From: Thomas Faber <thomas.faber@reactos.org>
Date: Sat, 8 Aug 2015 14:57:47 +0000 (+0000)
Subject: [WIN32K:NTGDI]
X-Git-Tag: ReactOS-0.4.0~1394
X-Git-Url: https://git.reactos.org/?p=reactos.git;a=commitdiff_plain;h=6371885a1493c08a1c373f3f692531e449a1268a

[WIN32K:NTGDI]
- Improve invalid parameter handling in IntGdiExtCreatePen. Patch by Benedikt Freisen.
CORE-9740 #resolve

svn path=/trunk/; revision=68630
---

diff --git a/reactos/win32ss/gdi/ntgdi/pen.c b/reactos/win32ss/gdi/ntgdi/pen.c
index c1a2ce0c7f0..058ca43483e 100644
--- a/reactos/win32ss/gdi/ntgdi/pen.c
+++ b/reactos/win32ss/gdi/ntgdi/pen.c
@@ -135,6 +135,9 @@ IntGdiExtCreatePen(
     // If dwPenStyle is PS_COSMETIC, the width must be set to 1.
     if ( !(bOldStylePen) && ((dwPenStyle & PS_TYPE_MASK) == PS_COSMETIC) && ( dwWidth != 1) )
         goto ExitCleanup;
+    // If dwPenStyle is PS_COSMETIC, the brush style must be BS_SOLID.
+    if ( !(bOldStylePen) && ((dwPenStyle & PS_TYPE_MASK) == PS_COSMETIC) && (ulBrushStyle != BS_SOLID) )
+        goto ExitCleanup;
 
     switch (dwPenStyle & PS_STYLE_MASK)
     {
@@ -205,6 +208,7 @@ IntGdiExtCreatePen(
 
     default:
         DPRINT1("IntGdiExtCreatePen unknown penstyle %x\n", dwPenStyle);
+        goto ExitCleanup;
     }
 
     PEN_UnlockPen(pbrushPen);