ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

gdi32: Add checks for invalid color usage values.

This commit is contained in:
Alexandre Julliard 2011-12-29 14:05:20 +01:00
parent c1c8c92875
commit 63a9217539
3 changed files with 67 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
dlls/gdi32/dib.c
View File

@ -169,7 +169,7 @@ static BOOL bitmapinfoheader_from_user_bitmapinfo( BITMAPINFOHEADER *dst, const
/*******************************************************************************************
* Fill out a true BITMAPINFO from a variable sized BITMAPINFO / BITMAPCOREINFO.
*
* The resulting stanitized BITMAPINFO is guaranteed to have:
* The resulting sanitized BITMAPINFO is guaranteed to have:
* - biSize set to sizeof(BITMAPINFOHEADER)
* - biSizeImage set to the actual image size even for non-compressed DIB
* - biClrUsed set to the size of the color table, and 0 only when there is no color table
@ -180,6 +180,7 @@ static BOOL bitmapinfo_from_user_bitmapinfo( BITMAPINFO *dst, const BITMAPINFO *
{
void *src_colors;
if (coloruse > DIB_PAL_COLORS + 1) return FALSE; /* FIXME: handle DIB_PAL_COLORS+1 format */
if (!bitmapinfoheader_from_user_bitmapinfo( &dst->bmiHeader, &info->bmiHeader )) return FALSE;
if (!is_valid_dib_format( &dst->bmiHeader, allow_compression )) return FALSE;
@ -645,7 +646,7 @@ INT WINAPI SetDIBits( HDC hdc, HBITMAP hbitmap, UINT startscan,
HRGN clip = 0;
const struct gdi_dc_funcs *funcs;
if (!bitmapinfo_from_user_bitmapinfo( src_info, info, coloruse, TRUE ))
if (!bitmapinfo_from_user_bitmapinfo( src_info, info, coloruse, TRUE ) || coloruse > DIB_PAL_COLORS)
{
SetLastError( ERROR_INVALID_PARAMETER );
return 0;
@ -1209,6 +1210,7 @@ INT WINAPI GetDIBits(
/* Since info may be a BITMAPCOREINFO or any of the larger BITMAPINFO structures, we'll use our
own copy and transfer the colour info back at the end */
if (!bitmapinfoheader_from_user_bitmapinfo( &dst_info->bmiHeader, &info->bmiHeader )) return 0;
if (coloruse > DIB_PAL_COLORS) return 0;
if (bits &&
(dst_info->bmiHeader.biCompression == BI_JPEG || dst_info->bmiHeader.biCompression == BI_PNG))
return 0;
@ -1426,6 +1428,7 @@ HBITMAP WINAPI CreateDIBitmap( HDC hdc, const BITMAPINFOHEADER *header,
if (!bitmapinfoheader_from_user_bitmapinfo( &info, header )) return 0;
if (info.biCompression == BI_JPEG || info.biCompression == BI_PNG) return 0;
if (coloruse > DIB_PAL_COLORS + 1) return 0;
if (info.biWidth < 0) return 0;
/* Top-down DIBs have a negative height */
@ -1474,6 +1477,7 @@ HBITMAP WINAPI CreateDIBSection(HDC hdc, CONST BITMAPINFO *bmi, UINT usage,
if (bits) *bits = NULL;
if (!bitmapinfo_from_user_bitmapinfo( info, bmi, usage, FALSE )) return 0;
if (usage > DIB_PAL_COLORS) return 0;
if (info->bmiHeader.biPlanes != 1)
{
if (info->bmiHeader.biPlanes * info->bmiHeader.biBitCount > 16) return 0;

