[ros-diffs] [greatlrd] 25935: NtGdiGetObject 1. fixed one BSD it does show bluescreen when the buffer are too small 2. fixed some bugs in calculation of different GdiObject sized

Author: greatlrd
Date: Thu Mar  1 22:13:29 2007
New Revision: 25935

URL: http://svn.reactos.org/svn/reactos?rev=25935&view=rev
Log:
NtGdiGetObject 
1. fixed one BSD it does show bluescreen when the buffer are too small
2. fixed some bugs in calculation of different GdiObject sized

Modified:
    trunk/reactos/subsystems/win32/win32k/objects/bitmaps.c
    trunk/reactos/subsystems/win32/win32k/objects/brush.c
    trunk/reactos/subsystems/win32/win32k/objects/dc.c
    trunk/reactos/subsystems/win32/win32k/objects/pen.c
    trunk/reactos/subsystems/win32/win32k/objects/text.c

Modified: trunk/reactos/subsystems/win32/win32k/objects/bitmaps.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/ob…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/objects/bitmaps.c (original)
+++ trunk/reactos/subsystems/win32/win32k/objects/bitmaps.c Thu Mar  1 22:13:29 2007
@@ -1559,29 +1559,29 @@
 }
 
 INT STDCALL
-BITMAP_GetObject(BITMAPOBJ * bmp, INT count, LPVOID buffer)
-{
-	if( !buffer ) return sizeof(BITMAP);
-    if (count < sizeof(BITMAP)) return 0;
+BITMAP_GetObject(BITMAPOBJ * bmp, INT Count, LPVOID buffer)
+{
+	if( buffer == NULL ) return sizeof(BITMAP);
+	if (Count < sizeof(BITMAP)) return 0;
 
 	if(bmp->dib)
 	{
 
-		if(count < (INT) sizeof(DIBSECTION))
-		{
-			if (count > (INT) sizeof(BITMAP)) count = sizeof(BITMAP);
+		if(Count < (INT) sizeof(DIBSECTION))
+		{
+			if (Count > (INT) sizeof(BITMAP)) Count = sizeof(BITMAP);
 		}
 		else
 		{
-			if (count > (INT) sizeof(DIBSECTION)) count = sizeof(DIBSECTION);
-		}
-		memcpy(buffer, bmp->dib, count);
-		return count;
+			if (Count > (INT) sizeof(DIBSECTION)) Count = sizeof(DIBSECTION);
+		}
+		memcpy(buffer, bmp->dib, Count);
+		return Count;
 	}
 	else
 	{
 		BITMAP Bitmap;
-		if (count > (INT) sizeof(BITMAP)) count = sizeof(BITMAP);
+		if (Count > (INT) sizeof(BITMAP)) Count = sizeof(BITMAP);
 		Bitmap.bmType = 0;
 		Bitmap.bmWidth = bmp->SurfObj.sizlBitmap.cx;
 		Bitmap.bmHeight = bmp->SurfObj.sizlBitmap.cy;
@@ -1590,8 +1590,8 @@
 		Bitmap.bmBitsPixel = BitsPerFormat(bmp->SurfObj.iBitmapFormat);
 		//Bitmap.bmBits = bmp->SurfObj.pvBits;
 		Bitmap.bmBits = NULL; /* not set accoring wine test confirm in win2k */
-		memcpy(buffer, &Bitmap, count);
-		return count;
+		memcpy(buffer, &Bitmap, Count);
+		return Count;
 	}
 }
 /* EOF */

Modified: trunk/reactos/subsystems/win32/win32k/objects/brush.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/ob…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/objects/brush.c (original)
+++ trunk/reactos/subsystems/win32/win32k/objects/brush.c Thu Mar  1 22:13:29 2007
@@ -51,62 +51,62 @@
 
