SURFOBJ *psoMask,
+    _In_ CLIPOBJ *pco,
+    _In_ XLATEOBJ *pxlo,
+    _In_ COLORADJUSTMENT *pca,
+    _In_ POINTL *pptlBrushOrg,
+    _In_ RECTL *prclTrg,
+    _In_ RECTL *prclSrc,
+    _In_ POINTL *pptlMask,
+    _In_ ULONG iMode,
+    _In_ BRUSHOBJ *pbo,
+    _In_ ROP4 rop4)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngStrokePath(
-    SURFOBJ *pso,
-    PATHOBJ *ppo,
-    CLIPOBJ *pco,
-    XFORMOBJ *pxo,
-    BRUSHOBJ *pbo,
-    POINTL *pptlBrushOrg,
-    LINEATTRS *plineattrs,
-    MIX mix)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *pso,
+    _In_ PATHOBJ *ppo,
+    _In_ CLIPOBJ *pco,
+    _In_ XFORMOBJ *pxo,
+    _In_ BRUSHOBJ *pbo,
+    _In_ POINTL *pptlBrushOrg,
+    _In_ LINEATTRS *plineattrs,
+    _In_ MIX mix)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngStrokeAndFillPath(
-    SURFOBJ *pso,
-    PATHOBJ *ppo,
-    CLIPOBJ *pco,
-    XFORMOBJ *pxo,
-    BRUSHOBJ *pboStroke,
-    LINEATTRS *plineattrs,
-    BRUSHOBJ *pboFill,
-    POINTL *pptlBrushOrg,
-    MIX mixFill,
-    FLONG flOptions)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *pso,
+    _In_ PATHOBJ *ppo,
+    _In_ CLIPOBJ *pco,IN XFORMOBJ *pxo,
+    _In_ BRUSHOBJ *pboStroke,
+    _In_ LINEATTRS *plineattrs,
+    _In_ BRUSHOBJ *pboFill,
+    _In_ POINTL *pptlBrushOrg,
+    _In_ MIX mix,
+    _In_ FLONG flOptions)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngTextOut(
-    SURFOBJ *pso,
-    STROBJ *pstro,
-    FONTOBJ *pfo,
-    CLIPOBJ *pco,
-    RECTL *prclExtra,
-    RECTL *prclOpaque,
-    BRUSHOBJ *pboFore,
-    BRUSHOBJ *pboOpaque,
-    POINTL *pptlOrg,
-    MIX mix)
+    _In_ SURFOBJ *pso,
+    _In_ STROBJ *pstro,
+    _In_ FONTOBJ *pfo,
+    _In_ CLIPOBJ *pco,
+    _In_ RECTL *prclExtra,
+    _In_ RECTL *prclOpaque,
+    _In_ BRUSHOBJ *pboFore,
+    _In_ BRUSHOBJ *pboOpaque,
+    _In_ POINTL *pptlOrg,
+    _In_ MIX mix)
 {
      UNIMPLEMENTED;
     return FALSE;
 }
 
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiEngTransparentBlt(
-    IN SURFOBJ *psoDst,
-    IN SURFOBJ *psoSrc,
-    IN CLIPOBJ *pco,
-    IN XLATEOBJ *pxlo,
-    IN PRECTL prclDst,
-    IN PRECTL prclSrc,
-    IN ULONG iTransColor,
-    IN ULONG ulReserved)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ SURFOBJ *psoDst,
+    _In_ SURFOBJ *psoSrc,
+    _In_ CLIPOBJ *pco,
+    _In_ XLATEOBJ *pxlo,
+    _In_ RECTL *prclDst,
+    _In_ RECTL *prclSrc,
+    _In_ ULONG iTransColor,
+    _In_ ULONG ulReserved)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 NTSTATUS
 APIENTRY
 NtGdiFONTOBJ_vGetInfo(
-    IN FONTOBJ *pfo,
-    IN ULONG cjSize,
-    OUT FONTINFO *pfi)
+    _In_ FONTOBJ *pfo,
+    _In_ ULONG cjSize,
+    _Out_writes_bytes_(cjSize) FONTINFO *pfi)
 {
     UNIMPLEMENTED;
     return STATUS_NOT_IMPLEMENTED;
 }
 
