[WIN32K] Fix probing and parameter validation in NtGdiPolyPolyDraw
[reactos.git] / reactos / win32ss / gdi / ntgdi / fillshap.c
index 1c72756..e20f199 100644 (file)
@@ -1,7 +1,7 @@
 /*
  * PROJECT:         ReactOS win32 kernel mode subsystem
  * LICENSE:         GPL - See COPYING in the top level directory
- * FILE:            subsystems/win32/win32k/objects/fillshap.c
+ * FILE:            win32ss/gdi/ntgdi/fillshap.c
  * PURPOSE:         fillshap
  * PROGRAMMER:
  */
@@ -81,8 +81,11 @@ IntGdiPolygon(PDC    dc,
         pbrFill = dc->dclevel.pbrFill;
         pbrLine = dc->dclevel.pbrLine;
         psurf = dc->dclevel.pSurface;
-        /* FIXME: psurf can be NULL!!!! don't assert but handle this case gracefully! */
-        ASSERT(psurf);
+        if (psurf == NULL)
+        {
+            /* Memory DC without a bitmap selected, nothing to do. */
+            return TRUE;
+        }
 
         /* Now fill the polygon with the current fill brush. */
         if (!(pbrFill->flAttrs & BR_IS_NULL))
@@ -112,7 +115,7 @@ IntGdiPolygon(PDC    dc,
 //                                 Points[1].x, Points[1].y );
 
                 ret = IntEngLineTo(&psurf->SurfObj,
-                                   &dc->co.ClipObj,
+                                   (CLIPOBJ *)&dc->co,
                                    &dc->eboLine.BrushObject,
                                    Points[i].x,          /* From */
                                    Points[i].y,
@@ -126,7 +129,7 @@ IntGdiPolygon(PDC    dc,
             if (ret)
             {
                 ret = IntEngLineTo(&psurf->SurfObj,
-                                   &dc->co.ClipObj,
+                                   (CLIPOBJ *)&dc->co,
                                    &dc->eboLine.BrushObject,
                                    Points[Count-1].x, /* From */
                                    Points[Count-1].y,
@@ -162,13 +165,20 @@ IntGdiPolyPolygon(DC      *dc,
 BOOL FASTCALL
 IntPolygon(HDC hdc, POINT *Point, int Count)
 {
-   PDC dc;
-   if (!(dc = DC_LockDc(hdc)))
-   {
-      EngSetLastError(ERROR_INVALID_HANDLE);
-      return FALSE;
-   }
-   return IntGdiPolygon(dc, Point, Count);
+    BOOL bResult;
+    PDC pdc;
+
+    pdc = DC_LockDc(hdc);
+    if (pdc == NULL)
+    {
+        EngSetLastError(ERROR_INVALID_HANDLE);
+        return FALSE;
+    }
+
+    bResult = IntGdiPolygon(pdc, Point, Count);
+
+    DC_UnlockDc(pdc);
+    return bResult;
 }
 
 
@@ -204,20 +214,12 @@ NtGdiEllipse(
     PBRUSH pFillBrushObj;
     BRUSH tmpFillBrushObj;
 
-    if ((Left == Right) || (Top == Bottom)) return TRUE;
-
     dc = DC_LockDc(hDC);
     if (dc == NULL)
     {
        EngSetLastError(ERROR_INVALID_HANDLE);
        return FALSE;
     }
-    if (dc->dctype == DC_TYPE_INFO)
-    {
-       DC_UnlockDc(dc);
-       /* Yes, Windows really returns TRUE in this case */
-       return TRUE;
-    }
 
     if (PATH_IsPathOpen(dc->dclevel))
     {
@@ -226,6 +228,15 @@ NtGdiEllipse(
         return ret;
     }
 
+    ////
+    //// Could this use PATH_CheckCorners ?
+    ////
+    if ((Left == Right) || (Top == Bottom))
+    {
+       DC_UnlockDc(dc);
+       return TRUE;
+    }
+
     if (Right < Left)
     {
        INT tmp = Right; Right = Left; Left = tmp;
@@ -234,6 +245,7 @@ NtGdiEllipse(
     {
        INT tmp = Bottom; Bottom = Top; Top = tmp;
     }
+    ////
 
     pdcattr = dc->pdcattr;
 
