[WIN32K]

Fix ROP2 value coming from user mode before using it.

svn path=/trunk/; revision=66225

reactos/win32ss/gdi/ntgdi/bitblt.c

@@ -1150,7 +1150,7 @@ IntGdiFillRgn(
                            &prgnClip->rdh.rcBound );
 
     /* Get the FG rop and create a MIX based on the BK mode */
-    rop2Fg = pdc->pdcattr->jROP2;
+    rop2Fg = FIXUP_ROP2(pdc->pdcattr->jROP2);
     mix = rop2Fg | (pdc->pdcattr->jBkMode == OPAQUE ? rop2Fg : R2_NOP) << 8;
 
     /* Prepare DC for blit */

reactos/win32ss/gdi/ntgdi/intgdi.h

@@ -5,6 +5,9 @@
 #define FIXUP_ROP(Rop) if(((Rop) & 0xFF000000) == 0) Rop = MAKEROP4((Rop), (Rop))
 #define ROP_TO_ROP4(Rop) ((Rop) >> 16)
 
+/* The range of valid ROP2 values is 1 .. 16 */
+#define FIXUP_ROP2(rop2) ((((rop2) - 1) & 0xF) + 1)
+
 /* Brush functions */
 
 extern HDC hSystemBM;