50
dlls/gdi32/tests/bitmap.c
View File

@ -1155,6 +1155,56 @@ static void test_dib_formats(void)
ret = GetDIBits(hdc, hbmp, 0, 2, NULL, bi, DIB_RGB_COLORS);
ok( !ret || broken(ret), /* nt4 */ "GetDIBits succeeded with zero height\n" );
/* some functions accept DIB_PAL_COLORS+1, but not beyond */
bi->bmiHeader.biWidth = 2;
bi->bmiHeader.biHeight = 2;
bi->bmiHeader.biBitCount = 1;
bi->bmiHeader.biCompression = BI_RGB;
hdib = CreateDIBSection(hdc, bi, DIB_PAL_COLORS+1, &bits, NULL, 0);
ok( hdib == NULL, "CreateDIBSection succeeded with DIB_PAL_COLORS+1\n" );
hdib = CreateDIBitmap( hdc, &bi->bmiHeader, 0, bits, bi, DIB_PAL_COLORS+1 );
ok( hdib != NULL, "CreateDIBitmap failed with DIB_PAL_COLORS+1\n" );
DeleteObject( hdib );
ret = SetDIBits(hdc, hbmp, 0, 1, data, bi, DIB_PAL_COLORS+1);
ok( !ret, "SetDIBits succeeded with DIB_PAL_COLORS+1\n" );
ret = SetDIBitsToDevice( memdc, 0, 0, 1, 1, 0, 0, 0, 1, data, bi, DIB_PAL_COLORS+1 );
ok( ret, "SetDIBitsToDevice failed with DIB_PAL_COLORS+1\n" );
ret = StretchDIBits( memdc, 0, 0, 1, 1, 0, 0, 1, 1, data, bi, DIB_PAL_COLORS+1, SRCCOPY );
ok( ret, "StretchDIBits failed with DIB_PAL_COLORS+1\n" );
ret = GetDIBits(hdc, hbmp, 0, 2, data, bi, DIB_PAL_COLORS+1);
ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+1\n" );
bi->bmiHeader.biWidth = 2;
bi->bmiHeader.biHeight = 2;
bi->bmiHeader.biBitCount = 1;
bi->bmiHeader.biCompression = BI_RGB;
ret = GetDIBits(hdc, hbmp, 0, 0, NULL, bi, DIB_PAL_COLORS+1);
ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+1\n" );
bi->bmiHeader.biWidth = 2;
bi->bmiHeader.biHeight = 2;
bi->bmiHeader.biBitCount = 1;
bi->bmiHeader.biCompression = BI_RGB;
hdib = CreateDIBSection(hdc, bi, DIB_PAL_COLORS+2, &bits, NULL, 0);
ok( hdib == NULL, "CreateDIBSection succeeded with DIB_PAL_COLORS+2\n" );
hdib = CreateDIBitmap( hdc, &bi->bmiHeader, 0, bits, bi, DIB_PAL_COLORS+2 );
ok( hdib == NULL, "CreateDIBitmap succeeded with DIB_PAL_COLORS+2\n" );
DeleteObject( hdib );
ret = SetDIBits(hdc, hbmp, 0, 1, data, bi, DIB_PAL_COLORS+2);
ok( !ret, "SetDIBits succeeded with DIB_PAL_COLORS+2\n" );
ret = SetDIBitsToDevice( memdc, 0, 0, 1, 1, 0, 0, 0, 1, data, bi, DIB_PAL_COLORS+2 );
ok( !ret, "SetDIBitsToDevice succeeded with DIB_PAL_COLORS+2\n" );
ret = StretchDIBits( memdc, 0, 0, 1, 1, 0, 0, 1, 1, data, bi, DIB_PAL_COLORS+2, SRCCOPY );
ok( !ret, "StretchDIBits succeeded with DIB_PAL_COLORS+2\n" );
ret = GetDIBits(hdc, hbmp, 0, 2, data, bi, DIB_PAL_COLORS+2);
ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+2\n" );
bi->bmiHeader.biWidth = 2;
bi->bmiHeader.biHeight = 2;
bi->bmiHeader.biBitCount = 1;
bi->bmiHeader.biCompression = BI_RGB;
ret = GetDIBits(hdc, hbmp, 0, 0, NULL, bi, DIB_PAL_COLORS+2);
ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+2\n" );
DeleteDC( memdc );
DeleteObject( hbmp );
ReleaseDC( 0, hdc );

11
dlls/gdi32/tests/brush.c
View File

@ -192,6 +192,17 @@ static void test_pattern_brush(void)
ret = GlobalFlags( mem );
ok( ret == 2, "wrong flags %x\n", ret );
brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS );
ok( brush != 0, "CreateDIBPatternBrushPt failed\n" );
DeleteObject( brush );
brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 1 );
ok( brush != 0, "CreateDIBPatternBrushPt failed\n" );
DeleteObject( brush );
brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 2 );
ok( !brush, "CreateDIBPatternBrushPt succeeded\n" );
brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 3 );
ok( !brush, "CreateDIBPatternBrushPt succeeded\n" );
info->bmiHeader.biBitCount = 8;
info->bmiHeader.biCompression = BI_RLE8;
brush = CreateDIBPatternBrushPt( info, DIB_RGB_COLORS );