Alexandre Julliard : gdi32: Add checks for invalid color usage values.
Alexandre Julliard
julliard at winehq.org
Thu Dec 29 12:15:44 CST 2011
Module: wine
Branch: master
Commit: 63a9217539b54ee4af5535d8f2e7ca5408d00c7a
URL: http://source.winehq.org/git/wine.git/?a=commit;h=63a9217539b54ee4af5535d8f2e7ca5408d00c7a
Author: Alexandre Julliard <julliard at winehq.org>
Date: Thu Dec 29 14:05:20 2011 +0100
gdi32: Add checks for invalid color usage values.
---
dlls/gdi32/dib.c | 8 +++++-
dlls/gdi32/tests/bitmap.c | 50 +++++++++++++++++++++++++++++++++++++++++++++
dlls/gdi32/tests/brush.c | 11 +++++++++
3 files changed, 67 insertions(+), 2 deletions(-)
diff --git a/dlls/gdi32/dib.c b/dlls/gdi32/dib.c
index d97b30f..b9ffbbe 100644
--- a/dlls/gdi32/dib.c
+++ b/dlls/gdi32/dib.c
@@ -169,7 +169,7 @@ static BOOL bitmapinfoheader_from_user_bitmapinfo( BITMAPINFOHEADER *dst, const
/*******************************************************************************************
* Fill out a true BITMAPINFO from a variable sized BITMAPINFO / BITMAPCOREINFO.
*
- * The resulting stanitized BITMAPINFO is guaranteed to have:
+ * The resulting sanitized BITMAPINFO is guaranteed to have:
* - biSize set to sizeof(BITMAPINFOHEADER)
* - biSizeImage set to the actual image size even for non-compressed DIB
* - biClrUsed set to the size of the color table, and 0 only when there is no color table
@@ -180,6 +180,7 @@ static BOOL bitmapinfo_from_user_bitmapinfo( BITMAPINFO *dst, const BITMAPINFO *
{
void *src_colors;
+ if (coloruse > DIB_PAL_COLORS + 1) return FALSE; /* FIXME: handle DIB_PAL_COLORS+1 format */
if (!bitmapinfoheader_from_user_bitmapinfo( &dst->bmiHeader, &info->bmiHeader )) return FALSE;
if (!is_valid_dib_format( &dst->bmiHeader, allow_compression )) return FALSE;
@@ -645,7 +646,7 @@ INT WINAPI SetDIBits( HDC hdc, HBITMAP hbitmap, UINT startscan,
HRGN clip = 0;
const struct gdi_dc_funcs *funcs;
- if (!bitmapinfo_from_user_bitmapinfo( src_info, info, coloruse, TRUE ))
+ if (!bitmapinfo_from_user_bitmapinfo( src_info, info, coloruse, TRUE ) || coloruse > DIB_PAL_COLORS)
{
SetLastError( ERROR_INVALID_PARAMETER );
return 0;
@@ -1209,6 +1210,7 @@ INT WINAPI GetDIBits(
/* Since info may be a BITMAPCOREINFO or any of the larger BITMAPINFO structures, we'll use our
own copy and transfer the colour info back at the end */
if (!bitmapinfoheader_from_user_bitmapinfo( &dst_info->bmiHeader, &info->bmiHeader )) return 0;
+ if (coloruse > DIB_PAL_COLORS) return 0;
if (bits &&
(dst_info->bmiHeader.biCompression == BI_JPEG || dst_info->bmiHeader.biCompression == BI_PNG))
return 0;
@@ -1426,6 +1428,7 @@ HBITMAP WINAPI CreateDIBitmap( HDC hdc, const BITMAPINFOHEADER *header,
if (!bitmapinfoheader_from_user_bitmapinfo( &info, header )) return 0;
if (info.biCompression == BI_JPEG || info.biCompression == BI_PNG) return 0;
+ if (coloruse > DIB_PAL_COLORS + 1) return 0;
if (info.biWidth < 0) return 0;
/* Top-down DIBs have a negative height */
@@ -1474,6 +1477,7 @@ HBITMAP WINAPI CreateDIBSection(HDC hdc, CONST BITMAPINFO *bmi, UINT usage,
if (bits) *bits = NULL;
if (!bitmapinfo_from_user_bitmapinfo( info, bmi, usage, FALSE )) return 0;
+ if (usage > DIB_PAL_COLORS) return 0;
if (info->bmiHeader.biPlanes != 1)
{
if (info->bmiHeader.biPlanes * info->bmiHeader.biBitCount > 16) return 0;
diff --git a/dlls/gdi32/tests/bitmap.c b/dlls/gdi32/tests/bitmap.c
index 9a34f63..7f609f2 100644
--- a/dlls/gdi32/tests/bitmap.c
+++ b/dlls/gdi32/tests/bitmap.c
@@ -1155,6 +1155,56 @@ static void test_dib_formats(void)
ret = GetDIBits(hdc, hbmp, 0, 2, NULL, bi, DIB_RGB_COLORS);
ok( !ret || broken(ret), /* nt4 */ "GetDIBits succeeded with zero height\n" );