@@ -252,7 +264,7 @@ NtGdiEllipse(
         return FALSE;
     }
 
-    PenOrigWidth = PenWidth = pbrush->ptPenWidth.x;
+    PenOrigWidth = PenWidth = pbrush->lWidth;
     if (pbrush->ulPenStyle == PS_NULL) PenWidth = 0;
 
     if (pbrush->ulPenStyle == PS_INSIDEFRAME)
@@ -266,7 +278,7 @@ NtGdiEllipse(
     }
 
     if (!PenWidth) PenWidth = 1;
-    pbrush->ptPenWidth.x = PenWidth;
+    pbrush->lWidth = PenWidth;
 
     RectBounds.left   = Left;
     RectBounds.right  = Right;
@@ -330,7 +342,7 @@ NtGdiEllipse(
         DC_vFinishBlit(dc, NULL);
     }
 
-    pbrush->ptPenWidth.x = PenOrigWidth;
+    pbrush->lWidth = PenOrigWidth;
     PEN_ShareUnlockPen(pbrush);
     DC_UnlockDc(dc);
     DPRINT("Ellipse Exit.\n");
@@ -371,56 +383,56 @@ NtGdiPolyPolyDraw( IN HDC hDC,
     PVOID pTemp;
     LPPOINT SafePoints;
     PULONG SafeCounts;
-    NTSTATUS Status = STATUS_SUCCESS;
+    NTSTATUS Status;
     BOOL Ret = TRUE;
-    ULONG nPoints = 0, nMaxPoints = 0, nInvalid = 0, i;
+    ULONG nPoints = 0, nMaxPoints = 0, i;
 
-    if (!UnsafePoints || !UnsafeCounts ||
-        Count == 0 || iFunc == 0 || iFunc > GdiPolyPolyRgn)
+    /* Validate parameters */
+    if ((UnsafePoints == NULL) ||
+        (UnsafeCounts == NULL) ||
+        (Count == 0) ||
+        (Count > ULONG_MAX / sizeof(ULONG)) ||
+        (iFunc == 0) ||
+        (iFunc > GdiPolyPolyRgn))
     {
+        DPRINT1("NtGdiPolyPolyDraw - Invalid parameter!\n");
         /* Windows doesn't set last error */
         return FALSE;
     }
 
     _SEH2_TRY
     {
-        ProbeForRead(UnsafePoints, Count * sizeof(POINT), 1);
+        /* Probe the buffer of counts for each polygon */
         ProbeForRead(UnsafeCounts, Count * sizeof(ULONG), 1);
 
-        /* Count points and validate poligons */
+        /* Count points. Note: We are not copying the buffer, so it can be
+           changed by usermode. This is ok, since the content is validated
+           again later. */
         for (i = 0; i < Count; i++)
         {
-            if (UnsafeCounts[i] < 2)
+            Status = RtlULongAdd(nMaxPoints, UnsafeCounts[i], &nMaxPoints);
+            if (!NT_SUCCESS(Status))
             {
-                nInvalid++;
+                DPRINT1("Overflow when counting points!\n");
+                return FALSE;
             }
-            nPoints += UnsafeCounts[i];
-            nMaxPoints = max(nMaxPoints, UnsafeCounts[i]);
         }
+
+        ProbeForRead(UnsafePoints, nMaxPoints * sizeof(POINT), 1);
     }
     _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
     {
-        Status = _SEH2_GetExceptionCode();
-    }
-    _SEH2_END;
-
-    if (!NT_SUCCESS(Status))
-    {
+        DPRINT1("Got exception!\n");
         /* Windows doesn't set last error */
         return FALSE;
     }
+    _SEH2_END;
 
-    if (nPoints == 0 || nPoints < nMaxPoints)
-    {
-        /* If all polygon counts are zero, or we have overflow,
-           return without setting a last error code. */
-        return FALSE;
-    }
-
-    if (nInvalid != 0)
+    if (nMaxPoints == 0)
     {
-        /* If at least one poly count is 0 or 1, fail */
-        EngSetLastError(ERROR_INVALID_PARAMETER);
+        /* If all polygon counts are zero, return FALSE
+           without setting a last error code. */
+        DPRINT1("nMaxPoints == 0!\n");
         return FALSE;
     }
 
@@ -430,12 +442,16 @@ NtGdiPolyPolyDraw( IN HDC hDC,
                                   TAG_SHAPE);
     if (!pTemp)
     {
+        DPRINT1("Failed to allocate %lu bytes (Count = %lu, nPoints = %u).\n",
+                Count * sizeof(ULONG) + nPoints * sizeof(POINT),
+                Count,
+                nPoints);
         EngSetLastError(ERROR_NOT_ENOUGH_MEMORY);
         return FALSE;
     }
 
