[tkreuzer] 70464: [WIN32K] Properly check the bitmap size in IntSetDIBits, taking into account that it might be set to 0, then we have to calculate it ourselves. Fixes a crash when invalid data is ...
Author: tkreuzer Date: Tue Dec 29 20:28:23 2015 New Revision: 70464
URL: http://svn.reactos.org/svn/reactos?rev=70464&view=rev Log: [WIN32K] Properly check the bitmap size in IntSetDIBits, taking into account that it might be set to 0, then we have to calculate it ourselves. Fixes a crash when invalid data is passed to NtGdiCreateDIBitmapInternal. [GDI32] Convert COREINFOHEADER to BITMAPINFOHEADER before passing it to NtGdiCreateDIBitmapInternal, which doesn't support it. CORE-10583 #resolve
Modified: trunk/reactos/win32ss/gdi/gdi32/objects/bitmap.c trunk/reactos/win32ss/gdi/ntgdi/dibobj.c
Modified: trunk/reactos/win32ss/gdi/gdi32/objects/bitmap.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/gdi32/objects/b... ============================================================================== --- trunk/reactos/win32ss/gdi/gdi32/objects/bitmap.c [iso-8859-1] (original) +++ trunk/reactos/win32ss/gdi/gdi32/objects/bitmap.c [iso-8859-1] Tue Dec 29 20:28:23 2015 @@ -408,23 +408,30 @@ // PDC_ATTR pDc_Attr; UINT InfoSize = 0; UINT cjBmpScanSize = 0; - HBITMAP hBmp; + HBITMAP hBmp = NULL; NTSTATUS Status = STATUS_SUCCESS; + PBITMAPINFO pbmiConverted; + UINT cjInfoSize; + + /* Convert the BITMAPINFO if it is a COREINFO */ + pbmiConverted = ConvertBitmapInfo(Data, ColorUse, &cjInfoSize, FALSE);
/* Check for CBM_CREATDIB */ if (Init & CBM_CREATDIB) { /* CBM_CREATDIB needs Data. */ - if (!Data) - { - return 0; + if (pbmiConverted == NULL) + { + DPRINT1("CBM_CREATDIB needs a BITMAINFO!\n"); + goto Exit; }
/* It only works with PAL or RGB */ if (ColorUse > DIB_PAL_COLORS) { + DPRINT1("Invalid ColorUse: %lu\n", ColorUse); GdiSetLastError(ERROR_INVALID_PARAMETER); - return 0; + goto Exit; }
/* Use the header from the data */ @@ -434,38 +441,48 @@ /* Header is required */ if (!Header) { + DPRINT1("Header is NULL\n"); GdiSetLastError(ERROR_INVALID_PARAMETER); - return 0; + goto Exit; }
/* Get the bitmap format and dimensions */ if (DIB_GetBitmapInfo(Header, &width, &height, &planes, &bpp, &compr, &dibsize) == -1) { + DPRINT1("DIB_GetBitmapInfo failed!\n"); GdiSetLastError(ERROR_INVALID_PARAMETER); - return NULL; + goto Exit; }
/* Check if the Compr is incompatible */ if ((compr == BI_JPEG) || (compr == BI_PNG) || (compr == BI_BITFIELDS)) - return 0; + { + DPRINT1("invalid compr: %lu!\n", compr); + goto Exit; + }
/* Only DIB_RGB_COLORS (0), DIB_PAL_COLORS (1) and 2 are valid. */ if (ColorUse > DIB_PAL_COLORS + 1) { + DPRINT1("invalid compr: %lu!\n", compr); GdiSetLastError(ERROR_INVALID_PARAMETER); - return 0; + goto Exit; }
/* If some Bits are given, only DIB_PAL_COLORS and DIB_RGB_COLORS are valid */ if (Bits && (ColorUse > DIB_PAL_COLORS)) { + DPRINT1("Invalid ColorUse: %lu\n", ColorUse); GdiSetLastError(ERROR_INVALID_PARAMETER); - return 0; + goto Exit; }
/* Negative width is not allowed */ if (width < 0) - return 0; + { + DPRINT1("Negative width: %li\n", width); + goto Exit; + }
/* Top-down DIBs have a negative height. */ height = abs(height); @@ -473,13 +490,13 @@ // For Icm support. // GdiGetHandleUserData(hdc, GDI_OBJECT_TYPE_DC, (PVOID)&pDc_Attr))
- if (Data) + if (pbmiConverted) { _SEH2_TRY { - cjBmpScanSize = GdiGetBitmapBitsSize((BITMAPINFO *) Data); - CalculateColorTableSize(&Data->bmiHeader, &ColorUse, &InfoSize); - InfoSize += Data->bmiHeader.biSize; + cjBmpScanSize = GdiGetBitmapBitsSize(pbmiConverted); + CalculateColorTableSize(&pbmiConverted->bmiHeader, &ColorUse, &InfoSize); + InfoSize += pbmiConverted->bmiHeader.biSize; } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { @@ -490,8 +507,9 @@
