[ros-diffs] [navaraf] 16737: Fix some bugs in DIB mapping code to prevent instant system crashes.

Fix some bugs in DIB mapping code to prevent instant system crashes.
Modified: trunk/reactos/subsys/win32k/objects/dib.c
  _____  

Modified: trunk/reactos/subsys/win32k/objects/dib.c
--- trunk/reactos/subsys/win32k/objects/dib.c	2005-07-26 11:00:15 UTC
(rev 16736)
+++ trunk/reactos/subsys/win32k/objects/dib.c	2005-07-26 11:22:48 UTC
(rev 16737)
@@ -175,7 +175,7 @@

   RECTL       DestRect;
   XLATEOBJ   *XlateObj;
   PPALGDI     hDCPalette;
-  //RGBQUAD  *lpRGB;
+  //RGBQUAD    *lpRGB;
   HPALETTE    DDB_Palette, DIB_Palette;
   ULONG       DDB_Palette_Type, DIB_Palette_Type;
   INT         DIBWidth;
@@ -190,7 +190,7 @@
   //if (ColorUse == DIB_PAL_COLORS)
   //  lpRGB = DIB_MapPaletteColors(hDC, bmi);
   //else
-  //  lpRGB = &bmi->bmiColors[0];
+  //  lpRGB = &bmi->bmiColors;
 
   DestSurf = &bitmap->SurfObj;
 
@@ -810,6 +810,7 @@
   UINT Entries = 0;
   BITMAP bm;
   SIZEL Size;
+  RGBQUAD *lpRGB;
 
   DPRINT("format (%ld,%ld), planes %d, bpp %d, size %ld, colors %ld
(%s)\n",
 	bi->biWidth, bi->biHeight, bi->biPlanes, bi->biBitCount,
@@ -846,7 +847,9 @@
   }
 
   if(usage == DIB_PAL_COLORS)
-    memcpy(bmi->bmiColors, (UINT *)DIB_MapPaletteColors(dc, bmi),
sizeof(UINT *));
+    lpRGB = DIB_MapPaletteColors(dc, bmi);
+  else
+    lpRGB = bmi->bmiColors;
 
   // Allocate Memory for DIB and fill structure
   if (bm.bmBits)
@@ -869,9 +872,9 @@
     else switch(bi->biBitCount)
     {
       case 16:
-        dib->dsBitfields[0] = (bi->biCompression == BI_BITFIELDS) ?
*(DWORD *)bmi->bmiColors : 0x7c00;
-        dib->dsBitfields[1] = (bi->biCompression == BI_BITFIELDS) ?
*((DWORD *)bmi->bmiColors + 1) : 0x03e0;
-        dib->dsBitfields[2] = (bi->biCompression == BI_BITFIELDS) ?
*((DWORD *)bmi->bmiColors + 2) : 0x001f;        break;
+        dib->dsBitfields[0] = (bi->biCompression == BI_BITFIELDS) ?
*(DWORD *)lpRGB : 0x7c00;
+        dib->dsBitfields[1] = (bi->biCompression == BI_BITFIELDS) ?
*((DWORD *)lpRGB + 1) : 0x03e0;
+        dib->dsBitfields[2] = (bi->biCompression == BI_BITFIELDS) ?
*((DWORD *)lpRGB + 2) : 0x001f;        break;
 
       case 24:
         dib->dsBitfields[0] = 0xff0000;
@@ -880,9 +883,9 @@
         break;
 
       case 32:
-        dib->dsBitfields[0] = (bi->biCompression == BI_BITFIELDS) ?
*(DWORD *)bmi->bmiColors : 0xff0000;
-        dib->dsBitfields[1] = (bi->biCompression == BI_BITFIELDS) ?
*((DWORD *)bmi->bmiColors + 1) : 0x00ff00;
-        dib->dsBitfields[2] = (bi->biCompression == BI_BITFIELDS) ?
*((DWORD *)bmi->bmiColors + 2) : 0x0000ff;
+        dib->dsBitfields[0] = (bi->biCompression == BI_BITFIELDS) ?
*(DWORD *)lpRGB : 0xff0000;
+        dib->dsBitfields[1] = (bi->biCompression == BI_BITFIELDS) ?
*((DWORD *)lpRGB + 1) : 0x00ff00;
+        dib->dsBitfields[2] = (bi->biCompression == BI_BITFIELDS) ?
*((DWORD *)lpRGB + 2) : 0x0000ff;
         break;
     }
     dib->dshSection = section;
@@ -901,12 +904,20 @@
                           bm.bmBits);
     if (! res)
       {
+        if (lpRGB != bmi->bmiColors)
+          {
+            ExFreePool(lpRGB);
+          }
         SetLastWin32Error(ERROR_NO_SYSTEM_RESOURCES);
 	return NULL;
       }
     bmp = BITMAPOBJ_LockBitmap(res);
     if (NULL == bmp)
       {
+        if (lpRGB != bmi->bmiColors)
+          {
+            ExFreePool(lpRGB);
+          }
 	SetLastWin32Error(ERROR_INVALID_HANDLE);
 	NtGdiDeleteObject(bmp);
 	return NULL;
@@ -921,7 +932,7 @@
     if(bi->biBitCount == 8) { Entries = 256; }
 
     if (Entries)
-      bmp->hDIBPalette = PALETTE_AllocPaletteIndexedRGB(Entries,
bmi->bmiColors);
+      bmp->hDIBPalette = PALETTE_AllocPaletteIndexedRGB(Entries,
lpRGB);
     else
       bmp->hDIBPalette = PALETTE_AllocPalette(PAL_BITFIELDS, 0, NULL,
                                               dib->dsBitfields[0],
@@ -946,6 +957,11 @@
     if (res) { BITMAPOBJ_FreeBitmap(res); res = 0; }
   }
 
+  if (lpRGB != bmi->bmiColors)
+    {
+      ExFreePool(lpRGB);
+    }
+
   if (bmp)
     {
       BITMAPOBJ_UnlockBitmap(bmp);
@@ -1097,6 +1113,12 @@
       return NULL;
     }
 
+  if (palGDI->Mode != PAL_INDEXED)
+    {
+      PALETTE_UnlockPalette(palGDI);
+      return NULL;
+    }
+
   nNumColors = 1 << lpbmi->bmiHeader.biBitCount;
   if (lpbmi->bmiHeader.biClrUsed)
     {