fixed some uninitialized variables warnings
Modified: trunk/reactos/subsys/win32k/objects/fillshap.c
Modified: trunk/reactos/subsys/win32k/objects/rect.c
Modified: trunk/reactos/subsys/win32k/objects/region.c

Modified: trunk/reactos/subsys/win32k/objects/fillshap.c
--- trunk/reactos/subsys/win32k/objects/fillshap.c	2005-08-06 20:18:59 UTC (rev 17116)
+++ trunk/reactos/subsys/win32k/objects/fillshap.c	2005-08-06 20:23:08 UTC (rev 17117)
@@ -925,7 +925,7 @@
   DC *dc;
   LPPOINT Safept;
   LPINT SafePolyPoints;
-  NTSTATUS Status;
+  NTSTATUS Status = STATUS_SUCCESS;
   BOOL Ret;
 
   dc = DC_LockDc(hDC);

Modified: trunk/reactos/subsys/win32k/objects/rect.c
--- trunk/reactos/subsys/win32k/objects/rect.c	2005-08-06 20:18:59 UTC (rev 17116)
+++ trunk/reactos/subsys/win32k/objects/rect.c	2005-08-06 20:23:08 UTC (rev 17117)
@@ -70,7 +70,7 @@
 BOOL STDCALL
 NtGdiIsEmptyRect(const RECT* UnsafeRect)
 {
-  RECT Rect;
+  RECT Rect = {0};
   NTSTATUS Status = STATUS_SUCCESS;
 
   _SEH_TRY

Modified: trunk/reactos/subsys/win32k/objects/region.c
--- trunk/reactos/subsys/win32k/objects/region.c	2005-08-06 20:18:59 UTC (rev 17116)
+++ trunk/reactos/subsys/win32k/objects/region.c	2005-08-06 20:23:08 UTC (rev 17117)
@@ -2028,7 +2028,7 @@
 STDCALL
 NtGdiCreateEllipticRgnIndirect(CONST PRECT Rect)
 {
-  RECT SafeRect;
+  RECT SafeRect = {0};
   NTSTATUS Status = STATUS_SUCCESS;
 
   _SEH_TRY
@@ -2073,7 +2073,7 @@
 HRGN STDCALL
 NtGdiCreateRectRgnIndirect(CONST PRECT rc)
 {
-  RECT SafeRc;
+  RECT SafeRc = {0};
   NTSTATUS Status = STATUS_SUCCESS;
 
   _SEH_TRY
@@ -3510,8 +3510,9 @@
       ProbeForRead(PolyCounts,
                    Count * sizeof(INT),
                    1);
+      /* just probe one point for now, we don't know the length of the array yet */
       ProbeForRead(pt,
-                   nPoints * sizeof(POINT),
+                   sizeof(POINT),
                    1);
    }
    _SEH_HANDLE
@@ -3593,10 +3594,13 @@
 
    _SEH_TRY
    {
+      ProbeForRead(pt,
+                   nPoints * sizeof(POINT),
+                   1);
       /* pointers were already probed! */
       RtlCopyMemory(Safept,
                     pt,
-                    Count * sizeof(POINT));
+                    nPoints * sizeof(POINT));
    }
    _SEH_HANDLE
    {