From: Bartosz Kosiorek <gang65@poczta.onet.pl> --- dlls/gdi32/tests/clipping.c | 2 -- dlls/win32u/region.c | 3 ++- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/dlls/gdi32/tests/clipping.c b/dlls/gdi32/tests/clipping.c index ce66f9cad09..e91647ea521 100644 --- a/dlls/gdi32/tests/clipping.c +++ b/dlls/gdi32/tests/clipping.c @@ -225,7 +225,6 @@ static void test_ExtCreateRegion(void) /* Cannot be smaller than sizeof(RGNDATAHEADER) */ SetLastError(0xdeadbeef); hrgn = ExtCreateRegion(NULL, sizeof(RGNDATAHEADER) - 1, &rgn.data); - todo_wine ok(!hrgn, "ExtCreateRegion should fail\n"); todo_wine ok(GetLastError() == ERROR_INVALID_PARAMETER || @@ -267,7 +266,6 @@ static void test_ExtCreateRegion(void) /* Buffer cannot be smaller than sizeof(RGNDATAHEADER) + 2 * sizeof(RECT) */ SetLastError(0xdeadbeef); hrgn = ExtCreateRegion(NULL, sizeof(RGNDATAHEADER) + 2 * sizeof(RECT) - 1, &rgn.data); - todo_wine ok(!hrgn, "ExtCreateRegion should fail\n"); ok(GetLastError() == 0xdeadbeef, "0xdeadbeef, got %lu\n", GetLastError()); diff --git a/dlls/win32u/region.c b/dlls/win32u/region.c index 35ef4a22256..3c1a8bc0953 100644 --- a/dlls/win32u/region.c +++ b/dlls/win32u/region.c @@ -896,7 +896,8 @@ HRGN WINAPI NtGdiExtCreateRegion( const XFORM *xform, DWORD count, const RGNDATA WINEREGION *obj; const RECT *pCurRect, *pEndRect; - if (!rgndata || rgndata->rdh.dwSize < sizeof(RGNDATAHEADER)) + if (!rgndata || rgndata->rdh.dwSize < sizeof(RGNDATAHEADER) || + count < sizeof(RGNDATAHEADER) + rgndata->rdh.nCount * sizeof(RECT)) return 0; /* XP doesn't care about the type */ -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/10929