 INT FASTCALL
 BRUSH_GetObject (PGDIBRUSHOBJ BrushObject, INT Count, LPLOGBRUSH Buffer)
-{	
-	if (Buffer)
-	{
-
-		/* Set colour */
-	    Buffer->lbColor =  BrushObject->BrushAttr.lbColor;
-
-		/* set Hatch */
-		if ((BrushObject->flAttrs & GDIBRUSH_IS_HATCH)!=0)
-		{
-			 /* FIXME : is this right value */
-             Buffer->lbHatch = (LONG)BrushObject->hbmPattern;
-		}
-		else
-		{
-			 Buffer->lbHatch = 0;
-		}
-
-		Buffer->lbStyle = 0;
-
-		/* Get the type of style */
-		if ((BrushObject->flAttrs & GDIBRUSH_IS_SOLID)!=0)
-		{
-			Buffer->lbStyle = BS_SOLID;
-		}
-		else if ((BrushObject->flAttrs & GDIBRUSH_IS_NULL)!=0)
-		{
-			Buffer->lbStyle = BS_NULL; // BS_HOLLOW
-		}
-		else if ((BrushObject->flAttrs & GDIBRUSH_IS_HATCH)!=0)
-		{
-			Buffer->lbStyle = BS_HATCHED;
-		}
-		else if ((BrushObject->flAttrs & GDIBRUSH_IS_BITMAP)!=0)
-		{
-			Buffer->lbStyle = BS_PATTERN;
-		}
-		else if ((BrushObject->flAttrs & GDIBRUSH_IS_DIB)!=0)
-		{
-			Buffer->lbStyle = BS_DIBPATTERN; 
-		}
-
-		/* FIXME 
-		else if ((BrushObject->flAttrs & )!=0)
-		{
-			Buffer->lbStyle = BS_INDEXED;
-		}
-		
-		else if ((BrushObject->flAttrs & )!=0)
-		{
-			Buffer->lbStyle = BS_DIBPATTERNPT;
-		}
-		*/
-				        
-	}
-	return sizeof(BRUSHOBJ);
+{
+   if( Buffer == NULL ) return sizeof(BRUSHOBJ);
+   if (Count < sizeof(BRUSHOBJ)) return 0;
+   if (Count > sizeof(BRUSHOBJ)) Count = sizeof(BRUSHOBJ);
+
+   /* Set colour */
+    Buffer->lbColor =  BrushObject->BrushAttr.lbColor;
+
+    /* set Hatch */
+    if ((BrushObject->flAttrs & GDIBRUSH_IS_HATCH)!=0)
+    {
+        /* FIXME : is this right value */
+        Buffer->lbHatch = (LONG)BrushObject->hbmPattern;
+    }
+    else
+    {
+        Buffer->lbHatch = 0;
+    }
+
+    Buffer->lbStyle = 0;
+
+    /* Get the type of style */
+    if ((BrushObject->flAttrs & GDIBRUSH_IS_SOLID)!=0)
+    {
+        Buffer->lbStyle = BS_SOLID;
+    }
+    else if ((BrushObject->flAttrs & GDIBRUSH_IS_NULL)!=0)
+    {
+        Buffer->lbStyle = BS_NULL; // BS_HOLLOW
+    }
+    else if ((BrushObject->flAttrs & GDIBRUSH_IS_HATCH)!=0)
+    {
+        Buffer->lbStyle = BS_HATCHED;
+    }
+    else if ((BrushObject->flAttrs & GDIBRUSH_IS_BITMAP)!=0)
+    {
+        Buffer->lbStyle = BS_PATTERN;
+    }
+    else if ((BrushObject->flAttrs & GDIBRUSH_IS_DIB)!=0)
+    {
+        Buffer->lbStyle = BS_DIBPATTERN; 
+    }
+
+    /* FIXME 
+    else if ((BrushObject->flAttrs & )!=0)
+    {
+        Buffer->lbStyle = BS_INDEXED;
+    }
+    else if ((BrushObject->flAttrs & )!=0)
+    {
+        Buffer->lbStyle = BS_DIBPATTERNPT;
+    }
+    */
+
+    /* FIXME */
+    return sizeof(BRUSHOBJ);
 }
 
 

Modified: trunk/reactos/subsystems/win32/win32k/objects/dc.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/ob…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/objects/dc.c (original)
+++ trunk/reactos/subsystems/win32/win32k/objects/dc.c Thu Mar  1 22:13:29 2007
@@ -1787,23 +1787,23 @@
 INT STDCALL
 NtGdiGetObject(HANDLE handle, INT count, LPVOID buffer)
 {
-  INT Ret;
+  INT Ret = 0;
   LPVOID SafeBuf;
   NTSTATUS Status = STATUS_SUCCESS;
+  INT RetCount = 0;
 
