Hugh Bellamy : gdiplus: Fix validation of HatchStyle in GdipCreateHatchBrush.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: e0601829e1093c6ba6e42004f5270817a6d90a3e
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=e0601829e1093c6ba6e42004f5...

Author: Hugh Bellamy <hughbellars(a)gmail.com>
Date:   Sun Sep 17 11:46:56 2017 +0100

gdiplus: Fix validation of HatchStyle in GdipCreateHatchBrush.

Signed-off-by: Hugh Bellamy <hughbellars(a)gmail.com>
Signed-off-by: Vincent Povirk <vincent(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/gdiplus/brush.c       |  3 +++
 dlls/gdiplus/tests/brush.c | 28 ++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/dlls/gdiplus/brush.c b/dlls/gdiplus/brush.c
index 201fadf..6db4ada 100644
--- a/dlls/gdiplus/brush.c
+++ b/dlls/gdiplus/brush.c
@@ -250,6 +250,9 @@ GpStatus WINGDIPAPI GdipCreateHatchBrush(HatchStyle hatchstyle, ARGB forecol, AR
 
     if(!brush)  return InvalidParameter;
 
+    if(hatchstyle < HatchStyleMin || hatchstyle > HatchStyleMax)
+        return InvalidParameter;
+
     *brush = heap_alloc_zero(sizeof(GpHatch));
     if (!*brush) return OutOfMemory;
 
diff --git a/dlls/gdiplus/tests/brush.c b/dlls/gdiplus/tests/brush.c
index 045d5e5..e002a6f 100644
--- a/dlls/gdiplus/tests/brush.c
+++ b/dlls/gdiplus/tests/brush.c
@@ -45,6 +45,33 @@ static void test_constructor_destructor(void)
     expect(Ok, status);
 }
 
+static void test_createHatchBrush(void)
+{
+    GpStatus status;
+    GpHatch *brush;
+
+    status = GdipCreateHatchBrush(HatchStyleMin, 1, 2, &brush);
+    expect(Ok, status);
+    ok(brush != NULL, "Expected the brush to be initialized.");
+
+    GdipDeleteBrush((GpBrush *)brush);
+
+    status = GdipCreateHatchBrush(HatchStyleMax, 1, 2, &brush);
+    expect(Ok, status);
+    ok(brush != NULL, "Expected the brush to be initialized.");
+
+    GdipDeleteBrush((GpBrush *)brush);
+
+    status = GdipCreateHatchBrush(HatchStyle05Percent, 1, 2, NULL);
+    expect(InvalidParameter, status);
+
+    status = GdipCreateHatchBrush((HatchStyle)(HatchStyleMin - 1), 1, 2, &brush);
+    expect(InvalidParameter, status);
+
+    status = GdipCreateHatchBrush((HatchStyle)(HatchStyleMax + 1), 1, 2, &brush);
+    expect(InvalidParameter, status);
+}
+
 static void test_type(void)
 {
     GpStatus status;
@@ -1563,6 +1590,7 @@ START_TEST(brush)
     GdiplusStartup(&gdiplusToken, &gdiplusStartupInput, NULL);
 
     test_constructor_destructor();
+    test_createHatchBrush();
     test_type();
     test_gradientblendcount();
     test_getblend();