[ros-diffs] [tkreuzer] 56437: [WIN32K] In NtGdiGetPixel check if the requested pixel is inside the boundaries of the surface, and return CLR_INVALID if not.

[tkreuzer]

Author: tkreuzer
Date: Fri Apr 27 10:12:26 2012
New Revision: 56437

URL: http://svn.reactos.org/svn/reactos?rev=56437&view=rev
Log:
[WIN32K]
In NtGdiGetPixel check if the requested pixel is inside the boundaries of the 
surface, and return CLR_INVALID if not.

Modified:
    trunk/reactos/win32ss/gdi/ntgdi/bitblt.c

Modified: trunk/reactos/win32ss/gdi/ntgdi/bitblt.c
URL: 
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/bitblt.c?rev=56437&r1=56436&r2=56437&view=diff
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/bitblt.c [iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/bitblt.c [iso-8859-1] Fri Apr 27 10:12:26 
2012
@@ -1109,8 +1109,7 @@
     _In_ INT y)
 {
     PDC pdc;
-    ULONG ulRGBColor;
-    BOOL bResult = FALSE;
+    ULONG ulRGBColor = CLR_INVALID;
     POINTL ptlSrc;
     PSURFACE psurfSrc, psurfDest;
 
@@ -1119,7 +1118,7 @@
     if (!pdc)
     {
         EngSetLastError(ERROR_INVALID_HANDLE);
-        return -1;
+        return CLR_INVALID;
     }
 
     /* Check if the DC has no surface (empty mem or info DC) */
@@ -1127,8 +1126,7 @@
     if (psurfSrc == NULL)
     {
         /* Fail! */
-        DC_UnlockDc(pdc);
-        return -1;
+        goto leave;
     }
 
     /* Get the logical coordinates */
@@ -1139,6 +1137,14 @@
     IntLPtoDP(pdc, &ptlSrc, 1);
     ptlSrc.x += pdc->ptlDCOrig.x;
     ptlSrc.y += pdc->ptlDCOrig.y;
+
+    /* Check if the pixel is outside the surface */
+    if ((ptlSrc.x >= psurfSrc->SurfObj.sizlBitmap.cx) ||
+        (ptlSrc.y >= psurfSrc->SurfObj.sizlBitmap.cy))
+    {
+        /* Fail! */
+        goto leave;
+    }
 
     /* Allocate a surface */
     psurfDest = SURFACE_AllocSurface(STYPE_BITMAP, 1, 1, BMF_32BPP);
@@ -1159,12 +1165,12 @@
                                   RGB(0,0,0));
 
             /* Call the copy bits function */
-            bResult = IntEngCopyBits(&psurfDest->SurfObj,
-                                     &psurfSrc->SurfObj,
-                                     NULL,
-                                     &exlo.xlo,
-                                     &rclDest,
-                                     &ptlSrc);
+            EngCopyBits(&psurfDest->SurfObj,
+                        &psurfSrc->SurfObj,
+                        NULL,
+                        &exlo.xlo,
+                        &rclDest,
+                        &ptlSrc);
 
             /* Cleanup the XLATEOBJ */
             EXLATEOBJ_vCleanup(&exlo);
@@ -1174,10 +1180,11 @@
         GDIOBJ_vDeleteObject(&psurfDest->BaseObject);
     }
 
+leave:
     /* Unlock the DC */
     DC_UnlockDc(pdc);
 
     /* Return the new RGB color or -1 on failure */
-    return bResult ? ulRGBColor : -1;
-}
-
+    return ulRGBColor;
+}
+