Sebastian Lackner : user32: Fix invalid argument passed to ExtCreateRegion.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: b43f13f8926b3610db4effeba7f531a8ecc0c2c7
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=b43f13f8926b3610db4effeba7...

Author: Sebastian Lackner 
Date:   Mon Nov  3 06:54:16 2014 +0100

user32: Fix invalid argument passed to ExtCreateRegion.

---

dlls/user32/painting.c | 4 ++--
 dlls/user32/winpos.c   | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/dlls/user32/painting.c b/dlls/user32/painting.c
index 63e09c5..5c1dc69 100644
--- a/dlls/user32/painting.c
+++ b/dlls/user32/painting.c
@@ -139,7 +139,7 @@ static void update_visible_region( struct dce *dce )
                 data->rdh.iType    = RDH_RECTANGLES;
                 data->rdh.nCount   = reply_size / sizeof(RECT);
                 data->rdh.nRgnSize = reply_size;
-                vis_rgn = ExtCreateRegion( NULL, size, data );
+                vis_rgn = ExtCreateRegion( NULL, data->rdh.dwSize + data->rdh.nRgnSize, data );

top_win         = wine_server_ptr_handle( reply->top_win );
                 win_rect.left   = reply->win_rect.left;
@@ -557,7 +557,7 @@ static HRGN get_update_region( HWND hwnd, UINT *flags, HWND *child )
                 data->rdh.iType    = RDH_RECTANGLES;
                 data->rdh.nCount   = reply_size / sizeof(RECT);
                 data->rdh.nRgnSize = reply_size;
-                hrgn = ExtCreateRegion( NULL, size, data );
+                hrgn = ExtCreateRegion( NULL, data->rdh.dwSize + data->rdh.nRgnSize, data );
                 if (child) *child = wine_server_ptr_handle( reply->child );
                 *flags = reply->flags;
             }
diff --git a/dlls/user32/winpos.c b/dlls/user32/winpos.c
index 0a70942..5373733 100644
--- a/dlls/user32/winpos.c
+++ b/dlls/user32/winpos.c
@@ -131,7 +131,7 @@ int WINAPI GetWindowRgn ( HWND hwnd, HRGN hrgn )
                     data->rdh.iType    = RDH_RECTANGLES;
                     data->rdh.nCount   = reply_size / sizeof(RECT);
                     data->rdh.nRgnSize = reply_size;
-                    win_rgn = ExtCreateRegion( NULL, size, data );
+                    win_rgn = ExtCreateRegion( NULL, data->rdh.dwSize + data->rdh.nRgnSize, data );
                 }
             }
             else size = reply->total_size;
@@ -532,7 +532,7 @@ void map_window_region( HWND from, HWND to, HRGN hrgn )
         rect[i].top    += offset.y;
         rect[i].bottom += offset.y;
     }
-    if ((new_rgn = ExtCreateRegion( NULL, data->rdh.nCount, data )))
+    if ((new_rgn = ExtCreateRegion( NULL, data->rdh.dwSize + data->rdh.nRgnSize, data )))
     {
         CombineRgn( hrgn, new_rgn, 0, RGN_COPY );
         DeleteObject( new_rgn );
@@ -2018,7 +2018,7 @@ static void update_surface_region( HWND hwnd )
                     data->rdh.iType    = RDH_RECTANGLES;
                     data->rdh.nCount   = reply_size / sizeof(RECT);
                     data->rdh.nRgnSize = reply_size;
-                    region = ExtCreateRegion( NULL, size, data );
+                    region = ExtCreateRegion( NULL, data->rdh.dwSize + data->rdh.nRgnSize, data );
                     OffsetRgn( region, -reply->visible_rect.left, -reply->visible_rect.top );
                 }
             }