     SafeCounts = pTemp;
-    SafePoints = (PVOID)(SafeCounts + Count);
+    SafePoints = (PPOINT)&SafeCounts[Count];
 
     _SEH2_TRY
     {
@@ -445,12 +461,37 @@ NtGdiPolyPolyDraw( IN HDC hDC,
     }
     _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
     {
-        Status = _SEH2_GetExceptionCode();
+        DPRINT1("Got exception!\n");
+        ExFreePoolWithTag(pTemp, TAG_SHAPE);
+        return FALSE;
     }
     _SEH2_END;
 
-    if (!NT_SUCCESS(Status))
+    /* Now that the buffers are copied, validate them again */
+    for (i = 0; i < Count; i++)
+    {
+        /* If any poly count is 0 or 1, fail */
+        if (SafeCounts[i] < 2)
+        {
+            DPRINT1("Invalid: UnsafeCounts[%lu] == %lu\n", i, SafeCounts[i]);
+            ExFreePoolWithTag(pTemp, TAG_SHAPE);
+            EngSetLastError(ERROR_INVALID_PARAMETER);
+            return FALSE;
+        }
+
+        Status = RtlULongAdd(nPoints, SafeCounts[i], &nPoints);
+        if (!NT_SUCCESS(Status))
+        {
+            DPRINT1("Overflow when counting points!\n");
+            return FALSE;
+        }
+    }
+
+    /* If the 2nd count does not match the 1st, someone changed the buffer
+       behind our back! */
+    if (nPoints != nMaxPoints)
     {
+        DPRINT1("Polygon count mismatch: %lu != %lu\n", nPoints, nMaxPoints);
         ExFreePoolWithTag(pTemp, TAG_SHAPE);
         return FALSE;
     }
@@ -458,26 +499,13 @@ NtGdiPolyPolyDraw( IN HDC hDC,
     /* Special handling for GdiPolyPolyRgn */
     if (iFunc == GdiPolyPolyRgn)
     {
-        PREGION Rgn;
-        HRGN hRgn;
+        INT iMode = (INT)(UINT_PTR)hDC;
+        HRGN hrgn;
+
+        hrgn = GreCreatePolyPolygonRgn(SafePoints, SafeCounts, Count, iMode);
 
-        Rgn = REGION_AllocUserRgnWithHandle(0);
-        if (!Rgn)
-        {
-            EngSetLastError(ERROR_NOT_ENOUGH_MEMORY);
-            ExFreePoolWithTag(pTemp, TAG_SHAPE);
-            return 0;
-        }
-        hRgn = Rgn->BaseObject.hHmgr;
-        if (!IntSetPolyPolygonRgn(SafePoints, SafeCounts, Count, hDC ? 1 : 2, Rgn))
-        {
-            /* EngSetLastError ? */
-            GreDeleteObject(hRgn);
-            hRgn = NULL;
-        }
-        RGNOBJAPI_Unlock(Rgn);
         ExFreePoolWithTag(pTemp, TAG_SHAPE);
-        return (ULONG_PTR)hRgn;
+        return (ULONG_PTR)hrgn;
     }
 
     dc = DC_LockDc(hDC);
@@ -488,14 +516,6 @@ NtGdiPolyPolyDraw( IN HDC hDC,
         return FALSE;
     }
 
-    if (dc->dctype == DC_TYPE_INFO)
-    {
-        DC_UnlockDc(dc);
-        ExFreePoolWithTag(pTemp, TAG_SHAPE);
-        /* Yes, Windows really returns TRUE in this case */
-        return TRUE;
-    }
-
     DC_vPrepareDCsForBlit(dc, NULL, NULL, NULL);
 
     if (dc->pdcattr->ulDirty_ & (DIRTY_FILL | DC_BRUSH_DIRTY))
@@ -575,6 +595,11 @@ IntRectangle(PDC dc,
     DestRect.top    += dc->ptlDCOrig.y;
     DestRect.bottom += dc->ptlDCOrig.y;
 
