[reactos] 01/01: [WIN32SS][NTGDI] Fix UnsafeSetBitmapBits (#1310)

[Katayama Hirofumi MZ]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=0aa21c3366fff15429449…

commit 0aa21c3366fff15429449a6eacea1547745e93cf
Author:     Katayama Hirofumi MZ <katayama.hirofumi.mz(a)gmail.com>
AuthorDate: Sun Jan 27 15:32:52 2019 +0900
Commit:     GitHub <noreply(a)github.com>
CommitDate: Sun Jan 27 15:32:52 2019 +0900

    [WIN32SS][NTGDI] Fix UnsafeSetBitmapBits (#1310)
    
    CORE-15657
---
 win32ss/gdi/ntgdi/bitmaps.c | 37 +++++++++++++++++++++++++------------
 win32ss/gdi/ntgdi/bitmaps.h |  7 -------
 2 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/win32ss/gdi/ntgdi/bitmaps.c b/win32ss/gdi/ntgdi/bitmaps.c
index e4639d861c..c0c587482a 100644
--- a/win32ss/gdi/ntgdi/bitmaps.c
+++ b/win32ss/gdi/ntgdi/bitmaps.c
@@ -3,7 +3,8 @@
  * PROJECT:          ReactOS kernel
  * PURPOSE:          Bitmap functions
  * FILE:             win32ss/gdi/ntgdi/bitmaps.c
- * PROGRAMER:        Timo Kreuzer <timo.kreuzer(a)reactos.org>
+ * PROGRAMERS:       Timo Kreuzer <timo.kreuzer(a)reactos.org>
+ *                   Katayama Hirofumi MZ <katayama.hirofumi.mz(a)gmail.com>
  */
 
 #include <win32k.h>
@@ -42,7 +43,7 @@ GreSetBitmapOwner(
     return GreSetObjectOwner(hbmp, ulOwner);
 }
 
-BOOL
+LONG
 NTAPI
 UnsafeSetBitmapBits(
     _Inout_ PSURFACE psurf,
@@ -52,34 +53,46 @@ UnsafeSetBitmapBits(
     PUCHAR pjDst;
     const UCHAR *pjSrc;
     LONG lDeltaDst, lDeltaSrc;
-    ULONG nWidth, nHeight, cBitsPixel;
+    ULONG Y, iSrc, iDst, cbSrc, cbDst, nWidth, nHeight, cBitsPixel;
+
     NT_ASSERT(psurf->flags & API_BITMAP);
     NT_ASSERT(psurf->SurfObj.iBitmapFormat <= BMF_32BPP);
 
     nWidth = psurf->SurfObj.sizlBitmap.cx;
-    nHeight = psurf->SurfObj.sizlBitmap.cy;
+    nHeight = labs(psurf->SurfObj.sizlBitmap.cy);
     cBitsPixel = BitsPerFormat(psurf->SurfObj.iBitmapFormat);
 
-    /* Get pointers */
     pjDst = psurf->SurfObj.pvScan0;
     pjSrc = pvBits;
     lDeltaDst = psurf->SurfObj.lDelta;
     lDeltaSrc = WIDTH_BYTES_ALIGN16(nWidth, cBitsPixel);
-    NT_ASSERT(lDeltaSrc <= abs(lDeltaDst));
+    NT_ASSERT(lDeltaSrc <= labs(lDeltaDst));
 
-    /* Make sure the buffer is large enough*/
-    if (cjBits < (lDeltaSrc * nHeight))
-        return FALSE;
+    cbDst = labs(lDeltaDst) * nHeight;
+    cbSrc = lDeltaSrc * nHeight;
+    cjBits = min(cjBits, cbSrc);
 
-    while (nHeight--)
+    iSrc = iDst = 0;
+    for (Y = 0; Y < nHeight; Y++)
     {
+        if (iSrc + lDeltaSrc > cjBits || iDst + labs(lDeltaDst) > cbDst)
+        {
+            LONG lDelta = min(cjBits - iSrc, cbDst - iDst);
+            NT_ASSERT(lDelta >= 0);
+            RtlCopyMemory(pjDst, pjSrc, lDelta);
+            iSrc += lDelta;
+            break;
+        }
+
         /* Copy one line */
-        memcpy(pjDst, pjSrc, lDeltaSrc);
+        RtlCopyMemory(pjDst, pjSrc, lDeltaSrc);
         pjSrc += lDeltaSrc;
         pjDst += lDeltaDst;
+        iSrc += lDeltaSrc;
+        iDst += labs(lDeltaDst);
     }
 
-    return TRUE;
+    return iSrc;
 }
 
 HBITMAP
diff --git a/win32ss/gdi/ntgdi/bitmaps.h b/win32ss/gdi/ntgdi/bitmaps.h
index 2f9ac4d394..56719ab9b1 100644
--- a/win32ss/gdi/ntgdi/bitmaps.h
+++ b/win32ss/gdi/ntgdi/bitmaps.h
@@ -44,13 +44,6 @@ GreCreateDIBitmapInternal(
     IN UINT cjMaxBits,
     IN HANDLE hcmXform);
 
-BOOL
-NTAPI
-UnsafeSetBitmapBits(
-    _Inout_ PSURFACE psurf,
-    _In_ ULONG cjBits,
-    _In_ const VOID *pvBits);
-
 BOOL
 NTAPI
 GreGetBitmapDimension(