+__kernel_entry
 XFORMOBJ*
 APIENTRY
 NtGdiFONTOBJ_pxoGetXform(
-    IN FONTOBJ *pfo)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ FONTOBJ *pfo)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 ULONG
 APIENTRY
 NtGdiFONTOBJ_cGetGlyphs(
-    IN FONTOBJ *pfo,
-    IN ULONG    iMode,
-    IN ULONG    cGlyph,
-    IN HGLYPH  *phg,
-    IN PVOID   *ppvGlyph)
-{
-    UNIMPLEMENTED;
-    return 0;
-}
-
+    _In_ FONTOBJ *pfo,
+    _In_ ULONG iMode,
+    _In_ ULONG cGlyph,
+    _In_ HGLYPH *phg,
+    _At_((GLYPHDATA**)ppvGlyph, _Outptr_) PVOID *ppvGlyph)
+{
+    UNIMPLEMENTED;
+    return 0;
+}
+
+__kernel_entry
 IFIMETRICS*
 APIENTRY
 NtGdiFONTOBJ_pifi(
-    IN FONTOBJ *pfo)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ FONTOBJ *pfo)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 FD_GLYPHSET*
 APIENTRY
 NtGdiFONTOBJ_pfdg(
-    IN FONTOBJ *pfo)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ FONTOBJ *pfo)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 PFD_GLYPHATTR
 APIENTRY
 NtGdiFONTOBJ_pQueryGlyphAttrs(
-    IN FONTOBJ *pfo,
-    IN ULONG iMode)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ FONTOBJ *pfo,
+    _In_ ULONG iMode)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 PVOID
 APIENTRY
 NtGdiFONTOBJ_pvTrueTypeFontFile(
-    IN FONTOBJ *pfo,
-    OUT ULONG *pcjFile)
-{
-    UNIMPLEMENTED;
-    return NULL;
-}
-
+    _In_ FONTOBJ *pfo,
+    _Out_ ULONG *pcjFile)
+{
+    UNIMPLEMENTED;
+    return NULL;
+}
+
+__kernel_entry
 ULONG
 APIENTRY
 NtGdiFONTOBJ_cGetAllGlyphHandles(
-    IN FONTOBJ *pfo,
-    IN HGLYPH  *phg)
-{
-    UNIMPLEMENTED;
-    return 0;
-}
-
+    _In_ FONTOBJ *pfo,
+    _Out_opt_ _Post_count_(return) HGLYPH *phg)
+{
+    UNIMPLEMENTED;
+    return 0;
+}
+
+__kernel_entry
 LONG
 APIENTRY
 NtGdiHT_Get8BPPMaskPalette(
-    OUT OPTIONAL LPPALETTEENTRY pPaletteEntry,
-    IN BOOL Use8BPPMaskPal,
-    IN BYTE CMYMask,
-    IN USHORT RedGamma,
-    IN USHORT GreenGamma,
-    IN USHORT BlueGamma)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _Out_opt_ _Post_count_(return) LPPALETTEENTRY pPaletteEntry,
+    _In_ BOOL Use8BPPMaskPal,
+    _In_ BYTE CMYMask,
+    _In_ USHORT RedGamma,
+    _In_ USHORT GreenGamma,
+    _In_ USHORT BlueGamma)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 LONG
 APIENTRY
 NtGdiHT_Get8BPPFormatPalette(
-    OUT OPTIONAL LPPALETTEENTRY pPaletteEntry,
-    IN USHORT RedGamma,
-    IN USHORT GreenGamma,
-    IN USHORT BlueGamma)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _Out_opt_ _Post_count_(return) LPPALETTEENTRY pPaletteEntry,
+    _In_ USHORT RedGamma,
+    _In_ USHORT GreenGamma,
+    _In_ USHORT BlueGamma)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 NTSTATUS
 APIENTRY
 NtGdiPATHOBJ_vGetBounds(
-    IN PATHOBJ *ppo,
-    OUT PRECTFX prectfx)
+    _In_ PATHOBJ *ppo,
+    _Out_ PRECTFX prectfx)
 {
     UNIMPLEMENTED;
     return STATUS_NOT_IMPLEMENTED;
 }
 
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiPATHOBJ_bEnum(
-    IN PATHOBJ *ppo,
-    OUT PATHDATA *ppd)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ PATHOBJ *ppo,
+    _Out_ PATHDATA *ppd)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 NTSTATUS
 APIENTRY
 NtGdiPATHOBJ_vEnumStart(
-    IN PATHOBJ *ppo)
+    _In_ PATHOBJ *ppo)
 {
     UNIMPLEMENTED;
     return STATUS_NOT_IMPLEMENTED;
 }
 
+__kernel_entry
 NTSTATUS
 APIENTRY
 NtGdiPATHOBJ_vEnumStartClipLines(
-    IN PATHOBJ *ppo,
-    IN CLIPOBJ *pco,
-    IN SURFOBJ *pso,
-    IN LINEATTRS *pla)
+    _In_ PATHOBJ *ppo,
+    _In_ CLIPOBJ *pco,
+    _In_ SURFOBJ *pso,
+    _In_ LINEATTRS *pla)
 {
     UNIMPLEMENTED;
     return STATUS_NOT_IMPLEMENTED;
 }
 
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiPATHOBJ_bEnumClipLines(
-    IN PATHOBJ *ppo,
-    IN ULONG cb,
-    OUT CLIPLINE *pcl)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ PATHOBJ *ppo,
+    _In_ ULONG cb,
+    _Out_writes_bytes_(cb) CLIPLINE *pcl)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiSTROBJ_bEnum(
-    IN STROBJ *pstro,
-    OUT ULONG *pc,
-    OUT PGLYPHPOS *ppgpos)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ STROBJ *pstro,
+    _Out_ ULONG *pc,
+    _Outptr_result_buffer_(*pc) PGLYPHPOS *ppgpos)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiSTROBJ_bEnumPositionsOnly(
-    IN STROBJ *pstro,
-    OUT ULONG *pc,
-    OUT PGLYPHPOS *ppgpos)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ STROBJ *pstro,
+    _Out_ ULONG *pc,
+    _Outptr_result_buffer_(*pc) PGLYPHPOS *ppgpos)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiSTROBJ_bGetAdvanceWidths(
-    IN STROBJ *pstro,
-    IN ULONG iFirst,
-    IN ULONG c,
-    OUT POINTQF *pptqD)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
+    _In_ STROBJ*pstro,
+    _In_ ULONG iFirst,
+    _In_ ULONG c,
+    _Out_writes_(c) POINTQF*pptqD)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+__kernel_entry
 NTSTATUS
 APIENTRY
 NtGdiSTROBJ_vEnumStart(
-    IN STROBJ *pstro)
+    _Inout_ STROBJ *pstro)
 {
     UNIMPLEMENTED;
     return STATUS_NOT_IMPLEMENTED;
 }
 
