https://git.reactos.org/?p=reactos.git;a=commitdiff;h=0aa21c3366fff15429449a6eacea1547745e93cf
commit 0aa21c3366fff15429449a6eacea1547745e93cf Author: Katayama Hirofumi MZ <[email protected]> AuthorDate: Sun Jan 27 15:32:52 2019 +0900 Commit: GitHub <[email protected]> CommitDate: Sun Jan 27 15:32:52 2019 +0900 [WIN32SS][NTGDI] Fix UnsafeSetBitmapBits (#1310) CORE-15657 --- win32ss/gdi/ntgdi/bitmaps.c | 37 +++++++++++++++++++++++++------------ win32ss/gdi/ntgdi/bitmaps.h | 7 ------- 2 files changed, 25 insertions(+), 19 deletions(-) diff --git a/win32ss/gdi/ntgdi/bitmaps.c b/win32ss/gdi/ntgdi/bitmaps.c index e4639d861c..c0c587482a 100644 --- a/win32ss/gdi/ntgdi/bitmaps.c +++ b/win32ss/gdi/ntgdi/bitmaps.c @@ -3,7 +3,8 @@ * PROJECT: ReactOS kernel * PURPOSE: Bitmap functions * FILE: win32ss/gdi/ntgdi/bitmaps.c - * PROGRAMER: Timo Kreuzer <[email protected]> + * PROGRAMERS: Timo Kreuzer <[email protected]> + * Katayama Hirofumi MZ <[email protected]> */ #include <win32k.h> @@ -42,7 +43,7 @@ GreSetBitmapOwner( return GreSetObjectOwner(hbmp, ulOwner); } -BOOL +LONG NTAPI UnsafeSetBitmapBits( _Inout_ PSURFACE psurf, @@ -52,34 +53,46 @@ UnsafeSetBitmapBits( PUCHAR pjDst; const UCHAR *pjSrc; LONG lDeltaDst, lDeltaSrc; - ULONG nWidth, nHeight, cBitsPixel; + ULONG Y, iSrc, iDst, cbSrc, cbDst, nWidth, nHeight, cBitsPixel; + NT_ASSERT(psurf->flags & API_BITMAP); NT_ASSERT(psurf->SurfObj.iBitmapFormat <= BMF_32BPP); nWidth = psurf->SurfObj.sizlBitmap.cx; - nHeight = psurf->SurfObj.sizlBitmap.cy; + nHeight = labs(psurf->SurfObj.sizlBitmap.cy); cBitsPixel = BitsPerFormat(psurf->SurfObj.iBitmapFormat); - /* Get pointers */ pjDst = psurf->SurfObj.pvScan0; pjSrc = pvBits; lDeltaDst = psurf->SurfObj.lDelta; lDeltaSrc = WIDTH_BYTES_ALIGN16(nWidth, cBitsPixel); - NT_ASSERT(lDeltaSrc <= abs(lDeltaDst)); + NT_ASSERT(lDeltaSrc <= labs(lDeltaDst)); - /* Make sure the buffer is large enough*/ - if (cjBits < (lDeltaSrc * nHeight)) - return FALSE; + cbDst = labs(lDeltaDst) * nHeight; + cbSrc = lDeltaSrc * nHeight; + cjBits = min(cjBits, cbSrc); - while (nHeight--) + iSrc = iDst = 0; + for (Y = 0; Y < nHeight; Y++) { + if (iSrc + lDeltaSrc > cjBits || iDst + labs(lDeltaDst) > cbDst) + { + LONG lDelta = min(cjBits - iSrc, cbDst - iDst); + NT_ASSERT(lDelta >= 0); + RtlCopyMemory(pjDst, pjSrc, lDelta); + iSrc += lDelta; + break; + } + /* Copy one line */ - memcpy(pjDst, pjSrc, lDeltaSrc); + RtlCopyMemory(pjDst, pjSrc, lDeltaSrc); pjSrc += lDeltaSrc; pjDst += lDeltaDst; + iSrc += lDeltaSrc; + iDst += labs(lDeltaDst); } - return TRUE; + return iSrc; } HBITMAP diff --git a/win32ss/gdi/ntgdi/bitmaps.h b/win32ss/gdi/ntgdi/bitmaps.h index 2f9ac4d394..56719ab9b1 100644 --- a/win32ss/gdi/ntgdi/bitmaps.h +++ b/win32ss/gdi/ntgdi/bitmaps.h @@ -44,13 +44,6 @@ GreCreateDIBitmapInternal( IN UINT cjMaxBits, IN HANDLE hcmXform); -BOOL -NTAPI -UnsafeSetBitmapBits( - _Inout_ PSURFACE psurf, - _In_ ULONG cjBits, - _In_ const VOID *pvBits); - BOOL NTAPI GreGetBitmapDimension(
