From: Bartosz Kosiorek <gang65@poczta.onet.pl> --- dlls/gdi32/objects.c | 2 +- dlls/gdi32/tests/clipping.c | 4 ---- dlls/win32u/region.c | 3 ++- 3 files changed, 3 insertions(+), 6 deletions(-) diff --git a/dlls/gdi32/objects.c b/dlls/gdi32/objects.c index f2b353cff27..12eaddcd623 100644 --- a/dlls/gdi32/objects.c +++ b/dlls/gdi32/objects.c @@ -642,7 +642,7 @@ HBITMAP WINAPI CreateDiscardableBitmap( HDC hdc, INT width, INT height ) */ HRGN WINAPI ExtCreateRegion( const XFORM *xform, DWORD count, const RGNDATA *data ) { - if (!data) + if (!data || count < sizeof(RGNDATAHEADER)) { SetLastError( ERROR_INVALID_PARAMETER ); return 0; diff --git a/dlls/gdi32/tests/clipping.c b/dlls/gdi32/tests/clipping.c index ce66f9cad09..a44fdbf5441 100644 --- a/dlls/gdi32/tests/clipping.c +++ b/dlls/gdi32/tests/clipping.c @@ -225,9 +225,7 @@ static void test_ExtCreateRegion(void) /* Cannot be smaller than sizeof(RGNDATAHEADER) */ SetLastError(0xdeadbeef); hrgn = ExtCreateRegion(NULL, sizeof(RGNDATAHEADER) - 1, &rgn.data); - todo_wine ok(!hrgn, "ExtCreateRegion should fail\n"); - todo_wine ok(GetLastError() == ERROR_INVALID_PARAMETER || broken(GetLastError() == 0xdeadbeef), "0xdeadbeef, got %lu\n", GetLastError()); @@ -267,10 +265,8 @@ static void test_ExtCreateRegion(void) /* Buffer cannot be smaller than sizeof(RGNDATAHEADER) + 2 * sizeof(RECT) */ SetLastError(0xdeadbeef); hrgn = ExtCreateRegion(NULL, sizeof(RGNDATAHEADER) + 2 * sizeof(RECT) - 1, &rgn.data); - todo_wine ok(!hrgn, "ExtCreateRegion should fail\n"); ok(GetLastError() == 0xdeadbeef, "0xdeadbeef, got %lu\n", GetLastError()); - } static void test_GetClipRgn(void) diff --git a/dlls/win32u/region.c b/dlls/win32u/region.c index 35ef4a22256..3c1a8bc0953 100644 --- a/dlls/win32u/region.c +++ b/dlls/win32u/region.c @@ -896,7 +896,8 @@ HRGN WINAPI NtGdiExtCreateRegion( const XFORM *xform, DWORD count, const RGNDATA WINEREGION *obj; const RECT *pCurRect, *pEndRect; - if (!rgndata || rgndata->rdh.dwSize < sizeof(RGNDATAHEADER)) + if (!rgndata || rgndata->rdh.dwSize < sizeof(RGNDATAHEADER) || + count < sizeof(RGNDATAHEADER) + rgndata->rdh.nCount * sizeof(RECT)) return 0; /* XP doesn't care about the type */ -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/10929