[khornicek] 62684: [DESK] - fix a bunch of buffer overruns, negative array index accesses and uninitialized variables CID #1102296 CID #501468 CID #716755 CID #716756 CID #1102323
7 Apr
2014
7 Apr
'14
11:36 p.m.
Author: khornicek
Date: Mon Apr 7 23:36:39 2014
New Revision: 62684
URL: http://svn.reactos.org/svn/reactos?rev=62684&view=rev
Log:
[DESK]
- fix a bunch of buffer overruns, negative array index accesses and uninitialized
variables
CID #1102296
CID #501468
CID #716755
CID #716756
CID #1102323
Modified:
trunk/reactos/dll/cpl/desk/advappdlg.c
trunk/reactos/dll/cpl/desk/draw.c
trunk/reactos/dll/cpl/desk/general.c
trunk/reactos/dll/cpl/desk/screensaver.c
Modified: trunk/reactos/dll/cpl/desk/advappdlg.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/cpl/desk/advappdlg.c?r…
==============================================================================
--- trunk/reactos/dll/cpl/desk/advappdlg.c [iso-8859-1] (original)
+++ trunk/reactos/dll/cpl/desk/advappdlg.c [iso-8859-1] Mon Apr 7 23:36:39 2014
@@ -275,7 +275,7 @@
plfFont->lfHeight = -MulDiv(GetDlgItemInt(hwndDlg,
IDC_ADVAPPEARANCE_FONTSIZE_E, &bTranslated, FALSE), GetDeviceCaps(hdcDlg, LOGPIXELSY),
72);
plfFont->lfWeight = (SendDlgItemMessage(hwndDlg, IDC_ADVAPPEARANCE_FONTBOLD,
BM_GETCHECK, 0, 0) == 1) ? FW_BOLD : FW_NORMAL;
plfFont->lfItalic = (BYTE)SendDlgItemMessage(hwndDlg,
IDC_ADVAPPEARANCE_FONTITALIC, BM_GETCHECK, 0, 0);
- GetDlgItemText(hwndDlg, IDC_ADVAPPEARANCE_FONT_C, plfFont->lfFaceName,
LF_FACESIZE * sizeof(TCHAR));
+ GetDlgItemText(hwndDlg, IDC_ADVAPPEARANCE_FONT_C, plfFont->lfFaceName,
LF_FACESIZE);
}
ReleaseDC(hwndDlg, hdcDlg);
Modified: trunk/reactos/dll/cpl/desk/draw.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/cpl/desk/draw.c?rev=62…
==============================================================================
--- trunk/reactos/dll/cpl/desk/draw.c [iso-8859-1] (original)
+++ trunk/reactos/dll/cpl/desk/draw.c [iso-8859-1] Mon Apr 7 23:36:39 2014
@@ -69,6 +69,8 @@
int LTpenplus = 0;
int RTpenplus = 0;
int RBpenplus = 0;
+ HBRUSH hbr;
+
/* Init some vars */
LTInnerPen = LTOuterPen = RBInnerPen = RBOuterPen = (HPEN)GetStockObject(NULL_PEN);
SavePen = (HPEN)SelectObject(hdc, LTInnerPen);
@@ -88,76 +90,84 @@
if((uFlags & BF_TOPLEFT) == BF_TOPLEFT)
LTpenplus = 1;
+ if((uFlags & MY_BF_ACTIVEBORDER))
+ hbr = CreateSolidBrush(scheme->crColor[COLOR_ACTIVEBORDER]);
+ else
+ hbr = CreateSolidBrush(scheme->crColor[COLOR_BTNFACE]);
+
+ FillRect(hdc, &InnerRect, hbr);
+ DeleteObject(hbr);
+
+ MoveToEx(hdc, 0, 0, &SavePoint);
+
+ /* Draw the outer edge */
+ if(LTOuterI != -1)
+ {
+ LTOuterPen = GetStockObject(DC_PEN);
+ SelectObject(hdc, LTOuterPen);
+ SetDCPenColor(hdc, scheme->crColor[LTOuterI]);