+    if (dc->fs & (DC_ACCUM_APP|DC_ACCUM_WMGR))
+    {
+       IntUpdateBoundsRect(dc, &DestRect);
+    }
+
     /* In GM_COMPATIBLE, don't include bottom and right edges */
     if (pdcattr->iGraphicsMode == GM_COMPATIBLE)
     {
@@ -601,7 +626,7 @@ IntRectangle(PDC dc,
     psurf = dc->dclevel.pSurface;
     if (!psurf)
     {
-        ret = FALSE;
+        ret = TRUE;
         goto cleanup;
     }
 
@@ -615,7 +640,7 @@ IntRectangle(PDC dc,
             ret = IntEngBitBlt(&psurf->SurfObj,
                                NULL,
                                NULL,
-                               &dc->co.ClipObj,
+                               (CLIPOBJ *)&dc->co,
                                NULL,
                                &DestRect,
                                NULL,
@@ -634,28 +659,28 @@ IntRectangle(PDC dc,
     {
         Mix = ROP2_TO_MIX(pdcattr->jROP2);
         ret = ret && IntEngLineTo(&psurf->SurfObj,
-                                  &dc->co.ClipObj,
+                                  (CLIPOBJ *)&dc->co,
                                   &dc->eboLine.BrushObject,
                                   DestRect.left, DestRect.top, DestRect.right, DestRect.top,
                                   &DestRect, // Bounding rectangle
                                   Mix);
 
         ret = ret && IntEngLineTo(&psurf->SurfObj,
-                                  &dc->co.ClipObj,
+                                  (CLIPOBJ *)&dc->co,
                                   &dc->eboLine.BrushObject,
                                   DestRect.right, DestRect.top, DestRect.right, DestRect.bottom,
                                   &DestRect, // Bounding rectangle
                                   Mix);
 
         ret = ret && IntEngLineTo(&psurf->SurfObj,
-                                  &dc->co.ClipObj,
+                                  (CLIPOBJ *)&dc->co,
                                   &dc->eboLine.BrushObject,
                                   DestRect.right, DestRect.bottom, DestRect.left, DestRect.bottom,
                                   &DestRect, // Bounding rectangle
                                   Mix);
 
         ret = ret && IntEngLineTo(&psurf->SurfObj,
-                                  &dc->co.ClipObj,
+                                  (CLIPOBJ *)&dc->co,
                                   &dc->eboLine.BrushObject,
                                   DestRect.left, DestRect.bottom, DestRect.left, DestRect.top,
                                   &DestRect, // Bounding rectangle
@@ -688,12 +713,6 @@ NtGdiRectangle(HDC  hDC,
         EngSetLastError(ERROR_INVALID_HANDLE);
         return FALSE;
     }
-    if (dc->dctype == DC_TYPE_INFO)
-    {
-        DC_UnlockDc(dc);
-        /* Yes, Windows really returns TRUE in this case */
-        return TRUE;
-    }
 
     /* Do we rotate or shear? */
     if (!(dc->pdcattr->mxWorldToDevice.flAccel & XFORM_SCALE))
@@ -773,7 +792,7 @@ IntRoundRect(
         return FALSE;
     }
 
-    PenOrigWidth = PenWidth = pbrLine->ptPenWidth.x;
+    PenOrigWidth = PenWidth = pbrLine->lWidth;
     if (pbrLine->ulPenStyle == PS_NULL) PenWidth = 0;
 
     if (pbrLine->ulPenStyle == PS_INSIDEFRAME)
@@ -787,7 +806,7 @@ IntRoundRect(
     }
 
     if (!PenWidth) PenWidth = 1;
-    pbrLine->ptPenWidth.x = PenWidth;
+    pbrLine->lWidth = PenWidth;
 
     RectBounds.left = Left;
     RectBounds.top = Top;
@@ -842,7 +861,7 @@ IntRoundRect(
     }
 
 
-    pbrLine->ptPenWidth.x = PenOrigWidth;
+    pbrLine->lWidth = PenOrigWidth;
     PEN_ShareUnlockPen(pbrLine);
     return ret;
 }
@@ -867,12 +886,6 @@ NtGdiRoundRect(
         DPRINT1("NtGdiRoundRect() - hDC is invalid\n");
         EngSetLastError(ERROR_INVALID_HANDLE);
     }
-    else if (dc->dctype == DC_TYPE_INFO)
-    {
-        DC_UnlockDc(dc);
-        /* Yes, Windows really returns TRUE in this case */
-        ret = TRUE;
-    }
     else
     {
         ret = IntRoundRect ( dc, LeftRect, TopRect, RightRect, BottomRect, Width, Height );
@@ -937,15 +950,7 @@ GreGradientFill(
         return FALSE;
     }
 
