[PATCH 0/1] MR6110: gdi32: Fix out-of-bounds write in EMR_ALPHABLEND handling.

[Esme Povirk (＠madewokherd)]

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=45105

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/6110

[PATCH 1/1] gdi32: Fix out-of-bounds write in EMR_ALPHABLEND handling.

[Esme Povirk]

From: Esme Povirk <esme(a)codeweavers.com>

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=45105
---
 dlls/gdi32/enhmetafile.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/dlls/gdi32/enhmetafile.c b/dlls/gdi32/enhmetafile.c
index 0351d8c462d..0ef26522eb6 100644
--- a/dlls/gdi32/enhmetafile.c
+++ b/dlls/gdi32/enhmetafile.c
@@ -1968,12 +1968,18 @@ BOOL WINAPI PlayEnhMetaFileRecord(
             HBITMAP hBmp = 0, hBmpOld = 0;
             const BITMAPINFO *pbi = (const BITMAPINFO *)((const BYTE *)mr + pAlphaBlend->offBmiSrc);
             void *bits;
+            DIBSECTION dib;
+            DWORD copy_size;
 
             SetGraphicsMode(hdcSrc, GM_ADVANCED);
             SetWorldTransform(hdcSrc, &pAlphaBlend->xformSrc);
 
             hBmp = CreateDIBSection(hdc, pbi, pAlphaBlend->iUsageSrc, &bits, NULL, 0);
-            memcpy(bits, (const BYTE *)mr + pAlphaBlend->offBitsSrc, pAlphaBlend->cbBitsSrc);
+
+            GetObjectW(hBmp, sizeof(dib), &dib);
+            copy_size = min(dib.dsBmih.biSizeImage, pAlphaBlend->cbBitsSrc);
+
+            memcpy(bits, (const BYTE *)mr + pAlphaBlend->offBitsSrc, copy_size);
             hBmpOld = SelectObject(hdcSrc, hBmp);
 
             GdiAlphaBlend(hdc, pAlphaBlend->xDest, pAlphaBlend->yDest, pAlphaBlend->cxDest, pAlphaBlend->cyDest,
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/6110

[PATCH 1/1] gdi32: Fix out-of-bounds write in EMR_ALPHABLEND handling.

[Marvin]

Hi,

It looks like your patch introduced the new failures shown below.
Please investigate and fix them before resubmitting your patch.
If they are not new, fixing them anyway would help a lot. Otherwise
please ask for the known failures list to be updated.

The tests also ran into some preexisting test failures. If you know how
to fix them that would be helpful. See the TestBot job for the details:

The full results can be found at:
https://testbot.winehq.org/JobDetails.pl?Key=147179

Your paranoid android.


=== debian11b (64 bit WoW report) ===

ddraw:
ddraw1.c:3645: Test failed: Expected (0,0)-(640,480), got (-32000,-32000)-(-31840,-31969).

[PATCH 0/1] MR6110: gdi32: Fix out-of-bounds write in EMR_ALPHABLEND handling. - approved

[Huw Davies (＠huw)]

This merge request was approved by Huw Davies.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/6110