[NtGDI] Fix brush attribute transfer.

diff --git a/win32ss/gdi/ntgdi/brush.cpp b/win32ss/gdi/ntgdi/brush.cpp
index 2c18e25..f98b233 100644 (file)
--- a/win32ss/gdi/ntgdi/brush.cpp
+++ b/win32ss/gdi/ntgdi/brush.cpp
@@ -76,6 +76,17 @@ BRUSH::~BRUSH(
     }
 }
 
+VOID
+BRUSH::vReleaseAttribute(VOID)
+{
+    if (this->pBrushAttr != &this->BrushAttr)
+    {
+        this->BrushAttr = *this->pBrushAttr;
+        GdiPoolFree(GetBrushAttrPool(), this->pBrushAttr);
+        this->pBrushAttr = &this->BrushAttr;
+    }
+}
+
 VOID
 BRUSH::vDeleteObject(
     _In_ PVOID pvObject)
@@ -543,10 +554,19 @@ NtGdiSetBrushAttributes(
     _In_ HBRUSH hbr,
     _In_ DWORD dwFlags)
 {
+    PBRUSH pbr;
     if ( dwFlags & SC_BB_STOCKOBJ )
     {
         if (GDIOBJ_ConvertToStockObj((HGDIOBJ*)&hbr))
         {
+            pbr = BRUSH::LockAny(hbr);
+            if (pbr == NULL)
+            {
+                ERR("Failed to lock brush %p\n", hbr);
+                return NULL;
+            }
+            pbr->vReleaseAttribute();
+            pbr->vUnlock();
             return hbr;
         }
     }
@@ -560,10 +580,22 @@ NtGdiClearBrushAttributes(
     _In_ HBRUSH hbr,
     _In_ DWORD dwFlags)
 {
+    PBRUSH pbr;
     if ( dwFlags & SC_BB_STOCKOBJ )
     {
         if (GDIOBJ_ConvertFromStockObj((HGDIOBJ*)&hbr))
         {
+            pbr = BRUSH::LockAny(hbr);
+            if (pbr == NULL)
+            {
+                ERR("Failed to lock brush %p\n", hbr);
+                return NULL;
+            }
+            if (!pbr->bAllocateBrushAttr())
+            {
+                ERR("Failed to allocate brush attribute\n");
+            }
+            pbr->vUnlock();
             return hbr;
         }
     }

diff --git a/win32ss/gdi/ntgdi/brush.hpp b/win32ss/gdi/ntgdi/brush.hpp
index 4fea65e..027db24 100644 (file)
--- a/win32ss/gdi/ntgdi/brush.hpp
+++ b/win32ss/gdi/ntgdi/brush.hpp
@@ -113,6 +113,8 @@ public:
     VOID
     vSetSolidColor(
         _In_ COLORREF crColor);
+
+    VOID vReleaseAttribute(VOID);
 };
 
 /* HACK! */