+ /* some functions accept DIB_PAL_COLORS+1, but not beyond */
+
+ bi->bmiHeader.biWidth = 2;
+ bi->bmiHeader.biHeight = 2;
+ bi->bmiHeader.biBitCount = 1;
+ bi->bmiHeader.biCompression = BI_RGB;
+ hdib = CreateDIBSection(hdc, bi, DIB_PAL_COLORS+1, &bits, NULL, 0);
+ ok( hdib == NULL, "CreateDIBSection succeeded with DIB_PAL_COLORS+1\n" );
+ hdib = CreateDIBitmap( hdc, &bi->bmiHeader, 0, bits, bi, DIB_PAL_COLORS+1 );
+ ok( hdib != NULL, "CreateDIBitmap failed with DIB_PAL_COLORS+1\n" );
+ DeleteObject( hdib );
+ ret = SetDIBits(hdc, hbmp, 0, 1, data, bi, DIB_PAL_COLORS+1);
+ ok( !ret, "SetDIBits succeeded with DIB_PAL_COLORS+1\n" );
+ ret = SetDIBitsToDevice( memdc, 0, 0, 1, 1, 0, 0, 0, 1, data, bi, DIB_PAL_COLORS+1 );
+ ok( ret, "SetDIBitsToDevice failed with DIB_PAL_COLORS+1\n" );
+ ret = StretchDIBits( memdc, 0, 0, 1, 1, 0, 0, 1, 1, data, bi, DIB_PAL_COLORS+1, SRCCOPY );
+ ok( ret, "StretchDIBits failed with DIB_PAL_COLORS+1\n" );
+ ret = GetDIBits(hdc, hbmp, 0, 2, data, bi, DIB_PAL_COLORS+1);
+ ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+1\n" );
+ bi->bmiHeader.biWidth = 2;
+ bi->bmiHeader.biHeight = 2;
+ bi->bmiHeader.biBitCount = 1;
+ bi->bmiHeader.biCompression = BI_RGB;
+ ret = GetDIBits(hdc, hbmp, 0, 0, NULL, bi, DIB_PAL_COLORS+1);
+ ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+1\n" );
+
+ bi->bmiHeader.biWidth = 2;
+ bi->bmiHeader.biHeight = 2;
+ bi->bmiHeader.biBitCount = 1;
+ bi->bmiHeader.biCompression = BI_RGB;
+ hdib = CreateDIBSection(hdc, bi, DIB_PAL_COLORS+2, &bits, NULL, 0);
+ ok( hdib == NULL, "CreateDIBSection succeeded with DIB_PAL_COLORS+2\n" );
+ hdib = CreateDIBitmap( hdc, &bi->bmiHeader, 0, bits, bi, DIB_PAL_COLORS+2 );
+ ok( hdib == NULL, "CreateDIBitmap succeeded with DIB_PAL_COLORS+2\n" );
+ DeleteObject( hdib );
+ ret = SetDIBits(hdc, hbmp, 0, 1, data, bi, DIB_PAL_COLORS+2);
+ ok( !ret, "SetDIBits succeeded with DIB_PAL_COLORS+2\n" );
+ ret = SetDIBitsToDevice( memdc, 0, 0, 1, 1, 0, 0, 0, 1, data, bi, DIB_PAL_COLORS+2 );
+ ok( !ret, "SetDIBitsToDevice succeeded with DIB_PAL_COLORS+2\n" );
+ ret = StretchDIBits( memdc, 0, 0, 1, 1, 0, 0, 1, 1, data, bi, DIB_PAL_COLORS+2, SRCCOPY );
+ ok( !ret, "StretchDIBits succeeded with DIB_PAL_COLORS+2\n" );
+ ret = GetDIBits(hdc, hbmp, 0, 2, data, bi, DIB_PAL_COLORS+2);
+ ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+2\n" );
+ bi->bmiHeader.biWidth = 2;
+ bi->bmiHeader.biHeight = 2;
+ bi->bmiHeader.biBitCount = 1;
+ bi->bmiHeader.biCompression = BI_RGB;
+ ret = GetDIBits(hdc, hbmp, 0, 0, NULL, bi, DIB_PAL_COLORS+2);
+ ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+2\n" );
+
DeleteDC( memdc );
DeleteObject( hbmp );
ReleaseDC( 0, hdc );
diff --git a/dlls/gdi32/tests/brush.c b/dlls/gdi32/tests/brush.c
index 4f44d03..b11d21c 100644
--- a/dlls/gdi32/tests/brush.c
+++ b/dlls/gdi32/tests/brush.c
@@ -192,6 +192,17 @@ static void test_pattern_brush(void)
ret = GlobalFlags( mem );
ok( ret == 2, "wrong flags %x\n", ret );
+ brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS );
+ ok( brush != 0, "CreateDIBPatternBrushPt failed\n" );
+ DeleteObject( brush );
+ brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 1 );
+ ok( brush != 0, "CreateDIBPatternBrushPt failed\n" );
+ DeleteObject( brush );
+ brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 2 );
+ ok( !brush, "CreateDIBPatternBrushPt succeeded\n" );
+ brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 3 );
+ ok( !brush, "CreateDIBPatternBrushPt succeeded\n" );
+
info->bmiHeader.biBitCount = 8;
info->bmiHeader.biCompression = BI_RLE8;
brush = CreateDIBPatternBrushPt( info, DIB_RGB_COLORS );
More information about the wine-cvs
mailing list