Module: wine Branch: master Commit: 8e8cdc78e6af71398414df8416bb7013b00ece34 URL: http://source.winehq.org/git/wine.git/?a=commit;h=8e8cdc78e6af71398414df8416...
Author: Alexandre Julliard julliard@winehq.org Date: Thu Dec 1 18:08:09 2011 +0100
gdi32: Add more parameter checks in GdiGradientFill.
---
dlls/gdi32/painting.c | 7 +++++-- dlls/gdi32/tests/bitmap.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 2 deletions(-)
diff --git a/dlls/gdi32/painting.c b/dlls/gdi32/painting.c index 75c32c8..d721bd1 100644 --- a/dlls/gdi32/painting.c +++ b/dlls/gdi32/painting.c @@ -1219,11 +1219,12 @@ POINT *GDI_Bezier( const POINT *Points, INT count, INT *nPtsOut ) * GdiGradientFill (GDI32.@) */ BOOL WINAPI GdiGradientFill( HDC hdc, TRIVERTEX *vert_array, ULONG nvert, - void * grad_array, ULONG ngrad, ULONG mode ) + void *grad_array, ULONG ngrad, ULONG mode ) { DC *dc; PHYSDEV physdev; BOOL ret; + ULONG i;
TRACE("%p vert_array:%p nvert:%d grad_array:%p ngrad:%d\n", hdc, vert_array, nvert, grad_array, ngrad);
@@ -1232,12 +1233,14 @@ BOOL WINAPI GdiGradientFill( HDC hdc, TRIVERTEX *vert_array, ULONG nvert, SetLastError( ERROR_INVALID_PARAMETER ); return FALSE; } + for (i = 0; i < ngrad * (mode == GRADIENT_FILL_TRIANGLE ? 3 : 2); i++) + if (((ULONG *)grad_array)[i] >= nvert) return FALSE; + if (!(dc = get_dc_ptr( hdc ))) { SetLastError( ERROR_INVALID_PARAMETER ); return FALSE; } - update_dc( dc ); physdev = GET_DC_PHYSDEV( dc, pGradientFill ); ret = physdev->funcs->pGradientFill( physdev, vert_array, nvert, grad_array, ngrad, mode ); diff --git a/dlls/gdi32/tests/bitmap.c b/dlls/gdi32/tests/bitmap.c index 8b62be6..26c840b 100644 --- a/dlls/gdi32/tests/bitmap.c +++ b/dlls/gdi32/tests/bitmap.c @@ -3417,6 +3417,17 @@ static void test_GdiGradientFill(void) ok( !ret, "GdiGradientFill succeeded\n" ); ok( GetLastError() == ERROR_INVALID_PARAMETER, "wrong error %u\n", GetLastError() ); SetLastError( 0xdeadbeef ); + ret = pGdiGradientFill( hdc, vt, 3, rect, 3, GRADIENT_FILL_RECT_H ); + ok( !ret, "GdiGradientFill succeeded\n" ); + ok( GetLastError() == 0xdeadbeef, "wrong error %u\n", GetLastError() ); + rect[2].UpperLeft = rect[2].LowerRight = 1; + SetLastError( 0xdeadbeef ); + ret = pGdiGradientFill( hdc, vt, 3, rect, 3, GRADIENT_FILL_RECT_H ); + ok( ret, "GdiGradientFill failed err %u\n", GetLastError() ); + SetLastError( 0xdeadbeef ); + ret = pGdiGradientFill( hdc, vt, 1, rect, 1, GRADIENT_FILL_RECT_H ); + ok( ret, "GdiGradientFill failed err %u\n", GetLastError() ); + SetLastError( 0xdeadbeef ); ret = pGdiGradientFill( hdc, vt, 1, tri, 0, GRADIENT_FILL_TRIANGLE ); ok( !ret, "GdiGradientFill succeeded\n" ); ok( GetLastError() == ERROR_INVALID_PARAMETER, "wrong error %u\n", GetLastError() ); @@ -3429,6 +3440,24 @@ static void test_GdiGradientFill(void) SetLastError( 0xdeadbeef ); ret = pGdiGradientFill( hdc, vt, 3, tri, 3, GRADIENT_FILL_TRIANGLE ); ok( ret, "GdiGradientFill failed err %u\n", GetLastError() ); + SetLastError( 0xdeadbeef ); + ret = pGdiGradientFill( hdc, vt, 3, tri, 4, GRADIENT_FILL_TRIANGLE ); + ok( !ret, "GdiGradientFill succeeded\n" ); + ok( GetLastError() == 0xdeadbeef, "wrong error %u\n", GetLastError() ); + tri[3].Vertex3 = 1; + SetLastError( 0xdeadbeef ); + ret = pGdiGradientFill( hdc, vt, 3, tri, 4, GRADIENT_FILL_TRIANGLE ); + ok( !ret, "GdiGradientFill succeeded\n" ); + ok( GetLastError() == 0xdeadbeef, "wrong error %u\n", GetLastError() ); + tri[3].Vertex3 = 0; + SetLastError( 0xdeadbeef ); + ret = pGdiGradientFill( hdc, vt, 3, tri, 4, GRADIENT_FILL_TRIANGLE ); + ok( !ret, "GdiGradientFill succeeded\n" ); + ok( GetLastError() == 0xdeadbeef, "wrong error %u\n", GetLastError() ); + tri[3].Vertex1 = tri[3].Vertex2 = tri[3].Vertex3 = 1; + SetLastError( 0xdeadbeef ); + ret = pGdiGradientFill( hdc, vt, 3, tri, 4, GRADIENT_FILL_TRIANGLE ); + ok( ret, "GdiGradientFill failed err %u\n", GetLastError() );
DeleteDC( hdc ); DeleteObject( bmp );
-
Alexandre Julliard