From e0601829e1093c6ba6e42004f5270817a6d90a3e Mon Sep 17 00:00:00 2001
From: Hugh Bellamy <hughbellars@gmail.com>
Date: Sun, 17 Sep 2017 11:46:56 +0100
Subject: [PATCH] gdiplus: Fix validation of HatchStyle in
 GdipCreateHatchBrush.

Signed-off-by: Hugh Bellamy <hughbellars@gmail.com>
Signed-off-by: Vincent Povirk <vincent@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
---
 dlls/gdiplus/brush.c       |  3 +++
 dlls/gdiplus/tests/brush.c | 28 ++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/dlls/gdiplus/brush.c b/dlls/gdiplus/brush.c
index 201fadf11a4..6db4ada66aa 100644
--- a/dlls/gdiplus/brush.c
+++ b/dlls/gdiplus/brush.c
@@ -250,6 +250,9 @@ GpStatus WINGDIPAPI GdipCreateHatchBrush(HatchStyle hatchstyle, ARGB forecol, AR
 
     if(!brush)  return InvalidParameter;
 
+    if(hatchstyle < HatchStyleMin || hatchstyle > HatchStyleMax)
+        return InvalidParameter;
+
     *brush = heap_alloc_zero(sizeof(GpHatch));
     if (!*brush) return OutOfMemory;
 
diff --git a/dlls/gdiplus/tests/brush.c b/dlls/gdiplus/tests/brush.c
index 045d5e5b8ac..e002a6f883e 100644
--- a/dlls/gdiplus/tests/brush.c
+++ b/dlls/gdiplus/tests/brush.c
@@ -45,6 +45,33 @@ static void test_constructor_destructor(void)
     expect(Ok, status);
 }
 
+static void test_createHatchBrush(void)
+{
+    GpStatus status;
+    GpHatch *brush;
+
+    status = GdipCreateHatchBrush(HatchStyleMin, 1, 2, &brush);
+    expect(Ok, status);
+    ok(brush != NULL, "Expected the brush to be initialized.");
+
+    GdipDeleteBrush((GpBrush *)brush);
+
+    status = GdipCreateHatchBrush(HatchStyleMax, 1, 2, &brush);
+    expect(Ok, status);
+    ok(brush != NULL, "Expected the brush to be initialized.");
+
+    GdipDeleteBrush((GpBrush *)brush);
+
+    status = GdipCreateHatchBrush(HatchStyle05Percent, 1, 2, NULL);
+    expect(InvalidParameter, status);
+
+    status = GdipCreateHatchBrush((HatchStyle)(HatchStyleMin - 1), 1, 2, &brush);
+    expect(InvalidParameter, status);
+
+    status = GdipCreateHatchBrush((HatchStyle)(HatchStyleMax + 1), 1, 2, &brush);
+    expect(InvalidParameter, status);
+}
+
 static void test_type(void)
 {
     GpStatus status;
@@ -1563,6 +1590,7 @@ START_TEST(brush)
     GdiplusStartup(&gdiplusToken, &gdiplusStartupInput, NULL);
 
     test_constructor_destructor();
+    test_createHatchBrush();
     test_type();
     test_gradientblendcount();
     test_getblend();