+__kernel_entry
 DWORD
 APIENTRY
 NtGdiSTROBJ_dwGetCodePage(
-    IN STROBJ *pstro)
-{
-    UNIMPLEMENTED;
-    return 0;
-}
-
+    _In_ STROBJ *pstro)
+{
+    UNIMPLEMENTED;
+    return 0;
+}
+
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiXFORMOBJ_bApplyXform(
-    IN XFORMOBJ *pxo,
-    IN ULONG iMode,
-    IN ULONG cPoints,
+    _In_ XFORMOBJ *pxo,
+    _In_ ULONG iMode,
+    _In_ ULONG cPoints,
     _In_reads_(cPoints) PPOINTL pptIn,
     _Out_writes_(cPoints) PPOINTL pptOut)
 {
@@ -657,42 +713,46 @@
     return FALSE;
 }
 
+__kernel_entry
 ULONG
 APIENTRY
 NtGdiXFORMOBJ_iGetXform(
-    IN XFORMOBJ *pxo,
-    OUT OPTIONAL XFORML *pxform)
-{
-    UNIMPLEMENTED;
-    return 0;
-}
-
+    _In_ XFORMOBJ *pxo,
+    _Out_opt_ XFORML *pxform)
+{
+    UNIMPLEMENTED;
+    return 0;
+}
+
+__kernel_entry
 ULONG
 APIENTRY
 NtGdiXLATEOBJ_cGetPalette(
-    IN XLATEOBJ *pxlo,
-    IN ULONG iPal,
-    IN ULONG cPal,
-    OUT ULONG *pPal)
-{
-    UNIMPLEMENTED;
-    return 0;
-}
-
+    _In_ XLATEOBJ *pxlo,
+    _In_ ULONG iPal,
+    _In_ ULONG cPal,
+    _Out_writes_(cPal) ULONG *pPal)
+{
+    UNIMPLEMENTED;
+    return 0;
+}
+
+__kernel_entry
 ULONG
 APIENTRY
 NtGdiXLATEOBJ_iXlate(
-    IN XLATEOBJ *pxlo,
-    IN ULONG iColor)
-{
-    UNIMPLEMENTED;
-    return 0;
-}
-
+    _In_ XLATEOBJ *pxlo,
+    _In_ ULONG iColor)
+{
+    UNIMPLEMENTED;
+    return 0;
+}
+
+__kernel_entry
 HANDLE
 APIENTRY
 NtGdiXLATEOBJ_hGetColorTransform(
-    IN XLATEOBJ *pxlo)
+    _In_ XLATEOBJ *pxlo)
 {
     UNIMPLEMENTED;
     return 0;

Modified: trunk/reactos/win32ss/gdi/ntgdi/arc.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/arc.c?re…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/arc.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/arc.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -317,6 +317,7 @@
   BOOL Ret = FALSE;
   gxf_long worker, worker1;
   KFLOATING_SAVE FloatSave;
+  NTSTATUS status;
 
   pDC = DC_LockDc (hDC);
   if(!pDC)
@@ -331,7 +332,12 @@
     return TRUE;
   }
 
-  KeSaveFloatingPointState(&FloatSave);
+  status = KeSaveFloatingPointState(&FloatSave);
+  if (!NT_SUCCESS(status))
+  {
+      DC_UnlockDc( pDC );
+      return FALSE;
+  }
 
   worker.l  = dwStartAngle;
   worker1.l = dwSweepAngle;
@@ -366,6 +372,7 @@
   DC *dc;
   BOOL Ret;
   KFLOATING_SAVE FloatSave;
+  NTSTATUS status;
 
   dc = DC_LockDc (hDC);
   if(!dc)
@@ -388,7 +395,12 @@
   if (dc->pdcattr->ulDirty_ & (DIRTY_LINE | DC_PEN_DIRTY))
     DC_vUpdateLineBrush(dc);
 
-  KeSaveFloatingPointState(&FloatSave);
+  status = KeSaveFloatingPointState(&FloatSave);
+  if (!NT_SUCCESS(status))
+  {
+      DC_UnlockDc( dc );
+      return FALSE;
+  }
 
   Ret = IntGdiArcInternal(
                   arctype,

Modified: trunk/reactos/win32ss/gdi/ntgdi/bezier.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/bezier.c…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/bezier.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/bezier.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -138,6 +138,12 @@
   if(*nPtsOut == *dwOut) {
     *dwOut *= 2;
     *PtsOut = ExAllocatePoolWithTag(PagedPool, *dwOut * sizeof(POINT), TAG_BEZIER);
+    if (*PtsOut == NULL)
+    {
+        /// \todo FIXME!
+        NT_ASSERT(FALSE);
+        return;
+    }
   }
 
   if(!level || BezierCheck(level, Points)) {

Modified: trunk/reactos/win32ss/gdi/ntgdi/bitblt.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/bitblt.c…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/bitblt.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/bitblt.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -1090,11 +1090,12 @@
     return bResult;
 }
 
