[tkreuzer] 66616: [WIN32K] - Pass size in bytes to UnsafeSetBitmapBits from NtGdiCreateBitmap - In NtGdiSetBitmapBits check for stock bitmap and non-API bitmap.

Author: tkreuzer
Date: Sun Mar  8 23:36:36 2015
New Revision: 66616

URL: http://svn.reactos.org/svn/reactos?rev=66616&view=rev
Log:
[WIN32K]
- Pass size in bytes to UnsafeSetBitmapBits from NtGdiCreateBitmap
- In NtGdiSetBitmapBits check for stock bitmap and non-API bitmap.

Modified:
    trunk/reactos/win32ss/gdi/ntgdi/bitmaps.c

Modified: trunk/reactos/win32ss/gdi/ntgdi/bitmaps.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/bitmaps.c...
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/bitmaps.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/bitmaps.c	[iso-8859-1] Sun Mar  8 23:36:36 2015
@@ -53,6 +53,8 @@
     PUCHAR pjDst, pjSrc;
     LONG lDeltaDst, lDeltaSrc;
     ULONG nWidth, nHeight, cBitsPixel;
+    NT_ASSERT(psurf->flags & API_BITMAP);
+    NT_ASSERT(psurf->SurfObj.iBitmapFormat <= BMF_32BPP);

nWidth = psurf->SurfObj.sizlBitmap.cx;
     nHeight = psurf->SurfObj.sizlBitmap.cy;
@@ -63,8 +65,10 @@
     pjSrc = pvBits;
     lDeltaDst = psurf->SurfObj.lDelta;
     lDeltaSrc = WIDTH_BYTES_ALIGN16(nWidth, cBitsPixel);
-
-    if (cjBits && (cjBits < (lDeltaSrc * nHeight)))
+    NT_ASSERT(lDeltaSrc <= abs(lDeltaDst));
+
+    /* Make sure the buffer is large enough*/
+    if (cjBits < (lDeltaSrc * nHeight))
         return 0;

while (nHeight--)
@@ -227,7 +231,7 @@
         _SEH2_TRY
         {
             ProbeForRead(pUnsafeBits, (SIZE_T)cjSize, 1);
-            UnsafeSetBitmapBits(psurf, 0, pUnsafeBits);
+            UnsafeSetBitmapBits(psurf, cjSize, pUnsafeBits);
         }
         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
         {
@@ -568,10 +572,26 @@
         return 0;
     }

+    if (GDI_HANDLE_IS_STOCKOBJ(hBitmap))
+    {
+        return 0;
+    }
+
     psurf = SURFACE_ShareLockSurface(hBitmap);
     if (psurf == NULL)
     {
         EngSetLastError(ERROR_INVALID_HANDLE);
+        return 0;
+    }
+
+    if (((psurf->flags & API_BITMAP) == 0) ||
+        (psurf->SurfObj.iBitmapFormat > BMF_32BPP))
+    {
+        DPRINT1("Invalid bitmap: iBitmapFormat = %lu, flags = 0x%lx\n",
+                psurf->SurfObj.iBitmapFormat,
+                psurf->flags);
+        EngSetLastError(ERROR_INVALID_HANDLE);
+        SURFACE_ShareUnlockSurface(psurf);
         return 0;
     }