Huw Davies : gdi32: Check that ExtFloodFill()' s initial co-ordinates lie within the dib.

[Alexandre Julliard]

Module: wine
Branch: stable
Commit: 8eef454103e27ac38fbe75653c3e48690df6697d
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=8eef454103e27ac38fbe75653c...

Author: Huw Davies <huw(a)codeweavers.com>
Date:   Thu Sep 29 09:57:47 2016 +0100

gdi32: Check that ExtFloodFill()'s initial co-ordinates lie within the dib.

It might seem more natural to move this check inside is_interior(), but
this would slow down the unclipped case.

Signed-off-by: Huw Davies <huw(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>
(cherry picked from commit 04f8ecd95691b2536cac76663f9864f7caf450fd)
Signed-off-by: Michael Stefaniuc <mstefani(a)winehq.org>

---

 dlls/gdi32/dibdrv/graphics.c | 3 +++
 dlls/gdi32/tests/dib.c       | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/dlls/gdi32/dibdrv/graphics.c b/dlls/gdi32/dibdrv/graphics.c
index 2c865c0..e2d58e8 100644
--- a/dlls/gdi32/dibdrv/graphics.c
+++ b/dlls/gdi32/dibdrv/graphics.c
@@ -982,6 +982,9 @@ BOOL dibdrv_ExtFloodFill( PHYSDEV dev, INT x, INT y, COLORREF color, UINT type )
 
     TRACE( "(%p, %d, %d, %08x, %d)\n", pdev, x, y, color, type );
 
+    if (x < 0 || x >= pdev->dib.rect.right - pdev->dib.rect.left ||
+        y < 0 || y >= pdev->dib.rect.bottom - pdev->dib.rect.top) return FALSE;
+
     if (!is_interior( &pdev->dib, pdev->clip, x, y, pixel, type )) return FALSE;
 
     if (!(rgn = CreateRectRgn( 0, 0, 0, 0 ))) return FALSE;
diff --git a/dlls/gdi32/tests/dib.c b/dlls/gdi32/tests/dib.c
index d12c752..7d8d51b 100644
--- a/dlls/gdi32/tests/dib.c
+++ b/dlls/gdi32/tests/dib.c
@@ -2779,6 +2779,9 @@ static void draw_graphics(HDC hdc, const BITMAPINFO *bmi, BYTE *bits)
 
     ExtSelectClipRgn( hdc, NULL, RGN_COPY );
 
+    ret = ExtFloodFill( hdc, -1, -1, RGB( 0, 0xff, 0 ), FLOODFILLSURFACE );
+    ok (!ret, "got ret %d\n", ret);
+
     SelectObject(hdc, orig_brush);
     SelectObject(hdc, orig_pen);
     DeleteObject(solid_brush);