From 9d118cb21afe7bccca03b3fa21daea3206cd20b9 Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Sat, 28 Apr 2007 21:53:06 +0000
Subject: [PATCH] BRUSH_GetObject: - return sizeof(LOBRUSH) not BRUSHOBJ -
 don't return 0 on too small usermode buffer NtGdiExtGetObjectW: - remove
 unnecessary hacks - no need to align usermode buffer to words - add
 ENUMLOGFONTEXDVW, wich should be the biggest structure needed more fixes for
 fonts and extpens needed in the corresponding subfunctions, but all of my
 other tests pass now.

svn path=/trunk/; revision=26565
---
 .../subsystems/win32/win32k/objects/brush.c   |  5 +-
 reactos/subsystems/win32/win32k/objects/dc.c  | 78 ++++---------------
 2 files changed, 17 insertions(+), 66 deletions(-)

diff --git a/reactos/subsystems/win32/win32k/objects/brush.c b/reactos/subsystems/win32/win32k/objects/brush.c
index 3c1675fc3e4..2bad4af73be 100644
--- a/reactos/subsystems/win32/win32k/objects/brush.c
+++ b/reactos/subsystems/win32/win32k/objects/brush.c
@@ -52,9 +52,8 @@ BRUSH_Cleanup(PVOID ObjectBody)
 INT FASTCALL
 BRUSH_GetObject (PGDIBRUSHOBJ BrushObject, INT Count, LPLOGBRUSH Buffer)
 {
-   if( Buffer == NULL ) return sizeof(BRUSHOBJ);
+   if( Buffer == NULL ) return sizeof(LOGBRUSH);
    if (Count == 0) return 0;
-   if ((UINT)Count < sizeof(BRUSHOBJ)) return 0;
 
    /* Set colour */
     Buffer->lbColor =  BrushObject->BrushAttr.lbColor;
@@ -106,7 +105,7 @@ BRUSH_GetObject (PGDIBRUSHOBJ BrushObject, INT Count, LPLOGBRUSH Buffer)
     */
 
     /* FIXME */
-    return sizeof(BRUSHOBJ);
+    return sizeof(LOGBRUSH);
 }
 
 
diff --git a/reactos/subsystems/win32/win32k/objects/dc.c b/reactos/subsystems/win32/win32k/objects/dc.c
index a8deb1a7813..8fc1cc08d52 100644
--- a/reactos/subsystems/win32/win32k/objects/dc.c
+++ b/reactos/subsystems/win32/win32k/objects/dc.c
@@ -1817,92 +1817,44 @@ NtGdiExtGetObjectW(IN HANDLE hGdiObj,
                    OUT LPVOID lpBuffer)
 {
     INT iRetCount = 0;
-    INT iObjectType;
-    INT cbRealCount = cbCount;
+    INT cbCopyCount;
     union
     {
-        BITMAP bmpObject;
-        DIBSECTION disObject;
-        LOGPEN lgpObject;
-        LOGBRUSH lgbObject;
-        LOGFONTW lgfObject;
-        EXTLOGFONTW elgfObject;
+        BITMAP bitmap;
+        DIBSECTION dibsection;
+        LOGPEN logpen;
+        LOGBRUSH logbrush;
+        LOGFONTW logfontw;
+        EXTLOGFONTW extlogfontw;
+        ENUMLOGFONTEXDVW enumlogfontexdvw;
     } Object;
 
-    //
-    // Get the object type
-    //
-    iObjectType = GDIOBJ_GetObjectType(hGdiObj);
+    // Normalize to the largest supported object size
+    cbCount = min((UINT)cbCount, sizeof(Object));
 
-    //
-    // Check if the given size is too large
-    //
-    if (cbCount > sizeof(Object))
-    {
-        //
-        // Normalize to the largest supported object size
-        //
-        DPRINT1("cbCount too big!\n");
-        cbCount = sizeof(Object);
-    }
-
-    //
-    // Check if this is a brush
-    //
-    if (iObjectType == GDI_OBJECT_TYPE_BRUSH)
-    {
-        //
-        // Windows GDI Hack: Manually correct the size
-        //
-        cbCount = sizeof(LOGBRUSH);
-    }
-
-    //
     // Now do the actual call
-    //
     iRetCount = IntGdiGetObject(hGdiObj, cbCount, lpBuffer ? &Object : NULL);
+    cbCopyCount = min((UINT)cbCount, (UINT)iRetCount);
 
-    //
-    // Check if this is a brush
-    //
-    if (iObjectType == GDI_OBJECT_TYPE_BRUSH)
+    // Make sure we have a buffer and a copy size
+    if ((cbCopyCount) && (lpBuffer))
     {
-        //
-        // Fixup the size to account for our previous fixup
-        //
-        cbCount = min(cbCount, cbRealCount);
-    }
-
-    //
-    // Make sure we have a buffer and a return size
-    //
-    if ((iRetCount) && (lpBuffer))
-    {
-        //
         // Enter SEH for buffer transfer
-        //
         _SEH_TRY
         {
-            //
             // Probe the buffer and copy it
-            //
-            ProbeForWrite(lpBuffer, min(cbCount, cbRealCount), sizeof(WORD));
-            RtlCopyMemory(lpBuffer, &Object, min(cbCount, cbRealCount));
+            ProbeForWrite(lpBuffer, cbCopyCount, 1);
+            RtlCopyMemory(lpBuffer, &Object, cbCopyCount);
         }
         _SEH_HANDLE
         {
-            //
             // Clear the return value.
             // Do *NOT* set last error here!
-            //
             iRetCount = 0;
         }
         _SEH_END;
     }
-
-    //
     // Return the count
-    //
     return iRetCount;
 }