+ if(uFlags & BF_TOP)
+ {
+ MoveToEx(hdc, InnerRect.left, InnerRect.top, NULL);
+ LineTo(hdc, InnerRect.right, InnerRect.top);
+ }
+ if(uFlags & BF_LEFT)
+ {
+ MoveToEx(hdc, InnerRect.left, InnerRect.top, NULL);
+ LineTo(hdc, InnerRect.left, InnerRect.bottom);
+ }
+ }
+
+ if(RBOuterI != -1)
+ {
+ RBOuterPen = GetStockObject(DC_PEN);
+ SelectObject(hdc, RBOuterPen);
+ SetDCPenColor(hdc, scheme->crColor[RBOuterI]);
+ if(uFlags & BF_BOTTOM)
+ {
+ MoveToEx(hdc, InnerRect.left, InnerRect.bottom-1, NULL);
+ LineTo(hdc, InnerRect.right, InnerRect.bottom-1);
+ }
+ if(uFlags & BF_RIGHT)
+ {
+ MoveToEx(hdc, InnerRect.right-1, InnerRect.top, NULL);
+ LineTo(hdc, InnerRect.right-1, InnerRect.bottom);
+ }
+ }
+
+ /* Draw the inner edge */
if(LTInnerI != -1)
+ {
LTInnerPen = GetStockObject(DC_PEN);
- if(LTOuterI != -1)
- LTOuterPen = GetStockObject(DC_PEN);
+ SelectObject(hdc, LTInnerPen);
+ SetDCPenColor(hdc, scheme->crColor[LTInnerI]);
+ if(uFlags & BF_TOP)
+ {
+ MoveToEx(hdc, InnerRect.left+LTpenplus, InnerRect.top+1, NULL);
+ LineTo(hdc, InnerRect.right-RTpenplus, InnerRect.top+1);
+ }
+ if(uFlags & BF_LEFT)
+ {
+ MoveToEx(hdc, InnerRect.left+1, InnerRect.top+LTpenplus, NULL);
+ LineTo(hdc, InnerRect.left+1, InnerRect.bottom-LBpenplus);
+ }
+ }
+
if(RBInnerI != -1)
+ {
RBInnerPen = GetStockObject(DC_PEN);
- if(RBOuterI != -1)
- RBOuterPen = GetStockObject(DC_PEN);
- {
- HBRUSH hbr;
-
- if((uFlags & MY_BF_ACTIVEBORDER))
- hbr = CreateSolidBrush(scheme->crColor[COLOR_ACTIVEBORDER]);
- else
- hbr = CreateSolidBrush(scheme->crColor[COLOR_BTNFACE]);
- FillRect(hdc, &InnerRect, hbr);
- DeleteObject(hbr);
- }
- MoveToEx(hdc, 0, 0, &SavePoint);
-
- /* Draw the outer edge */
- SelectObject(hdc, LTOuterPen);
- SetDCPenColor(hdc, scheme->crColor[LTOuterI]);
- if(uFlags & BF_TOP)
- {
- MoveToEx(hdc, InnerRect.left, InnerRect.top, NULL);
- LineTo(hdc, InnerRect.right, InnerRect.top);
- }
- if(uFlags & BF_LEFT)
- {
- MoveToEx(hdc, InnerRect.left, InnerRect.top, NULL);
- LineTo(hdc, InnerRect.left, InnerRect.bottom);
- }
- SelectObject(hdc, RBOuterPen);
- SetDCPenColor(hdc, scheme->crColor[RBOuterI]);
- if(uFlags & BF_BOTTOM)
- {
- MoveToEx(hdc, InnerRect.left, InnerRect.bottom-1, NULL);
- LineTo(hdc, InnerRect.right, InnerRect.bottom-1);
- }
- if(uFlags & BF_RIGHT)
- {
- MoveToEx(hdc, InnerRect.right-1, InnerRect.top, NULL);
- LineTo(hdc, InnerRect.right-1, InnerRect.bottom);
- }
-
- /* Draw the inner edge */
- SelectObject(hdc, LTInnerPen);
- SetDCPenColor(hdc, scheme->crColor[LTInnerI]);
- if(uFlags & BF_TOP)
- {
- MoveToEx(hdc, InnerRect.left+LTpenplus, InnerRect.top+1, NULL);
- LineTo(hdc, InnerRect.right-RTpenplus, InnerRect.top+1);
- }
- if(uFlags & BF_LEFT)
- {
