From 8e00d905ca189c33ce6b9cbb410cedca1fd436ac Mon Sep 17 00:00:00 2001
From: Thomas Bluemel <thomas@reactsoft.com>
Date: Thu, 11 Dec 2003 14:48:55 +0000
Subject: [PATCH] fixed NtGdiCreatePenIndirect()

svn path=/trunk/; revision=6956
---
 reactos/subsys/win32k/objects/pen.c | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/reactos/subsys/win32k/objects/pen.c b/reactos/subsys/win32k/objects/pen.c
index c6551f8dd01..9f3e83a844a 100644
--- a/reactos/subsys/win32k/objects/pen.c
+++ b/reactos/subsys/win32k/objects/pen.c
@@ -16,11 +16,13 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: pen.c,v 1.11 2003/08/19 11:48:50 weiden Exp $ */
+/* $Id: pen.c,v 1.12 2003/12/11 14:48:55 weiden Exp $ */
 #undef WIN32_LEAN_AND_MEAN
 #include <windows.h>
 #include <ddk/ntddk.h>
 #include <win32k/pen.h>
+#include <include/error.h>
+#include <internal/safe.h>
 
 #define NDEBUG
 #include <win32k/debug1.h>
@@ -43,10 +45,19 @@ HPEN
 STDCALL
 NtGdiCreatePenIndirect(CONST PLOGPEN lgpn)
 {
-  PPENOBJ penPtr;
-  HPEN    hpen;
-
-  if (lgpn->lopnStyle > PS_INSIDEFRAME) return 0;
+  PPENOBJ  penPtr;
+  LOGPEN   Safelgpn;
+  HPEN     hpen;
+  NTSTATUS Status;
+  
+  Status = MmCopyFromCaller(&Safelgpn, lgpn, sizeof(LOGPEN));
+  if(!NT_SUCCESS(Status))
+  {
+    SetLastNtError(Status);
+    return 0;
+  }
+  
+  if (Safelgpn.lopnStyle > PS_INSIDEFRAME) return 0;
 
   hpen = PENOBJ_AllocPen();
   if (!hpen) return 0;
@@ -54,9 +65,9 @@ NtGdiCreatePenIndirect(CONST PLOGPEN lgpn)
   penPtr   = PENOBJ_LockPen( hpen );
   ASSERT( penPtr );
 
-  penPtr->logpen.lopnStyle = lgpn->lopnStyle;
-  penPtr->logpen.lopnWidth = lgpn->lopnWidth;
-  penPtr->logpen.lopnColor = lgpn->lopnColor;
+  penPtr->logpen.lopnStyle = Safelgpn.lopnStyle;
+  penPtr->logpen.lopnWidth = Safelgpn.lopnWidth;
+  penPtr->logpen.lopnColor = Safelgpn.lopnColor;
   PENOBJ_UnlockPen( hpen );
   return hpen;
 }