-    if(pdc->dctype == DC_TYPE_INFO)
-    {
-        DC_UnlockDc(pdc);
-        /* Yes, Windows really returns TRUE in this case */
-        return TRUE;
-    }
-
-    psurf = pdc->dclevel.pSurface;
-    if(!psurf)
+    if (!pdc->dclevel.pSurface)
     {
         /* Memory DC with no surface selected */
         DC_UnlockDc(pdc);
@@ -975,12 +980,19 @@ GreGradientFill(
     ptlDitherOrg.x += pdc->ptlDCOrig.x;
     ptlDitherOrg.y += pdc->ptlDCOrig.y;
 
-    EXLATEOBJ_vInitialize(&exlo, &gpalRGB, psurf->ppal, 0, 0, 0);
+   if (pdc->fs & (DC_ACCUM_APP|DC_ACCUM_WMGR))
+   {
+      IntUpdateBoundsRect(pdc, &rclExtent);
+   }
 
     DC_vPrepareDCsForBlit(pdc, &rclExtent, NULL, NULL);
 
+    psurf = pdc->dclevel.pSurface;
+
+    EXLATEOBJ_vInitialize(&exlo, &gpalRGB, psurf->ppal, 0, 0, 0);
+
     bRet = IntEngGradientFill(&psurf->SurfObj,
-                             &pdc->co.ClipObj,
+                             (CLIPOBJ *)&pdc->co,
                              &exlo.xlo,
                              pVertex,
                              nVertex,
@@ -1083,8 +1095,10 @@ NtGdiExtFloodFill(
     UINT  FillType)
 {
     PDC dc;
+#if 0
     PDC_ATTR   pdcattr;
-    SURFACE    *psurf = NULL;
+#endif
+    SURFACE    *psurf;
     EXLATEOBJ  exlo;
     BOOL       Ret = FALSE;
     RECTL      DestRect;
@@ -1097,44 +1111,45 @@ NtGdiExtFloodFill(
         EngSetLastError(ERROR_INVALID_HANDLE);
         return FALSE;
     }
-    if (dc->dctype == DC_TYPE_INFO)
-    {
-        DC_UnlockDc(dc);
-        /* Yes, Windows really returns TRUE in this case */
-        return TRUE;
-    }
 
-    psurf = dc->dclevel.pSurface;
-    if (!psurf)
+    if (!dc->dclevel.pSurface)
     {
-        Ret = FALSE;
+        Ret = TRUE;
         goto cleanup;
     }
 
+#if 0
     pdcattr = dc->pdcattr;
-
-    if (pdcattr->ulDirty_ & (DIRTY_FILL | DC_BRUSH_DIRTY))
-        DC_vUpdateFillBrush(dc);
-
-    if (pdcattr->ulDirty_ & (DIRTY_LINE | DC_PEN_DIRTY))
-        DC_vUpdateLineBrush(dc);
+#endif
 
     Pt.x = XStart;
     Pt.y = YStart;
     IntLPtoDP(dc, (LPPOINT)&Pt, 1);
 
+    DC_vPrepareDCsForBlit(dc, &DestRect, NULL, NULL);
+
+    /// FIXME: what about prgnVIS? And what about REAL clipping?
+    psurf = dc->dclevel.pSurface;
     if (dc->prgnRao)
     {
         Ret = REGION_PtInRegion(dc->prgnRao, Pt.x, Pt.y);
         if (Ret)
-            REGION_GetRgnBox(dc->prgnRao ,(LPRECT)&DestRect);
+            REGION_GetRgnBox(dc->prgnRao(LPRECT)&DestRect);
         else
+        {
+            DC_vFinishBlit(dc, NULL);
             goto cleanup;
+        }
     }
     else
+    {
         RECTL_vSetRect(&DestRect, 0, 0, psurf->SurfObj.sizlBitmap.cx, psurf->SurfObj.sizlBitmap.cy);
+    }
 
-    DC_vPrepareDCsForBlit(dc, &DestRect, NULL, NULL);
+    if (dc->fs & (DC_ACCUM_APP|DC_ACCUM_WMGR))
+    {
+       IntUpdateBoundsRect(dc, &DestRect);
+    }
 
     EXLATEOBJ_vInitialize(&exlo, &gpalRGB, psurf->ppal, 0, 0xffffff, 0);