Author: tkreuzer Date: Sun May 25 12:59:17 2014 New Revision: 63442
URL: http://svn.reactos.org/svn/reactos?rev=63442&view=rev Log: [WIN32K] Make sure to check for invalid NULL handles before passing them to GDIOBJ_bLockMultipleObjects, which skips NULL handles. This is a design limitation, since otherwise we either need to pass a bitfield of valid handles, or duplicate code in certain functions, where different combinations of dest, source and mask dc are allowed.
Modified: trunk/reactos/win32ss/gdi/ntgdi/bitblt.c
Modified: trunk/reactos/win32ss/gdi/ntgdi/bitblt.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/bitblt.c?... ============================================================================== --- trunk/reactos/win32ss/gdi/ntgdi/bitblt.c [iso-8859-1] (original) +++ trunk/reactos/win32ss/gdi/ntgdi/bitblt.c [iso-8859-1] Sun May 25 12:59:17 2014 @@ -47,6 +47,12 @@ return FALSE; }
+ if ((hDCDest == NULL) || (hDCSrc == NULL)) + { + EngSetLastError(ERROR_INVALID_PARAMETER); + return FALSE; + } + TRACE("Locking DCs\n"); ahDC[0] = hDCDest; ahDC[1] = hDCSrc ; @@ -161,14 +167,14 @@ return NtGdiStretchBlt(hDCDest, XDest, YDest, - Width, + Width, Height, hDCSrc, XSrc, YSrc, Width, Height, - ROP, + ROP, crBackColor);
dwTRop = ROP & ~(NOMIRRORBITMAP|CAPTUREBLT); @@ -212,6 +218,12 @@ ULONG TransparentColor = 0; BOOL Ret = FALSE; EXLATEOBJ exlo; + + if ((hdcDst == NULL) || (hdcSrc == NULL)) + { + EngSetLastError(ERROR_INVALID_PARAMETER); + return FALSE; + }
TRACE("Locking DCs\n"); ahDC[0] = hdcDst;