+static
 BOOL
 IntGdiFillRgn(
     _In_ PDC pdc,
     _In_ PREGION prgn,
-    _In_ PBRUSH pbrFill)
+    _In_opt_ PBRUSH pbrFill)
 {
     PREGION prgnClip;
     XCLIPOBJ xcoClip;

Modified: trunk/reactos/win32ss/gdi/ntgdi/brush.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/brush.c?…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/brush.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/brush.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -47,6 +47,7 @@
 
     ppi = PsGetCurrentProcessWin32Process();
     NT_ASSERT(ppi);
+    __analysis_assume(ppi);
 
     pBrushAttr = GdiPoolAllocate(ppi->pPoolBrushAttr);
     if (!pBrushAttr)

Modified: trunk/reactos/win32ss/gdi/ntgdi/cliprgn.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/cliprgn.…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/cliprgn.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/cliprgn.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -143,6 +143,7 @@
     return retval;
 }
 
+_Success_(return!=ERROR)
 INT
 FASTCALL
 GdiGetClipBox(
@@ -186,6 +187,7 @@
     return iComplexity;
 }
 
+_Success_(return!=ERROR)
 INT
 APIENTRY
 NtGdiGetAppClipBox(

Modified: trunk/reactos/win32ss/gdi/ntgdi/cliprgn.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/cliprgn.…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/cliprgn.h	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/cliprgn.h	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -1,5 +1,6 @@
 #pragma once
 
+_Success_(return!=ERROR)
 INT
 FASTCALL
 GdiGetClipBox(

Modified: trunk/reactos/win32ss/gdi/ntgdi/coord.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/coord.c?…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/coord.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/coord.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -517,7 +517,13 @@
     /* The xform is permitted to be NULL for MWT_IDENTITY.
      * However, if it is not NULL, then it must be valid even
      * though it is not used. */
-    if ((pxformUnsafe != NULL) || (dwMode != MWT_IDENTITY))
+    if ((dwMode != MWT_IDENTITY) && (pxformUnsafe == NULL))
+    {
+        DC_UnlockDc(pdc);
+        return FALSE;
+    }
+
+    if (pxformUnsafe != NULL)
     {
         _SEH2_TRY
         {

Modified: trunk/reactos/win32ss/gdi/ntgdi/dclife.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/dclife.c…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/dclife.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/dclife.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -670,17 +670,18 @@
     return hdc;
 }
 
+__kernel_entry
 HDC
 APIENTRY
 NtGdiOpenDCW(
-    PUNICODE_STRING pustrDevice,
-    DEVMODEW *pdmInit,
-    PUNICODE_STRING pustrLogAddr,
-    ULONG iType,
-    BOOL bDisplay,
-    HANDLE hspool,
-    DRIVER_INFO_2W *pDriverInfo2,
-    VOID *pUMdhpdev)
+    _In_opt_ PUNICODE_STRING pustrDevice,
+    _In_ DEVMODEW *pdmInit,
+    _In_ PUNICODE_STRING pustrLogAddr,
+    _In_ ULONG iType,
+    _In_ BOOL bDisplay,
+    _In_opt_ HANDLE hspool,
+    _In_opt_ DRIVER_INFO_2W *pDriverInfo2,
+    _At_((PUMDHPDEV*)pUMdhpdev, _Out_) PVOID pUMdhpdev)
 {
     UNICODE_STRING ustrDevice;
     WCHAR awcDevice[CCHDEVICENAME];
@@ -706,6 +707,8 @@
             if (pdmInit)
             {
                 /* FIXME: could be larger */
+                /* According to a comment in Windows SDK the size of the buffer for
+                   pdm is (pdm->dmSize + pdm->dmDriverExtra) */
                 ProbeForRead(pdmInit, sizeof(DEVMODEW), 1);
                 RtlCopyMemory(&dmInit, pdmInit, sizeof(DEVMODEW));
             }

Modified: trunk/reactos/win32ss/gdi/ntgdi/dcobjs.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/dcobjs.c…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/dcobjs.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/dcobjs.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -159,7 +159,8 @@
  *
  * @implemented
  */
-_Success_(return != FALSE)
+_Success_(return!=FALSE)
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiSetBrushOrg(

Modified: trunk/reactos/win32ss/gdi/ntgdi/dcstate.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/dcstate.…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/dcstate.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/dcstate.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -105,17 +105,20 @@
     return TRUE;
 }
 
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiResetDC(
-    IN HDC hdc,
-    IN LPDEVMODEW pdm,
-    OUT PBOOL pbBanding,
-    IN OPTIONAL DRIVER_INFO_2W *pDriverInfo2,
-    OUT VOID *ppUMdhpdev)
-{
+    _In_ HDC hdc,
+    _In_ LPDEVMODEW pdm,
+    _Out_ PBOOL pbBanding,
+    _In_opt_ DRIVER_INFO_2W *pDriverInfo2,
+    _At_((PUMDHPDEV*)ppUMdhpdev, _Out_) PVOID ppUMdhpdev)
+{
+    /* According to a comment in Windows SDK the size of the buffer for
+       pdm is (pdm->dmSize + pdm->dmDriverExtra) */
     UNIMPLEMENTED;
-    return 0;
+    return FALSE;
 }
 