   /* From Wine: GetObject does not SetLastError() on a null object */
-  if (!handle) return 0;
-
-  if (count <= 0)
-  {
-    return 0;
+  if (!handle) return Ret;
+
+  RetCount = IntGdiGetObject(handle, 0, NULL);
+  if ((count <= 0) || (!buffer))
+  {
+    return RetCount;
   }
 
   _SEH_TRY
   {
-    ProbeForWrite(buffer,
-                  count,
-                  1);
+    ProbeForWrite(buffer, count, 1);
   }
   _SEH_HANDLE
   {
@@ -1814,36 +1814,37 @@
   if(!NT_SUCCESS(Status))
   {
     SetLastNtError(Status);
-    return 0;
-  }
-
-  SafeBuf = ExAllocatePoolWithTag(PagedPool, count, TAG_GDIOBJ);
-  if(!SafeBuf)
-  {
-    SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);
-    return 0;
-  }
-
-  Ret = IntGdiGetObject(handle, count, SafeBuf);
-
-  _SEH_TRY
-  {
-    /* pointer already probed! */
-    RtlCopyMemory(buffer,
-                  SafeBuf,
-                  count);
-  }
-  _SEH_HANDLE
-  {
-    Status = _SEH_GetExceptionCode();
-  }
-  _SEH_END;
-
-  ExFreePool(SafeBuf);
-  if(!NT_SUCCESS(Status))
-  {
-    SetLastNtError(Status);
-    return 0;
+    return Ret;
+  }
+
+  if (RetCount >= count)
+  {
+    SafeBuf = ExAllocatePoolWithTag(PagedPool, count, TAG_GDIOBJ);
+    if(!SafeBuf)
+    {
+        SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);
+        return Ret;
+    }
+    Ret = IntGdiGetObject(handle, count, SafeBuf);
+
+    _SEH_TRY
+    {
+        /* pointer already probed! */
+        RtlCopyMemory(buffer, SafeBuf, count);
+    }
+    _SEH_HANDLE
+    {
+        Status = _SEH_GetExceptionCode();
+    }
+    _SEH_END;
+
+    ExFreePool(SafeBuf);
+
+    if(!NT_SUCCESS(Status))
+    {
+        SetLastNtError(Status);
+        return 0;
+    }
   }
 
   return Ret;

Modified: trunk/reactos/subsystems/win32/win32k/objects/pen.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/ob…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/objects/pen.c (original)
+++ trunk/reactos/subsystems/win32/win32k/objects/pen.c Thu Mar  1 22:13:29 2007
@@ -99,6 +99,10 @@
    LOGPEN LogPen;
 
    if( Buffer == NULL ) return sizeof(LOGPEN);
+   if (Count < sizeof(LOGPEN)) return 0;
+   if (Count > sizeof(LOGPEN)) Count = sizeof(LOGPEN);
+
+   if( Buffer == NULL ) return sizeof(LOGPEN);
 
    LogPen.lopnWidth = PenObject->ptPenWidth;
    LogPen.lopnStyle = PenObject->ulPenStyle;   

Modified: trunk/reactos/subsystems/win32/win32k/objects/text.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/ob…
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/objects/text.c (original)
+++ trunk/reactos/subsystems/win32/win32k/objects/text.c Thu Mar  1 22:13:29 2007
@@ -4093,17 +4093,13 @@
 INT FASTCALL
 FontGetObject(PTEXTOBJ Font, INT Count, PVOID Buffer)
 {
-  if (Buffer)
-  {
-     if (Count < sizeof(LOGFONTW))
-     {
-         SetLastWin32Error(ERROR_BUFFER_OVERFLOW);
-         return 0;
-     }
-
-     RtlCopyMemory(Buffer, &Font->logfont, sizeof(LOGFONTW));
-  }
-
+  if( Buffer == NULL ) return sizeof(LOGFONTW);
+
+  /* fixme  SetLastWin32Error(ERROR_BUFFER_OVERFLOW); in count<0*/
+  if (Count < sizeof(LOGFONTW)) return 0;
+  if (Count > sizeof(LOGFONTW)) Count = sizeof(LOGFONTW);
+
+  RtlCopyMemory(Buffer, &Font->logfont, sizeof(LOGFONTW));
   return sizeof(LOGFONTW);
 }