[tkreuzer] 57952: [WIN32K] Fix a bug caused by r57948

Author: tkreuzer
Date: Wed Dec 19 22:01:54 2012
New Revision: 57952

URL: http://svn.reactos.org/svn/reactos?rev=57952&view=rev
Log:
[WIN32K]
Fix a bug caused by r57948

Modified:
    trunk/reactos/win32ss/gdi/ntgdi/region.c

Modified: trunk/reactos/win32ss/gdi/ntgdi/region.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/region.c…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/region.c [iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/region.c [iso-8859-1] Wed Dec 19 22:01:54 2012
@@ -3996,7 +3996,7 @@
     _In_ ULONG cjBuffer,
     _Out_opt_bytecap_(cjBuffer) LPRGNDATA lpRgnData)
 {
-    ULONG cjSize;
+    ULONG cjRects, cjSize;
     PREGION prgn;
 
     /* Lock the region */
@@ -4007,8 +4007,9 @@
         return 0;
     }
 
-    /* Calculate the region size */
-    cjSize = prgn->rdh.nCount * sizeof(RECT) + sizeof(RGNDATAHEADER);
+    /* Calculate the region sizes */
+    cjRects = prgn->rdh.nCount * sizeof(RECT);
+    cjSize = cjRects + sizeof(RGNDATAHEADER);
 
     /* Check if region data is requested */
     if (lpRgnData)
@@ -4021,7 +4022,7 @@
             {
                 ProbeForWrite(lpRgnData, cjSize, sizeof(ULONG));
                 RtlCopyMemory(lpRgnData, &prgn->rdh, sizeof(RGNDATAHEADER));
-                RtlCopyMemory(lpRgnData->Buffer, prgn->Buffer, cjSize);
+                RtlCopyMemory(lpRgnData->Buffer, prgn->Buffer, cjRects);
             }
             _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
             {