 

Modified: trunk/reactos/win32ss/gdi/ntgdi/dibobj.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/dibobj.c…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/dibobj.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/dibobj.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -1002,6 +1002,8 @@
     return ScanLines;
 }
 
+_Success_(return!=0)
+__kernel_entry
 INT
 APIENTRY
 NtGdiGetDIBitsInternal(
@@ -1009,13 +1011,13 @@
     _In_ HBITMAP hbm,
     _In_ UINT iStartScan,
     _In_ UINT cScans,
-    _Out_opt_ LPBYTE pjBits,
-    _Inout_ LPBITMAPINFO pbmiUser,
+    _Out_writes_bytes_opt_(cjMaxBits) LPBYTE pjBits,
+    _Inout_ LPBITMAPINFO pbmi,
     _In_ UINT iUsage,
     _In_ UINT cjMaxBits,
     _In_ UINT cjMaxInfo)
 {
-    PBITMAPINFO pbmi;
+    PBITMAPINFO pbmiSafe;
     HANDLE hSecure = NULL;
     INT iResult = 0;
     UINT cjAlloc;
@@ -1037,8 +1039,8 @@
     cjAlloc = sizeof(BITMAPV5HEADER) + 256 * sizeof(RGBQUAD);
 
     /* Allocate a buffer the bitmapinfo */
-    pbmi = ExAllocatePoolWithTag(PagedPool, cjAlloc, 'imBG');
-    if (!pbmi)
+    pbmiSafe = ExAllocatePoolWithTag(PagedPool, cjAlloc, 'imBG');
+    if (!pbmiSafe)
     {
         /* Fail */
         return 0;
@@ -1048,8 +1050,8 @@
     _SEH2_TRY
     {
         /* Probe and copy the BITMAPINFO */
-        ProbeForRead(pbmiUser, cjMaxInfo, 1);
-        RtlCopyMemory(pbmi, pbmiUser, cjMaxInfo);
+        ProbeForRead(pbmi, cjMaxInfo, 1);
+        RtlCopyMemory(pbmi, pbmi, cjMaxInfo);
     }
     _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
     {
@@ -1058,8 +1060,8 @@
     _SEH2_END;
 
     /* Check if the header size is large enough */
-    if ((pbmi->bmiHeader.biSize < sizeof(BITMAPCOREHEADER)) ||
-        (pbmi->bmiHeader.biSize > cjMaxInfo))
+    if ((pbmiSafe->bmiHeader.biSize < sizeof(BITMAPCOREHEADER)) ||
+        (pbmiSafe->bmiHeader.biSize > cjMaxInfo))
     {
         goto cleanup;
     }
@@ -1081,7 +1083,7 @@
                                    iStartScan,
                                    cScans,
                                    pjBits,
-                                   pbmi,
+                                   pbmiSafe,
                                    iUsage,
                                    cjMaxBits,
                                    cjMaxInfo);
@@ -1093,20 +1095,21 @@
         _SEH2_TRY
         {
             /* Copy the data back */
-            cjMaxInfo = min(cjMaxInfo, (UINT)DIB_BitmapInfoSize(pbmi, (WORD)iUsage));
-            ProbeForWrite(pbmiUser, cjMaxInfo, 1);
-            RtlCopyMemory(pbmiUser, pbmi, cjMaxInfo);
+            cjMaxInfo = min(cjMaxInfo, (UINT)DIB_BitmapInfoSize(pbmiSafe,
(WORD)iUsage));
+            ProbeForWrite(pbmi, cjMaxInfo, 1);
+            RtlCopyMemory(pbmi, pbmiSafe, cjMaxInfo);
         }
         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
         {
             /* Ignore */
+            (VOID)0;
         }
         _SEH2_END;
     }
 
 cleanup:
     if (hSecure) EngUnsecureMem(hSecure);
-    ExFreePoolWithTag(pbmi, 'imBG');
+    ExFreePoolWithTag(pbmiSafe, 'imBG');
 
     return iResult;
 }

Modified: trunk/reactos/win32ss/gdi/ntgdi/fillshap.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/fillshap…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/fillshap.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/fillshap.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -1074,7 +1074,7 @@
 #if 0
     PDC_ATTR   pdcattr;
 #endif
-    SURFACE    *psurf = NULL;
+    SURFACE    *psurf;
     EXLATEOBJ  exlo;
     BOOL       Ret = FALSE;
     RECTL      DestRect;
@@ -1111,6 +1111,7 @@
     DC_vPrepareDCsForBlit(dc, &DestRect, NULL, NULL);
 
     /// FIXME: what about prgnVIS? And what about REAL clipping?
+    psurf = dc->dclevel.pSurface;
     if (dc->prgnRao)
     {
         Ret = REGION_PtInRegion(dc->prgnRao, Pt.x, Pt.y);
@@ -1127,8 +1128,6 @@
         RECTL_vSetRect(&DestRect, 0, 0, psurf->SurfObj.sizlBitmap.cx,
psurf->SurfObj.sizlBitmap.cy);
     }
 
