[jgardou] 64911: [USER32] - Fix LookupIconIdFromDirectoryEx, returning 0 when no matching entry is found. - Fix error handling when opening a cursor file. - Various code beautification here and the...

Author: jgardou
Date: Thu Oct 23 09:32:21 2014
New Revision: 64911

URL: http://svn.reactos.org/svn/reactos?rev=64911&view=rev
Log:
[USER32]
 - Fix LookupIconIdFromDirectoryEx, returning 0 when no matching entry is found.
 - Fix error handling when opening a cursor file.
 - Various code beautification here and there
CORE-7575

Modified:
    trunk/reactos/win32ss/user/user32/windows/cursoricon_new.c

Modified: trunk/reactos/win32ss/user/user32/windows/cursoricon_new.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/user32/window…
==============================================================================
--- trunk/reactos/win32ss/user/user32/windows/cursoricon_new.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/user32/windows/cursoricon_new.c	[iso-8859-1] Thu Oct 23
09:32:21 2014
@@ -393,10 +393,11 @@
     WORD i;
     const CURSORICONFILEDIRENTRY* entry;
 
+    /* Check our file is what it claims to be */
     if ( dwFileSize < sizeof(*dir) )
         return NULL;
 
-    if ( dwFileSize < (sizeof(*dir) +
sizeof(dir->idEntries[0])*(dir->idCount-1)) )
+    if (dwFileSize < (sizeof(*dir) + FIELD_OFFSET(CURSORICONFILEDIR,
idEntries[dir->idCount])))
         return NULL;
 
     /* 
@@ -418,7 +419,8 @@
         fakeEntry = &fakeDir->idEntries[i];
         entry = &dir->idEntries[i];
         /* Take this as an occasion to perform a size check */
-        if((entry->dwDIBOffset + entry->dwDIBSize) > dwFileSize)
+        if ((entry->dwDIBOffset > dwFileSize)
+                || ((entry->dwDIBOffset + entry->dwDIBSize) > dwFileSize))
         {
             ERR("Corrupted icon file?.\n");
             HeapFree(GetProcessHeap(), 0, fakeDir);
@@ -1260,12 +1262,12 @@
     cursorData.rt = (USHORT)((ULONG_PTR)(bIcon ? RT_ICON : RT_CURSOR));
     
     /* Do the dance */
-    if(!CURSORICON_GetCursorDataFromBMI(&cursorData,
(BITMAPINFO*)&bits[entry->dwDIBOffset]))
+    if(!CURSORICON_GetCursorDataFromBMI(&cursorData,
(BITMAPINFO*)(&bits[entry->dwDIBOffset])))
         goto end;
     
     hCurIcon = NtUserxCreateEmptyCurObject(FALSE);
     if(!hCurIcon)
-        goto end_error;
+        goto end;
     
     /* Tell win32k */
     if(!NtUserSetCursorIconData(hCurIcon, NULL, NULL, &cursorData))
@@ -1283,6 +1285,7 @@
     DeleteObject(cursorData.hbmMask);
     if(cursorData.hbmColor) DeleteObject(cursorData.hbmColor);
     if(cursorData.hbmAlpha) DeleteObject(cursorData.hbmAlpha);
+    UnmapViewOfFile(bits);
     
     return NULL;
 }
@@ -2196,7 +2199,7 @@
     
     /* No inferior or equal depth available. Get the smallest bigger one */
     BitCount = 0xFFFF;
-    iIndex = 0;
+    iIndex = -1;
     for(i = 0; i < dir->idCount; i++)
     {
         entry = &dir->idEntries[i];
@@ -2222,8 +2225,10 @@
             BitCount = entry->wBitCount;
         }
     }
-    
-    return dir->idEntries[iIndex].wResId;
+    if (iIndex >= 0)
+        return dir->idEntries[iIndex].wResId;
+    
+    return 0;
 }
 
 HICON WINAPI CreateIcon(