- MoveToEx(hdc, InnerRect.left+1, InnerRect.top+LTpenplus, NULL);
- LineTo(hdc, InnerRect.left+1, InnerRect.bottom-LBpenplus);
- }
- SelectObject(hdc, RBInnerPen);
- SetDCPenColor(hdc, scheme->crColor[RBInnerI]);
- if(uFlags & BF_BOTTOM)
- {
- MoveToEx(hdc, InnerRect.left+LBpenplus, InnerRect.bottom-2, NULL);
- LineTo(hdc, InnerRect.right-RBpenplus, InnerRect.bottom-2);
- }
- if(uFlags & BF_RIGHT)
- {
- MoveToEx(hdc, InnerRect.right-2, InnerRect.top+RTpenplus, NULL);
- LineTo(hdc, InnerRect.right-2, InnerRect.bottom-RBpenplus);
+ SelectObject(hdc, RBInnerPen);
+ SetDCPenColor(hdc, scheme->crColor[RBInnerI]);
+ if(uFlags & BF_BOTTOM)
+ {
+ MoveToEx(hdc, InnerRect.left+LBpenplus, InnerRect.bottom-2, NULL);
+ LineTo(hdc, InnerRect.right-RBpenplus, InnerRect.bottom-2);
+ }
+ if(uFlags & BF_RIGHT)
+ {
+ MoveToEx(hdc, InnerRect.right-2, InnerRect.top+RTpenplus, NULL);
+ LineTo(hdc, InnerRect.right-2, InnerRect.bottom-RBpenplus);
+ }
}
if (uFlags & BF_ADJUST)
@@ -245,6 +255,8 @@
case DFCS_CAPTIONRESTORE:
Symbol = '2';
break;
+ default:
+ return FALSE;
}
MyIntDrawRectEdge(dc, r, (uFlags & DFCS_PUSHED) ? EDGE_SUNKEN : EDGE_RAISED,
BF_RECT | BF_MIDDLE | BF_SOFT, scheme);
ZeroMemory(&lf, sizeof(LOGFONT));
@@ -313,6 +325,9 @@
case DFCS_SCROLLRIGHT:
Symbol = '4';
break;
+
+ default:
+ return FALSE;
}
MyIntDrawRectEdge(dc, r, (uFlags & DFCS_PUSHED) ? EDGE_SUNKEN : EDGE_RAISED,
(uFlags&DFCS_FLAT) | BF_MIDDLE | BF_RECT, scheme);
ZeroMemory(&lf, sizeof(LOGFONT));
Modified: trunk/reactos/dll/cpl/desk/general.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/cpl/desk/general.c?rev…
==============================================================================
--- trunk/reactos/dll/cpl/desk/general.c [iso-8859-1] (original)
+++ trunk/reactos/dll/cpl/desk/general.c [iso-8859-1] Mon Apr 7 23:36:39 2014
@@ -33,7 +33,7 @@
TCHAR Buffer[LINE_LEN];
TCHAR Desc[LINE_LEN];
- if (SetupGetStringField(&Context, 0, Buffer, sizeof(Buffer), NULL)
&&
+ if (SetupGetStringField(&Context, 0, Buffer, sizeof(Buffer) /
sizeof(TCHAR), NULL) &&
SetupGetIntField(&Context, 1, &ci))
{
_stprintf(Desc, _T("%s (%d DPI)"), Buffer, ci);
Modified: trunk/reactos/dll/cpl/desk/screensaver.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/cpl/desk/screensaver.c…
==============================================================================
--- trunk/reactos/dll/cpl/desk/screensaver.c [iso-8859-1] (original)
+++ trunk/reactos/dll/cpl/desk/screensaver.c [iso-8859-1] Mon Apr 7 23:36:39 2014
@@ -340,7 +340,6 @@
ScreenSaverCount = pData->ScreenSaverCount;
-
hr = StringCbCopy(szSearchPath, sizeof(szSearchPath), pszSearchPath);
if (FAILED(hr))
return;
3819
days inactive
3819
days old
0 comments
1 participants
participants (1)
-
khornicek＠svn.reactos.org