-    psurf = dc->dclevel.pSurface;
-
     EXLATEOBJ_vInitialize(&exlo, &gpalRGB, psurf->ppal, 0, 0xffffff, 0);
 
     /* Only solid fills supported for now

Modified: trunk/reactos/win32ss/gdi/ntgdi/freetype.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/freetype…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/freetype.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/freetype.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -153,8 +153,17 @@
     FontCacheNumEntries = 0;
     /* Fast Mutexes must be allocated from non paged pool */
     FontListLock = ExAllocatePoolWithTag(NonPagedPool, sizeof(FAST_MUTEX),
TAG_INTERNAL_SYNC);
+    if (FontListLock == NULL)
+    {
+        return FALSE;
+    }
+
     ExInitializeFastMutex(FontListLock);
     FreeTypeLock = ExAllocatePoolWithTag(NonPagedPool, sizeof(FAST_MUTEX),
TAG_INTERNAL_SYNC);
+    if (FreeTypeLock == NULL)
+    {
+        return FALSE;
+    }
     ExInitializeFastMutex(FreeTypeLock);
 
     ulError = FT_Init_FreeType(&library);
@@ -417,7 +426,15 @@
     Entry->Font = FontGDI;
     Entry->NotEnum = (Characteristics & FR_NOT_ENUM);
     RtlInitAnsiString(&AnsiFaceName, (LPSTR)Face->family_name);
-    RtlAnsiStringToUnicodeString(&Entry->FaceName, &AnsiFaceName, TRUE);
+    Status = RtlAnsiStringToUnicodeString(&Entry->FaceName, &AnsiFaceName,
TRUE);
+    if (!NT_SUCCESS(Status))
+    {
+        ExFreePoolWithTag(FontGDI->Filename, GDITAG_PFF);
+        EngFreeMem(FontGDI);
+        FT_Done_Face(Face);
+        ExFreePoolWithTag(Entry, TAG_FONT);
+        return 0;
+    }
 
     if (Characteristics & FR_PRIVATE)
     {
@@ -786,14 +803,24 @@
     FT_WinFNT_HeaderRec Win;
     FT_Error Error;
     char *Cp;
+    NTSTATUS status;
 
     Needed = sizeof(OUTLINETEXTMETRICW);
 
     RtlInitAnsiString(&FamilyNameA, FontGDI->face->family_name);
-    RtlAnsiStringToUnicodeString(&FamilyNameW, &FamilyNameA, TRUE);
+    status = RtlAnsiStringToUnicodeString(&FamilyNameW, &FamilyNameA, TRUE);
+    if (!NT_SUCCESS(status))
+    {
+        return 0;
+    }
 
     RtlInitAnsiString(&StyleNameA, FontGDI->face->style_name);
-    RtlAnsiStringToUnicodeString(&StyleNameW, &StyleNameA, TRUE);
+    status = RtlAnsiStringToUnicodeString(&StyleNameW, &StyleNameA, TRUE);
+    if (!NT_SUCCESS(status))
+    {
+        RtlFreeUnicodeString(&FamilyNameW);
+        return 0;
+    }
 
     /* These names should be read from the TT name table */
 
@@ -939,6 +966,7 @@
     ANSI_STRING EntryFaceNameA;
     UNICODE_STRING EntryFaceNameW;
     FONTGDI *FontGDI;
+    NTSTATUS status;
 
     Entry = Head->Flink;
     while (Entry != Head)
@@ -949,7 +977,12 @@
         ASSERT(FontGDI);
 
         RtlInitAnsiString(&EntryFaceNameA, FontGDI->face->family_name);
-        RtlAnsiStringToUnicodeString(&EntryFaceNameW, &EntryFaceNameA, TRUE);
+        status = RtlAnsiStringToUnicodeString(&EntryFaceNameW, &EntryFaceNameA,
TRUE);
+        if (!NT_SUCCESS(status))
+        {
+            break;
+        }
+
         if ((LF_FACESIZE - 1) * sizeof(WCHAR) < EntryFaceNameW.Length)
         {
             EntryFaceNameW.Length = (LF_FACESIZE - 1) * sizeof(WCHAR);
@@ -1007,6 +1040,7 @@
     TEXTMETRICW *TM;
     NEWTEXTMETRICW *Ntm;
     DWORD fs0;
+    NTSTATUS status;
 
     RtlZeroMemory(Info, sizeof(FONTFAMILYINFO));
     Size = IntGetOutlineTextMetrics(FontGDI, 0, NULL);
@@ -1078,7 +1112,11 @@
     RtlInitAnsiString(&StyleA, FontGDI->face->style_name);
     StyleW.Buffer = Info->EnumLogFontEx.elfStyle;
     StyleW.MaximumLength = sizeof(Info->EnumLogFontEx.elfStyle);
-    RtlAnsiStringToUnicodeString(&StyleW, &StyleA, FALSE);
+    status = RtlAnsiStringToUnicodeString(&StyleW, &StyleA, FALSE);
+    if (!NT_SUCCESS(status))
+    {
+        return;
+    }
 
