Author: tkreuzer Date: Wed Dec 19 22:01:54 2012 New Revision: 57952
URL: http://svn.reactos.org/svn/reactos?rev=57952&view=rev Log: [WIN32K] Fix a bug caused by r57948
Modified: trunk/reactos/win32ss/gdi/ntgdi/region.c
Modified: trunk/reactos/win32ss/gdi/ntgdi/region.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/region.c?... ============================================================================== --- trunk/reactos/win32ss/gdi/ntgdi/region.c [iso-8859-1] (original) +++ trunk/reactos/win32ss/gdi/ntgdi/region.c [iso-8859-1] Wed Dec 19 22:01:54 2012 @@ -3996,7 +3996,7 @@ _In_ ULONG cjBuffer, _Out_opt_bytecap_(cjBuffer) LPRGNDATA lpRgnData) { - ULONG cjSize; + ULONG cjRects, cjSize; PREGION prgn;
/* Lock the region */ @@ -4007,8 +4007,9 @@ return 0; }
- /* Calculate the region size */ - cjSize = prgn->rdh.nCount * sizeof(RECT) + sizeof(RGNDATAHEADER); + /* Calculate the region sizes */ + cjRects = prgn->rdh.nCount * sizeof(RECT); + cjSize = cjRects + sizeof(RGNDATAHEADER);
/* Check if region data is requested */ if (lpRgnData) @@ -4021,7 +4022,7 @@ { ProbeForWrite(lpRgnData, cjSize, sizeof(ULONG)); RtlCopyMemory(lpRgnData, &prgn->rdh, sizeof(RGNDATAHEADER)); - RtlCopyMemory(lpRgnData->Buffer, prgn->Buffer, cjSize); + RtlCopyMemory(lpRgnData->Buffer, prgn->Buffer, cjRects); } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {