[greatlrd] 33883: Fixed Alphablend crash in win32k

Author: greatlrd
Date: Sat Jun  7 04:43:35 2008
New Revision: 33883

URL: http://svn.reactos.org/svn/reactos?rev=33883&view=rev
Log:
Fixed Alphablend crash in win32k

Modified:
    trunk/reactos/subsystems/win32/win32k/eng/bitblt.c

Modified: trunk/reactos/subsystems/win32/win32k/eng/bitblt.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/subsystems/win32/win32k/eng...
==============================================================================
--- trunk/reactos/subsystems/win32/win32k/eng/bitblt.c [iso-8859-1] (original)
+++ trunk/reactos/subsystems/win32/win32k/eng/bitblt.c [iso-8859-1] Sat Jun  7 04:43:35 2008
@@ -1064,20 +1064,33 @@
            BlendObj->BlendFunction.BlendFlags, BlendObj->BlendFunction.SourceConstantAlpha,
            BlendObj->BlendFunction.AlphaFormat);

+
     /* Validate input */
-    if (DestRect->left >= DestRect->right || DestRect->top >= DestRect->bottom)
-    {
-        DPRINT1("Empty destination rectangle!\n");
+    OutputRect = *DestRect;
+    if (OutputRect.right < OutputRect.left)
+    {
+        OutputRect.left = DestRect->right;
+        OutputRect.right = DestRect->left;
+    }
+    if (OutputRect.bottom < OutputRect.top)
+    {
+        OutputRect.left = DestRect->right;
+        OutputRect.right = DestRect->left;
+    }
+
+
+    /* Validate input */
+
+    InputRect = *SourceRect;
+    if ( (InputRect.top < 0) || (InputRect.bottom < 0) ||
+         (InputRect.left < 0) || (InputRect.right < 0) )
+    {
         return FALSE;
     }
-    if (SourceRect->left >= SourceRect->right || SourceRect->top >= SourceRect->bottom)
-    {
-        DPRINT1("Empty source rectangle!\n");
-        return FALSE;
-    }
+
     if (Dest == Source &&
-            !(DestRect->left >= SourceRect->right || SourceRect->left >= DestRect->right ||
-              DestRect->top >= SourceRect->bottom || SourceRect->top >= DestRect->bottom))
+            !(OutputRect.left >= SourceRect->right || InputRect.left >= OutputRect.right ||
+              OutputRect.top >= SourceRect->bottom || InputRect.top >= OutputRect.bottom))
     {
         DPRINT1("Source and destination rectangles overlap!\n");
         return FALSE;
@@ -1109,11 +1122,11 @@
     }

/* Stretch source if needed */
-    if (DestRect->right - DestRect->left != SourceRect->right - SourceRect->left ||
-            DestRect->bottom - DestRect->top != SourceRect->bottom - SourceRect->top)
-    {
-        SourceStretchedSize.cx = DestRect->right - DestRect->left;
-        SourceStretchedSize.cy = DestRect->bottom - DestRect->top;
+    if (OutputRect.right - OutputRect.left != InputRect.right - InputRect.left ||
+            OutputRect.bottom - OutputRect.top != InputRect.bottom - InputRect.top)
+    {
+        SourceStretchedSize.cx = OutputRect.right - OutputRect.left;
+        SourceStretchedSize.cy = OutputRect.bottom - OutputRect.top;
         Width = DIB_GetDIBWidthBytes(SourceStretchedSize.cx, BitsPerFormat(Source->iBitmapFormat));
         /* FIXME: Maybe it is a good idea to use EngCreateDeviceBitmap and IntEngStretchBlt
                   if possible to get a HW accelerated stretch. */
@@ -1142,7 +1155,7 @@
                               NULL, &SourceStretchedRect, SourceRect, NULL,
                               NULL, NULL, COLORONCOLOR))*/
         if (!EngStretchBlt(SourceStretchedObj, Source, NULL, NULL, NULL,
-                           NULL, NULL, &SourceStretchedRect, SourceRect,
+                           NULL, NULL, &SourceStretchedRect, &InputRect,
                            NULL, COLORONCOLOR))
         {
             DPRINT1("EngStretchBlt failed!\n");
@@ -1151,15 +1164,14 @@
             EngDeleteSurface((HSURF)SourceStretchedBitmap);
             return FALSE;
         }
-        SourceRect = &SourceStretchedRect;
+        InputRect.top = SourceStretchedRect.top;
+        InputRect.bottom = SourceStretchedRect.bottom;
+        InputRect.left = SourceStretchedRect.left;
+        InputRect.right = SourceStretchedRect.right;
         Source = SourceStretchedObj;
     }

/* Now call the DIB function */
-    InputRect.left = SourceRect->left;
-    InputRect.right = SourceRect->right;
-    InputRect.top = SourceRect->top;
-    InputRect.bottom = SourceRect->bottom;
     if (!IntEngEnter(&EnterLeaveSource, Source, &InputRect, TRUE, &Translate, &InputObj))
     {
         if (SourceStretchedObj != NULL)
@@ -1173,15 +1185,11 @@
         }
         return FALSE;
     }
-    InputRect.left = SourceRect->left + Translate.x;
-    InputRect.right = SourceRect->right + Translate.x;
-    InputRect.top = SourceRect->top + Translate.y;
-    InputRect.bottom = SourceRect->bottom + Translate.y;
-
-    OutputRect.left = DestRect->left;
-    OutputRect.right = DestRect->right;
-    OutputRect.top = DestRect->top;
-    OutputRect.bottom = DestRect->bottom;
+    InputRect.left +=  Translate.x;
+    InputRect.right +=  Translate.x;
+    InputRect.top +=  Translate.y;
+    InputRect.bottom +=  Translate.y;
+
     if (!IntEngEnter(&EnterLeaveDest, Dest, &OutputRect, FALSE, &Translate, &OutputObj))
     {
         IntEngLeave(&EnterLeaveSource);
@@ -1196,10 +1204,10 @@
         }
         return FALSE;
     }
-    OutputRect.left = DestRect->left + Translate.x;
-    OutputRect.right = DestRect->right + Translate.x;
-    OutputRect.top = DestRect->top + Translate.y;
-    OutputRect.bottom = DestRect->bottom + Translate.y;
+    OutputRect.left += Translate.x;
+    OutputRect.right += Translate.x;
+    OutputRect.top += Translate.y;
+    OutputRect.bottom += Translate.y;

Ret = FALSE;
     ClippingType = (ClipRegion == NULL) ? DC_TRIVIAL : ClipRegion->iDComplexity;