if (!NT_SUCCESS(Status)) { + DPRINT1("Got an exception!\n"); GdiSetLastError(ERROR_INVALID_PARAMETER); - return NULL; + goto Exit; }
DPRINT("pBMI %p, Size bpp %u, dibsize %d, Conv %u, BSS %u\n", Data, bpp, dibsize, InfoSize, @@ -501,9 +519,18 @@ hBmp = GetStockObject(DEFAULT_BITMAP); else { - hBmp = NtGdiCreateDIBitmapInternal(hDC, width, height, Init, (LPBYTE) Bits, - (LPBITMAPINFO) Data, ColorUse, InfoSize, cjBmpScanSize, 0, 0); - } + hBmp = NtGdiCreateDIBitmapInternal(hDC, width, height, Init, (LPBYTE)Bits, + (LPBITMAPINFO)pbmiConverted, ColorUse, InfoSize, cjBmpScanSize, 0, 0); + } + +Exit: + + /* Cleanup converted BITMAPINFO */ + if ((pbmiConverted != NULL) && (pbmiConverted != Data)) + { + RtlFreeHeap(RtlGetProcessHeap(), 0, pbmiConverted); + } + return hBmp; }
Modified: trunk/reactos/win32ss/gdi/ntgdi/dibobj.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/dibobj.c?... ============================================================================== --- trunk/reactos/win32ss/gdi/ntgdi/dibobj.c [iso-8859-1] (original) +++ trunk/reactos/win32ss/gdi/ntgdi/dibobj.c [iso-8859-1] Tue Dec 29 20:28:23 2015 @@ -259,11 +259,37 @@ POINTL ptSrc; EXLATEOBJ exlo; PPALETTE ppalDIB = 0; + ULONG cjSizeImage;
if (!bmi) return 0;
- if (bmi->bmiHeader.biSizeImage > cjMaxBits) - { + /* Check if the header provided an image size */ + if (bmi->bmiHeader.biSizeImage != 0) + { + /* Use the given size */ + cjSizeImage = bmi->bmiHeader.biSizeImage; + } + /* Otherwise check for uncompressed formats */ + else if ((bmi->bmiHeader.biCompression == BI_RGB) || + (bmi->bmiHeader.biCompression == BI_BITFIELDS)) + { + /* Calculate the image size */ + cjSizeImage = DIB_GetDIBImageBytes(bmi->bmiHeader.biWidth, + ScanLines, + bmi->bmiHeader.biBitCount); + } + else + { + /* Compressed format without a size. This is invalid. */ + DPRINT1("Compressed format without a size!"); + return 0; + } + + /* Check if the size that we have is ok */ + if (cjSizeImage > cjMaxBits) + { + DPRINT1("Size too large! cjSizeImage = %lu, cjMaxBits = %lu\n", + cjSizeImage, cjMaxBits); return 0; }
@@ -273,7 +299,7 @@ BitmapFormat(bmi->bmiHeader.biBitCount, bmi->bmiHeader.biCompression), bmi->bmiHeader.biHeight < 0 ? BMF_TOPDOWN : 0, - bmi->bmiHeader.biSizeImage, + cjSizeImage, (PVOID)Bits, 0); if (!SourceBitmap) @@ -314,6 +340,8 @@ rcDst.right = psurfDst->SurfObj.sizlBitmap.cx; ptSrc.x = 0; ptSrc.y = 0; + + NT_ASSERT(psurfSrc->SurfObj.cjBits <= cjMaxBits);
result = IntEngCopyBits(&psurfDst->SurfObj, &psurfSrc->SurfObj, @@ -1366,7 +1394,11 @@ /* Undocumented flag which creates a DDB of the format specified by the bitmap info. */ handle = IntCreateCompatibleBitmap(Dc, width, height, planes, bpp); if (!handle) + { + DPRINT1("IntCreateCompatibleBitmap() failed!\n"); return NULL; + } + /* The palette must also match the given data */ Surface = SURFACE_ShareLockSurface(handle); ASSERT(Surface); @@ -1430,6 +1462,7 @@ safeBits = ExAllocatePoolWithTag(PagedPool, cjMaxBits, TAG_DIB); if(!safeBits) { + DPRINT1("Failed to allocate %lu bytes\n", cjMaxBits); EngSetLastError(ERROR_NOT_ENOUGH_MEMORY); return NULL; } @@ -1452,6 +1485,7 @@
if(!NT_SUCCESS(Status)) { + DPRINT1("Got an exception! pjInit = %p\n", pjInit); SetLastNtError(Status); goto cleanup; } @@ -1498,6 +1532,7 @@ hdcDest = NtGdiCreateCompatibleDC(0); if(!hdcDest) { + DPRINT1("NtGdiCreateCompatibleDC failed\n"); return NULL; } } @@ -1509,6 +1544,7 @@ Dc = DC_LockDc(hdcDest); if (!Dc) { + DPRINT1("Failed to lock hdcDest %p\n", hdcDest); EngSetLastError(ERROR_INVALID_HANDLE); return NULL; }
-
tkreuzer＠svn.reactos.org