Module: wine Branch: master Commit: 63a9217539b54ee4af5535d8f2e7ca5408d00c7a URL: http://source.winehq.org/git/wine.git/?a=commit;h=63a9217539b54ee4af5535d8f2...
Author: Alexandre Julliard julliard@winehq.org Date: Thu Dec 29 14:05:20 2011 +0100
gdi32: Add checks for invalid color usage values.
---
dlls/gdi32/dib.c | 8 +++++- dlls/gdi32/tests/bitmap.c | 50 +++++++++++++++++++++++++++++++++++++++++++++ dlls/gdi32/tests/brush.c | 11 +++++++++ 3 files changed, 67 insertions(+), 2 deletions(-)
diff --git a/dlls/gdi32/dib.c b/dlls/gdi32/dib.c index d97b30f..b9ffbbe 100644 --- a/dlls/gdi32/dib.c +++ b/dlls/gdi32/dib.c @@ -169,7 +169,7 @@ static BOOL bitmapinfoheader_from_user_bitmapinfo( BITMAPINFOHEADER *dst, const /******************************************************************************************* * Fill out a true BITMAPINFO from a variable sized BITMAPINFO / BITMAPCOREINFO. * - * The resulting stanitized BITMAPINFO is guaranteed to have: + * The resulting sanitized BITMAPINFO is guaranteed to have: * - biSize set to sizeof(BITMAPINFOHEADER) * - biSizeImage set to the actual image size even for non-compressed DIB * - biClrUsed set to the size of the color table, and 0 only when there is no color table @@ -180,6 +180,7 @@ static BOOL bitmapinfo_from_user_bitmapinfo( BITMAPINFO *dst, const BITMAPINFO * { void *src_colors;
+ if (coloruse > DIB_PAL_COLORS + 1) return FALSE; /* FIXME: handle DIB_PAL_COLORS+1 format */ if (!bitmapinfoheader_from_user_bitmapinfo( &dst->bmiHeader, &info->bmiHeader )) return FALSE; if (!is_valid_dib_format( &dst->bmiHeader, allow_compression )) return FALSE;
@@ -645,7 +646,7 @@ INT WINAPI SetDIBits( HDC hdc, HBITMAP hbitmap, UINT startscan, HRGN clip = 0; const struct gdi_dc_funcs *funcs;
- if (!bitmapinfo_from_user_bitmapinfo( src_info, info, coloruse, TRUE )) + if (!bitmapinfo_from_user_bitmapinfo( src_info, info, coloruse, TRUE ) || coloruse > DIB_PAL_COLORS) { SetLastError( ERROR_INVALID_PARAMETER ); return 0; @@ -1209,6 +1210,7 @@ INT WINAPI GetDIBits( /* Since info may be a BITMAPCOREINFO or any of the larger BITMAPINFO structures, we'll use our own copy and transfer the colour info back at the end */ if (!bitmapinfoheader_from_user_bitmapinfo( &dst_info->bmiHeader, &info->bmiHeader )) return 0; + if (coloruse > DIB_PAL_COLORS) return 0; if (bits && (dst_info->bmiHeader.biCompression == BI_JPEG || dst_info->bmiHeader.biCompression == BI_PNG)) return 0; @@ -1426,6 +1428,7 @@ HBITMAP WINAPI CreateDIBitmap( HDC hdc, const BITMAPINFOHEADER *header,
if (!bitmapinfoheader_from_user_bitmapinfo( &info, header )) return 0; if (info.biCompression == BI_JPEG || info.biCompression == BI_PNG) return 0; + if (coloruse > DIB_PAL_COLORS + 1) return 0; if (info.biWidth < 0) return 0;
/* Top-down DIBs have a negative height */ @@ -1474,6 +1477,7 @@ HBITMAP WINAPI CreateDIBSection(HDC hdc, CONST BITMAPINFO *bmi, UINT usage,
if (bits) *bits = NULL; if (!bitmapinfo_from_user_bitmapinfo( info, bmi, usage, FALSE )) return 0; + if (usage > DIB_PAL_COLORS) return 0; if (info->bmiHeader.biPlanes != 1) { if (info->bmiHeader.biPlanes * info->bmiHeader.biBitCount > 16) return 0; diff --git a/dlls/gdi32/tests/bitmap.c b/dlls/gdi32/tests/bitmap.c index 9a34f63..7f609f2 100644 --- a/dlls/gdi32/tests/bitmap.c +++ b/dlls/gdi32/tests/bitmap.c @@ -1155,6 +1155,56 @@ static void test_dib_formats(void) ret = GetDIBits(hdc, hbmp, 0, 2, NULL, bi, DIB_RGB_COLORS); ok( !ret || broken(ret), /* nt4 */ "GetDIBits succeeded with zero height\n" );
