[PATCH v4 0/1] MR10929: gdi32: Validate count parameter in ExtCreateRegion

[Bartosz Kosiorek (＠gang65)]

--
  v4: gdi32: Validate count parameter in ExtCreateRegion
 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10929

[PATCH v4 1/1] gdi32: Validate count parameter in ExtCreateRegion

[Bartosz Kosiorek]

From: Bartosz Kosiorek <[e-mail]>

---
 dlls/gdi32/tests/clipping.c | 2 --
 dlls/win32u/region.c        | 3 ++-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/dlls/gdi32/tests/clipping.c b/dlls/gdi32/tests/clipping.c
index ce66f9cad09..e91647ea521 100644
--- a/dlls/gdi32/tests/clipping.c
+++ b/dlls/gdi32/tests/clipping.c
@@ -225,7 +225,6 @@ static void test_ExtCreateRegion(void)
     /* Cannot be smaller than sizeof(RGNDATAHEADER) */
     SetLastError(0xdeadbeef);
     hrgn = ExtCreateRegion(NULL, sizeof(RGNDATAHEADER) - 1, &rgn.data);
-    todo_wine
     ok(!hrgn, "ExtCreateRegion should fail\n");
     todo_wine
     ok(GetLastError() == ERROR_INVALID_PARAMETER ||
@@ -267,7 +266,6 @@ static void test_ExtCreateRegion(void)
     /* Buffer cannot be smaller than sizeof(RGNDATAHEADER) + 2 * sizeof(RECT) */
     SetLastError(0xdeadbeef);
     hrgn = ExtCreateRegion(NULL, sizeof(RGNDATAHEADER) + 2 * sizeof(RECT) - 1, &rgn.data);
-    todo_wine
     ok(!hrgn, "ExtCreateRegion should fail\n");
     ok(GetLastError() == 0xdeadbeef, "0xdeadbeef, got %lu\n", GetLastError());
 
diff --git a/dlls/win32u/region.c b/dlls/win32u/region.c
index 35ef4a22256..3c1a8bc0953 100644
--- a/dlls/win32u/region.c
+++ b/dlls/win32u/region.c
@@ -896,7 +896,8 @@ HRGN WINAPI NtGdiExtCreateRegion( const XFORM *xform, DWORD count, const RGNDATA
     WINEREGION *obj;
     const RECT *pCurRect, *pEndRect;
 
-    if (!rgndata || rgndata->rdh.dwSize < sizeof(RGNDATAHEADER))
+    if (!rgndata || rgndata->rdh.dwSize < sizeof(RGNDATAHEADER) ||
+        count < sizeof(RGNDATAHEADER) + rgndata->rdh.nCount * sizeof(RECT))
         return 0;
 
     /* XP doesn't care about the type */
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/10929