Jinoh Kang : riched20: Don't assume that TxDraw preserves the device context's brush selection.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 2027be7e0370c92595f126a0b0dd167a635d50a2
URL:    https://gitlab.winehq.org/wine/wine/-/commit/2027be7e0370c92595f126a0b0dd167...

Author: Jinoh Kang <jinoh.kang.kr(a)gmail.com>
Date:   Sat Mar  4 22:09:16 2023 +0900

riched20: Don't assume that TxDraw preserves the device context's brush selection.

Today, RichEditWndProc_common assumes that ITextServices::TxDraw
preserves the brush selection of the given device context.  However,
this invariant may be broken by misbehaving embedded OLE objects in the
text document.

Fix this by not assuming that the return value of the second
SelectObject() call equals the brush passed to the first SelectObject()
call in RichEditWndProc_common's WM_PAINT / WM_PRINTCLIENT case.

---

 dlls/riched20/txthost.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/dlls/riched20/txthost.c b/dlls/riched20/txthost.c
index cb008f19c21..ec6f8e52fa5 100644
--- a/dlls/riched20/txthost.c
+++ b/dlls/riched20/txthost.c
@@ -1312,7 +1312,7 @@ static LRESULT RichEditWndProc_common( HWND hwnd, UINT msg, WPARAM wparam,
         HDC hdc;
         RECT rc, client, update;
         PAINTSTRUCT ps;
-        HBRUSH brush = CreateSolidBrush( ITextHost_TxGetSysColor( &host->ITextHost_iface, COLOR_WINDOW ) );
+        HBRUSH brush, old_brush;
 
         ITextHost_TxGetClientRect( &host->ITextHost_iface, &client );
 
@@ -1327,7 +1327,8 @@ static LRESULT RichEditWndProc_common( HWND hwnd, UINT msg, WPARAM wparam,
             update = client;
         }
 
-        brush = SelectObject( hdc, brush );
+        brush = CreateSolidBrush( ITextHost_TxGetSysColor( &host->ITextHost_iface, COLOR_WINDOW ) );
+        old_brush = SelectObject( hdc, brush );
 
         /* Erase area outside of the formatting rectangle */
         if (update.top < client.top)
@@ -1361,7 +1362,8 @@ static LRESULT RichEditWndProc_common( HWND hwnd, UINT msg, WPARAM wparam,
 
         ITextServices_TxDraw( host->text_srv, DVASPECT_CONTENT, 0, NULL, NULL, hdc, NULL, NULL, NULL,
                               &update, NULL, 0, TXTVIEW_ACTIVE );
-        DeleteObject( SelectObject( hdc, brush ) );
+        SelectObject( hdc, old_brush );
+        DeleteObject( brush );
         if (msg == WM_PAINT) EndPaint( hwnd, &ps );
         return 0;
     }