[tkreuzer] 66225: [WIN32K] Fix ROP2 value coming from user mode before using it.

Author: tkreuzer
Date: Wed Feb 11 21:32:54 2015
New Revision: 66225

URL: http://svn.reactos.org/svn/reactos?rev=66225&view=rev
Log:
[WIN32K]
Fix ROP2 value coming from user mode before using it.

Modified:
    trunk/reactos/win32ss/gdi/ntgdi/bitblt.c
    trunk/reactos/win32ss/gdi/ntgdi/intgdi.h

Modified: trunk/reactos/win32ss/gdi/ntgdi/bitblt.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/bitblt.c?...
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/bitblt.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/bitblt.c	[iso-8859-1] Wed Feb 11 21:32:54 2015
@@ -1150,7 +1150,7 @@
                            &prgnClip->rdh.rcBound );

/* Get the FG rop and create a MIX based on the BK mode */
-    rop2Fg = pdc->pdcattr->jROP2;
+    rop2Fg = FIXUP_ROP2(pdc->pdcattr->jROP2);
     mix = rop2Fg | (pdc->pdcattr->jBkMode == OPAQUE ? rop2Fg : R2_NOP) << 8;

/* Prepare DC for blit */

Modified: trunk/reactos/win32ss/gdi/ntgdi/intgdi.h
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/intgdi.h?...
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/intgdi.h	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/intgdi.h	[iso-8859-1] Wed Feb 11 21:32:54 2015
@@ -4,6 +4,9 @@
 #define ROP_USES_MASK(Rop)    (((Rop) & 0xFF000000) != (((Rop) & 0xff0000) << 8))
 #define FIXUP_ROP(Rop) if(((Rop) & 0xFF000000) == 0) Rop = MAKEROP4((Rop), (Rop))
 #define ROP_TO_ROP4(Rop) ((Rop) >> 16)
+
+/* The range of valid ROP2 values is 1 .. 16 */
+#define FIXUP_ROP2(rop2) ((((rop2) - 1) & 0xF) + 1)

/* Brush functions */