[tfaber] 74435: [WIN32K] - Check for null members when cleaning up DCs and brushes. Fixes crashes in some failure cases when running out of GDI handles. CORE-13155

Author: tfaber
Date: Sun Apr 30 18:41:56 2017
New Revision: 74435

URL: http://svn.reactos.org/svn/reactos?rev=74435&view=rev
Log:
[WIN32K]
- Check for null members when cleaning up DCs and brushes. Fixes crashes in some failure
cases when running out of GDI handles.
CORE-13155

Modified:
    trunk/reactos/win32ss/gdi/eng/engbrush.c
    trunk/reactos/win32ss/gdi/ntgdi/dclife.c

Modified: trunk/reactos/win32ss/gdi/eng/engbrush.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/eng/engbrush.c…
==============================================================================
--- trunk/reactos/win32ss/gdi/eng/engbrush.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/eng/engbrush.c	[iso-8859-1] Sun Apr 30 18:41:56 2017
@@ -175,9 +175,18 @@
     }
 
     /* Dereference the palettes */
-    PALETTE_ShareUnlockPalette(pebo->ppalSurf);
-    PALETTE_ShareUnlockPalette(pebo->ppalDC);
-    if (pebo->ppalDIB) PALETTE_ShareUnlockPalette(pebo->ppalDIB);
+    if (pebo->ppalSurf)
+    {
+        PALETTE_ShareUnlockPalette(pebo->ppalSurf);
+    }
+    if (pebo->ppalDC)
+    {
+        PALETTE_ShareUnlockPalette(pebo->ppalDC);
+    }
+    if (pebo->ppalDIB)
+    {
+        PALETTE_ShareUnlockPalette(pebo->ppalDIB);
+    }
 }
 
 VOID

Modified: trunk/reactos/win32ss/gdi/ntgdi/dclife.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/dclife.c…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/dclife.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/dclife.c	[iso-8859-1] Sun Apr 30 18:41:56 2017
@@ -91,7 +91,6 @@
     /* Insert the object */
     if (!GDIOBJ_hInsertObject(&pdc->BaseObject, GDI_OBJ_HMGR_POWNED))
     {
-        /// FIXME: this is broken, since the DC is not initialized yet...
         DPRINT1("Could not insert DC into handle table.\n");
         GDIOBJ_vFreeObject(&pdc->BaseObject);
         return NULL;
@@ -370,7 +369,8 @@
     EBRUSHOBJ_vCleanup(&pdc->eboBackground);
 
     /* Release font */
-    LFONT_ShareUnlockFont(pdc->dclevel.plfnt);
+    if (pdc->dclevel.plfnt)
+        LFONT_ShareUnlockFont(pdc->dclevel.plfnt);
 
     /*  Free regions */
     if (pdc->dclevel.prgnClip)
@@ -394,10 +394,11 @@
        pdc->dclevel.hPath = 0;
        pdc->dclevel.flPath = 0;
     }
-    if(pdc->dclevel.pSurface)
+    if (pdc->dclevel.pSurface)
         SURFACE_ShareUnlockSurface(pdc->dclevel.pSurface);
 
-    PDEVOBJ_vRelease(pdc->ppdev);
+    if (pdc->ppdev)
+        PDEVOBJ_vRelease(pdc->ppdev);
 }
 
 VOID