File tree Expand file tree Collapse file tree 1 file changed +28
-0
lines changed
Expand file tree Collapse file tree 1 file changed +28
-0
lines changed Original file line number Diff line number Diff line change @@ -228,6 +228,34 @@ CallDibBitBlt(SURFOBJ* OutputObj,
228228 SURFOBJ * psoPattern ;
229229 BOOLEAN Result ;
230230
231+ /* Validate output surface and its scan buffer */
232+ if (!OutputObj || !OutputObj -> pvScan0 )
233+ {
234+ DPRINT1 ("CallDibBitBlt: Invalid OutputObj or pvScan0\n" );
235+ return FALSE;
236+ }
237+
238+ /* Validate input surface and its scan buffer if ROP uses source */
239+ if (ROP4_USES_SOURCE (Rop4 ))
240+ {
241+ if (!InputObj || !InputObj -> pvScan0 )
242+ {
243+ DPRINT1 ("CallDibBitBlt: Invalid InputObj or pvScan0 for source-using ROP\n" );
244+ return FALSE;
245+ }
246+
247+ /* Validate source point is within source surface bounds */
248+ if (InputPoint -> x < 0 || InputPoint -> y < 0 ||
249+ InputPoint -> x >= (LONG )InputObj -> sizlBitmap .cx ||
250+ InputPoint -> y >= (LONG )InputObj -> sizlBitmap .cy )
251+ {
252+ DPRINT1 ("CallDibBitBlt: Source point (%d,%d) out of bounds for surface (%d,%d)\n" ,
253+ InputPoint -> x , InputPoint -> y ,
254+ InputObj -> sizlBitmap .cx , InputObj -> sizlBitmap .cy );
255+ return FALSE;
256+ }
257+ }
258+
231259 BltInfo .DestSurface = OutputObj ;
232260 BltInfo .SourceSurface = InputObj ;
233261 BltInfo .PatternSurface = NULL ;
You can’t perform that action at this time.
0 commit comments