Zebediah Figura : win32u: Do not free user memory when deleting dibs created with NtGdiDdDDICreateDCFromMemory().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 220b0a7c060e71a7a414cd89542769451274e873
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=220b0a7c060e71a7a414cd895...

Author: Zebediah Figura 
Date:   Fri Nov 19 18:30:51 2021 -0600

win32u: Do not free user memory when deleting dibs created with NtGdiDdDDICreateDCFromMemory().

This fixes a test crash in ddraw:ddraw1 introduced by
7d2a7b94aad8a776a2ee3031a18bb3b53d5925cd.

Signed-off-by: Zebediah Figura 
Signed-off-by: Alexandre Julliard

---

dlls/gdi32/tests/bitmap.c |  6 +++---
 dlls/win32u/dib.c         | 20 +++++++++++++++++++-
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/dlls/gdi32/tests/bitmap.c b/dlls/gdi32/tests/bitmap.c
index a244414660b..93793ad7108 100644
--- a/dlls/gdi32/tests/bitmap.c
+++ b/dlls/gdi32/tests/bitmap.c
@@ -5969,11 +5969,11 @@ static void test_D3DKMTCreateDCFromMemory( void )

size = VirtualQuery( alloc_data, &memory_info, sizeof(memory_info) );
     ok(size == sizeof(memory_info), "Got unexpected size %u.\n", size);
-    todo_wine ok(memory_info.State == MEM_COMMIT, "Got state %#x.\n", memory_info.State);
-    todo_wine ok(memory_info.Protect == PAGE_READWRITE, "Got protection %#x.\n", memory_info.Protect);
+    ok(memory_info.State == MEM_COMMIT, "Got state %#x.\n", memory_info.State);
+    ok(memory_info.Protect == PAGE_READWRITE, "Got protection %#x.\n", memory_info.Protect);

ret = VirtualFree( alloc_data, 0, MEM_RELEASE );
-    todo_wine ok(ret, "Failed to free memory, error %u.\n", GetLastError());
+    ok(ret, "Failed to free memory, error %u.\n", GetLastError());
 }

START_TEST(bitmap)
diff --git a/dlls/win32u/dib.c b/dlls/win32u/dib.c
index b27b341d470..ee82d1a8ed8 100644
--- a/dlls/win32u/dib.c
+++ b/dlls/win32u/dib.c
@@ -1574,6 +1574,24 @@ error:
 }

+static BOOL memory_dib_DeleteObject( HGDIOBJ handle )
+{
+    BITMAPOBJ *bmp;
+
+    if (!(bmp = free_gdi_handle( handle ))) return FALSE;
+
+    free( bmp->color_table );
+    free( bmp );
+    return TRUE;
+}
+
+
+static const struct gdi_obj_funcs memory_dib_funcs =
+{
+    .pGetObjectW = DIB_GetObject,
+    .pDeleteObject = memory_dib_DeleteObject,
+};
+
 /***********************************************************************
  *           NtGdiDdDDICreateDCFromMemory    (win32u.@)
  */
@@ -1673,7 +1691,7 @@ NTSTATUS WINAPI NtGdiDdDDICreateDCFromMemory( D3DKMT_CREATEDCFROMMEMORY *desc )
         }
     }

-    if (!(bitmap = alloc_gdi_handle( &bmp->obj, NTGDI_OBJ_BITMAP, &dib_funcs ))) goto error;
+    if (!(bitmap = alloc_gdi_handle( &bmp->obj, NTGDI_OBJ_BITMAP, &memory_dib_funcs ))) goto error;

desc->hDc = dc;
     desc->hBitmap = bitmap;