     Info->EnumLogFontEx.elfLogFont.lfCharSet = DEFAULT_CHARSET;
     Info->EnumLogFontEx.elfScript[0] = L'\0';
@@ -1192,6 +1230,7 @@
     ANSI_STRING EntryFaceNameA;
     UNICODE_STRING EntryFaceNameW;
     FONTGDI *FontGDI;
+    NTSTATUS status;
 
     Entry = Head->Flink;
     while (Entry != Head)
@@ -1202,7 +1241,12 @@
         ASSERT(FontGDI);
 
         RtlInitAnsiString(&EntryFaceNameA, FontGDI->face->family_name);
-        RtlAnsiStringToUnicodeString(&EntryFaceNameW, &EntryFaceNameA, TRUE);
+        status = RtlAnsiStringToUnicodeString(&EntryFaceNameW, &EntryFaceNameA,
TRUE);
+        if (!NT_SUCCESS(status))
+        {
+            return FALSE;
+        }
+
         if ((LF_FACESIZE - 1) * sizeof(WCHAR) < EntryFaceNameW.Length)
         {
             EntryFaceNameW.Length = (LF_FACESIZE - 1) * sizeof(WCHAR);
@@ -1232,6 +1276,7 @@
     DWORD Size;
 } FONT_FAMILY_INFO_CALLBACK_CONTEXT, *PFONT_FAMILY_INFO_CALLBACK_CONTEXT;
 
+_Function_class_(RTL_QUERY_REGISTRY_ROUTINE)
 static NTSTATUS APIENTRY
 FontFamilyInfoQueryRegistryCallback(IN PWSTR ValueName, IN ULONG ValueType,
                                     IN PVOID ValueData, IN ULONG ValueLength,
@@ -1779,7 +1824,7 @@
         for (n = 0; n < ft_face->num_charmaps; n++)
         {
             charmap = ft_face->charmaps[n];
-            DPRINT("Found charmap encoding: %u\n", charmap->encoding);
+            DPRINT("Found charmap encoding: %i\n", charmap->encoding);
             if (charmap->encoding != 0)
             {
                 found = charmap;
@@ -2230,7 +2275,7 @@
         for (n = 0; n < face->num_charmaps; n++)
         {
             charmap = face->charmaps[n];
-            DPRINT("Found charmap encoding: %u\n", charmap->encoding);
+            DPRINT("Found charmap encoding: %i\n", charmap->encoding);
             if (charmap->encoding != 0)
             {
                 found = charmap;
@@ -2505,7 +2550,7 @@
         }
     }
     else
-        DPRINT1("Encoding %u not supported\n", face->charmap->encoding);
+        DPRINT1("Encoding %i not supported\n", face->charmap->encoding);
 
     size = sizeof(GLYPHSET) + sizeof(WCRANGE) * (num_ranges - 1);
     if (glyphset)
@@ -3356,7 +3401,7 @@
     Start.y = YStart;
     IntLPtoDP(dc, &Start, 1);
 
-    RealXStart = (Start.x + dc->ptlDCOrig.x) << 6;
+    RealXStart = ((LONGLONG)Start.x + dc->ptlDCOrig.x) << 6;
     YStart = Start.y + dc->ptlDCOrig.y;
 
     SourcePoint.x = 0;
@@ -3433,7 +3478,7 @@
         for (n = 0; n < face->num_charmaps; n++)
         {
             charmap = face->charmaps[n];
-            DPRINT("Found charmap encoding: %u\n", charmap->encoding);
+            DPRINT("Found charmap encoding: %i\n", charmap->encoding);
             if (charmap->encoding != 0)
             {
                 found = charmap;
@@ -3498,7 +3543,7 @@
     {
         ULONGLONG TextWidth = 0;
         LPCWSTR TempText = String;
-        int Start;
+        int iStart;
 
         /*
          * Calculate width of the text.
@@ -3506,16 +3551,16 @@
 
         if (NULL != Dx)
         {
-            Start = Count < 2 ? 0 : Count - 2;
+            iStart = Count < 2 ? 0 : Count - 2;
             TextWidth = Count < 2 ? 0 : (Dx[(Count-2)<<DxShift] << 6);
         }
         else
         {
-            Start = 0;
-        }
-        TempText = String + Start;
-
-        for (i = Start; i < Count; i++)
+            iStart = 0;
+        }
+        TempText = String + iStart;
+
+        for (i = iStart; i < Count; i++)
         {
             if (fuOptions & ETO_GLYPH_INDEX)
                 glyph_index = *TempText;
@@ -4304,12 +4349,12 @@
 DWORD
 FASTCALL
 GreGetGlyphIndicesW(
-    HDC hdc,
-    LPWSTR pwc,
-    INT cwc,
-    LPWORD pgi,
-    DWORD iMode,
-    DWORD Unknown)
+    _In_ HDC hdc,
+    _In_opt_ LPWSTR pwc,
+    _In_ INT cwc,
+    _Out_opt_ LPWORD pgi,
+    _In_ DWORD iMode,
+    _In_ DWORD dwUnknown)
 {
     PDC dc;
     PDC_ATTR pdcattr;

Modified: trunk/reactos/win32ss/gdi/ntgdi/gdiobj.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/gdiobj.c…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/gdiobj.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/gdiobj.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -37,6 +37,13 @@
 #define NDEBUG
 #include <debug.h>
 