+ /* some functions accept DIB_PAL_COLORS+1, but not beyond */ + + bi->bmiHeader.biWidth = 2; + bi->bmiHeader.biHeight = 2; + bi->bmiHeader.biBitCount = 1; + bi->bmiHeader.biCompression = BI_RGB; + hdib = CreateDIBSection(hdc, bi, DIB_PAL_COLORS+1, &bits, NULL, 0); + ok( hdib == NULL, "CreateDIBSection succeeded with DIB_PAL_COLORS+1\n" ); + hdib = CreateDIBitmap( hdc, &bi->bmiHeader, 0, bits, bi, DIB_PAL_COLORS+1 ); + ok( hdib != NULL, "CreateDIBitmap failed with DIB_PAL_COLORS+1\n" ); + DeleteObject( hdib ); + ret = SetDIBits(hdc, hbmp, 0, 1, data, bi, DIB_PAL_COLORS+1); + ok( !ret, "SetDIBits succeeded with DIB_PAL_COLORS+1\n" ); + ret = SetDIBitsToDevice( memdc, 0, 0, 1, 1, 0, 0, 0, 1, data, bi, DIB_PAL_COLORS+1 ); + ok( ret, "SetDIBitsToDevice failed with DIB_PAL_COLORS+1\n" ); + ret = StretchDIBits( memdc, 0, 0, 1, 1, 0, 0, 1, 1, data, bi, DIB_PAL_COLORS+1, SRCCOPY ); + ok( ret, "StretchDIBits failed with DIB_PAL_COLORS+1\n" ); + ret = GetDIBits(hdc, hbmp, 0, 2, data, bi, DIB_PAL_COLORS+1); + ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+1\n" ); + bi->bmiHeader.biWidth = 2; + bi->bmiHeader.biHeight = 2; + bi->bmiHeader.biBitCount = 1; + bi->bmiHeader.biCompression = BI_RGB; + ret = GetDIBits(hdc, hbmp, 0, 0, NULL, bi, DIB_PAL_COLORS+1); + ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+1\n" ); + + bi->bmiHeader.biWidth = 2; + bi->bmiHeader.biHeight = 2; + bi->bmiHeader.biBitCount = 1; + bi->bmiHeader.biCompression = BI_RGB; + hdib = CreateDIBSection(hdc, bi, DIB_PAL_COLORS+2, &bits, NULL, 0); + ok( hdib == NULL, "CreateDIBSection succeeded with DIB_PAL_COLORS+2\n" ); + hdib = CreateDIBitmap( hdc, &bi->bmiHeader, 0, bits, bi, DIB_PAL_COLORS+2 ); + ok( hdib == NULL, "CreateDIBitmap succeeded with DIB_PAL_COLORS+2\n" ); + DeleteObject( hdib ); + ret = SetDIBits(hdc, hbmp, 0, 1, data, bi, DIB_PAL_COLORS+2); + ok( !ret, "SetDIBits succeeded with DIB_PAL_COLORS+2\n" ); + ret = SetDIBitsToDevice( memdc, 0, 0, 1, 1, 0, 0, 0, 1, data, bi, DIB_PAL_COLORS+2 ); + ok( !ret, "SetDIBitsToDevice succeeded with DIB_PAL_COLORS+2\n" ); + ret = StretchDIBits( memdc, 0, 0, 1, 1, 0, 0, 1, 1, data, bi, DIB_PAL_COLORS+2, SRCCOPY ); + ok( !ret, "StretchDIBits succeeded with DIB_PAL_COLORS+2\n" ); + ret = GetDIBits(hdc, hbmp, 0, 2, data, bi, DIB_PAL_COLORS+2); + ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+2\n" ); + bi->bmiHeader.biWidth = 2; + bi->bmiHeader.biHeight = 2; + bi->bmiHeader.biBitCount = 1; + bi->bmiHeader.biCompression = BI_RGB; + ret = GetDIBits(hdc, hbmp, 0, 0, NULL, bi, DIB_PAL_COLORS+2); + ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+2\n" ); + DeleteDC( memdc ); DeleteObject( hbmp ); ReleaseDC( 0, hdc ); diff --git a/dlls/gdi32/tests/brush.c b/dlls/gdi32/tests/brush.c index 4f44d03..b11d21c 100644 --- a/dlls/gdi32/tests/brush.c +++ b/dlls/gdi32/tests/brush.c @@ -192,6 +192,17 @@ static void test_pattern_brush(void) ret = GlobalFlags( mem ); ok( ret == 2, "wrong flags %x\n", ret );
+ brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS ); + ok( brush != 0, "CreateDIBPatternBrushPt failed\n" ); + DeleteObject( brush ); + brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 1 ); + ok( brush != 0, "CreateDIBPatternBrushPt failed\n" ); + DeleteObject( brush ); + brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 2 ); + ok( !brush, "CreateDIBPatternBrushPt succeeded\n" ); + brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 3 ); + ok( !brush, "CreateDIBPatternBrushPt succeeded\n" ); + info->bmiHeader.biBitCount = 8; info->bmiHeader.biCompression = BI_RLE8; brush = CreateDIBPatternBrushPt( info, DIB_RGB_COLORS );