ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

gdi32: Add a check for overflow in DIB dimensions.

This commit is contained in:
Alexandre Julliard 2013-09-11 17:30:46 +02:00
parent 08e82d4686
commit 69abf20fcd
2 changed files with 48 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
dlls/gdi32/dib.c
View File

@ -128,6 +128,11 @@ static BOOL is_valid_dib_format( const BITMAPINFOHEADER *info, BOOL allow_compre
if (!info->biPlanes) return FALSE;
/* check for size overflow */
if (!info->biBitCount) return FALSE;
if (UINT_MAX / info->biBitCount < info->biWidth) return FALSE;
if (UINT_MAX / get_dib_stride( info->biWidth, info->biBitCount ) < abs( info->biHeight )) return FALSE;
switch (info->biBitCount)
{
case 1:

43
dlls/gdi32/tests/bitmap.c
View File

@ -1207,6 +1207,49 @@ static void test_dib_formats(void)
ret = GetDIBits(hdc, hbmp, 0, 0, NULL, bi, DIB_PAL_COLORS+2);
ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+2\n" );
bi->bmiHeader.biWidth = 0x4000;
bi->bmiHeader.biHeight = 0x4000;
bi->bmiHeader.biBitCount = 1;
bi->bmiHeader.biCompression = BI_RGB;
hdib = CreateDIBSection(hdc, bi, DIB_RGB_COLORS, &bits, NULL, 0);
ok( hdib != NULL, "CreateDIBSection failed with large size\n" );
DeleteObject( hdib );
bi->bmiHeader.biWidth = 0x8001;
bi->bmiHeader.biHeight = 0x8001;
bi->bmiHeader.biBitCount = 32;
bi->bmiHeader.biCompression = BI_RGB;
hdib = CreateDIBSection(hdc, bi, DIB_RGB_COLORS, &bits, NULL, 0);
ok( hdib == NULL, "CreateDIBSection succeeded with size overflow\n" );
bi->bmiHeader.biWidth = 1;
bi->bmiHeader.biHeight = 0x40000001;
bi->bmiHeader.biBitCount = 32;
bi->bmiHeader.biCompression = BI_RGB;
hdib = CreateDIBSection(hdc, bi, DIB_RGB_COLORS, &bits, NULL, 0);
ok( hdib == NULL, "CreateDIBSection succeeded with size overflow\n" );
bi->bmiHeader.biWidth = 2;
bi->bmiHeader.biHeight = 0x40000001;
bi->bmiHeader.biBitCount = 16;
bi->bmiHeader.biCompression = BI_RGB;
hdib = CreateDIBSection(hdc, bi, DIB_RGB_COLORS, &bits, NULL, 0);
ok( hdib == NULL, "CreateDIBSection succeeded with size overflow\n" );
bi->bmiHeader.biWidth = 0x40000001;
bi->bmiHeader.biHeight = 1;
bi->bmiHeader.biBitCount = 32;
bi->bmiHeader.biCompression = BI_RGB;
hdib = CreateDIBSection(hdc, bi, DIB_RGB_COLORS, &bits, NULL, 0);
ok( hdib == NULL, "CreateDIBSection succeeded with size overflow\n" );
bi->bmiHeader.biWidth = 0x40000001;
bi->bmiHeader.biHeight = 4;
bi->bmiHeader.biBitCount = 8;
bi->bmiHeader.biCompression = BI_RGB;
hdib = CreateDIBSection(hdc, bi, DIB_RGB_COLORS, &bits, NULL, 0);
ok( hdib == NULL, "CreateDIBSection succeeded with size overflow\n" );
DeleteDC( memdc );
DeleteObject( hbmp );
ReleaseDC( 0, hdc );