+FORCEINLINE
+ULONG
+InterlockedReadUlong(
+    _In_ _Interlocked_operand_ ULONG volatile *Source)
+{
+    return *Source;
+}
 
 FORCEINLINE
 void
@@ -126,8 +133,8 @@
 static PVOID gpvGdiHdlTblSection = NULL;
 PENTRY gpentHmgr;
 PULONG gpaulRefCount;
-ULONG gulFirstFree;
-ULONG gulFirstUnused;
+volatile ULONG gulFirstFree;
+volatile ULONG gulFirstUnused;
 static PPAGED_LOOKASIDE_LIST gpaLookasideList;
 
 static VOID NTAPI GDIOBJ_vCleanup(PVOID ObjectBody);
@@ -293,6 +300,7 @@
 
     Status = PsLookupProcessByProcessId(ULongToHandle(ulProcessId), &pep);
     NT_ASSERT(NT_SUCCESS(Status));
+    __analysis_assume(NT_SUCCESS(Status));
 
     ppi = PsGetProcessWin32Process(pep);
     if (ppi) InterlockedIncrement((LONG*)&ppi->GDIHandleCount);
@@ -309,6 +317,7 @@
 
     Status = PsLookupProcessByProcessId(ULongToHandle(ulProcessId), &pep);
     NT_ASSERT(NT_SUCCESS(Status));
+    __analysis_assume(NT_SUCCESS(Status));
 
     ppi = PsGetProcessWin32Process(pep);
     if (ppi) InterlockedDecrement((LONG*)&ppi->GDIHandleCount);
@@ -327,7 +336,7 @@
     do
     {
         /* Get the index and sequence number of the first free entry */
-        iFirst = gulFirstFree;
+        iFirst = InterlockedReadUlong(&gulFirstFree);
 
         /* Check if we have a free entry */
         if (!(iFirst & GDI_HANDLE_INDEX_MASK))
@@ -395,7 +404,7 @@
     do
     {
         /* Get the current first free index and sequence number */
-        iFirst = gulFirstFree;
+        iFirst = InterlockedReadUlong(&gulFirstFree);
 
         /* Set the einfo.pobj member to the index of the first free entry */
         pentFree->einfo.pobj = UlongToPtr(iFirst & GDI_HANDLE_INDEX_MASK);

Modified: trunk/reactos/win32ss/gdi/ntgdi/region.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/region.c…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/region.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/region.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -2288,7 +2288,7 @@
 static
 VOID
 REGION_vSyncRegion(
-    PREGION prgn)
+    _In_ PREGION prgn)
 {
     PRGN_ATTR prgnattr;
 
@@ -3997,11 +3997,12 @@
     return bResult;
 }
 
+__kernel_entry
 BOOL
 APIENTRY
 NtGdiRectInRegion(
     _In_ HRGN hrgn,
-    _In_ LPRECT prclUnsafe)
+    _Inout_ LPRECT prclUnsafe)
 {
     RECTL rcTemp;
 
@@ -4059,12 +4060,13 @@
  * If the function fails, the return value is zero."
  */
 _Success_(return!=0)
+__kernel_entry
 ULONG
 APIENTRY
 NtGdiGetRegionData(
     _In_ HRGN hrgn,
     _In_ ULONG cjBuffer,
-    _Out_opt_bytecap_(cjBuffer) LPRGNDATA lpRgnData)
+    _Out_writes_bytes_to_opt_(cjBuffer, return) LPRGNDATA lpRgnData)
 {
     ULONG cjRects, cjSize;
     PREGION prgn;

Modified: trunk/reactos/win32ss/gdi/ntgdi/region.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/region.h…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/region.h	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/region.h	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -9,7 +9,7 @@
   /* Header for all gdi objects in the handle table.
      Do not (re)move this. */
   BASEOBJECT BaseObject;
-  PRGN_ATTR prgnattr;
+  _Notnull_ PRGN_ATTR prgnattr;
   RGN_ATTR rgnattr;
 
   RGNDATAHEADER rdh;
@@ -101,4 +101,8 @@
 IntSysCreateRectpRgn(INT LeftRect, INT TopRect, INT RightRect, INT BottomRect);
 
 // FIXME: move this
-BOOL FASTCALL IntGdiPaintRgn(PDC, PREGION );
+BOOL
+FASTCALL
+IntGdiPaintRgn(
+    _In_ PDC pdc,
+    _In_ PREGION prgn);

Modified: trunk/reactos/win32ss/gdi/ntgdi/wingl.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/wingl.c?…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/wingl.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/wingl.c	[iso-8859-1] Tue Mar 10 00:11:29 2015
@@ -39,13 +39,14 @@
 }
 
 _Success_(return != 0)
+__kernel_entry
 INT
 APIENTRY
 NtGdiDescribePixelFormat(
     _In_ HDC hdc,
     _In_ INT ipfd,
     _In_ UINT cjpfd,
-    _When_(cjpfd != 0, _Out_) PPIXELFORMATDESCRIPTOR ppfd)
+    _Out_writes_bytes_(cjpfd) PPIXELFORMATDESCRIPTOR ppfd)
 {
     PDC pdc;
     PPDEVOBJ ppdev;