From a9a2c6971fc02d0154e64b0d0df0742fbd2d4eee Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Wed, 11 Feb 2015 21:32:54 +0000
Subject: [PATCH] [WIN32K] Fix ROP2 value coming from user mode before using
 it.

svn path=/trunk/; revision=66225
---
 reactos/win32ss/gdi/ntgdi/bitblt.c | 2 +-
 reactos/win32ss/gdi/ntgdi/intgdi.h | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/reactos/win32ss/gdi/ntgdi/bitblt.c b/reactos/win32ss/gdi/ntgdi/bitblt.c
index 16a68e7f20a..a0b07248918 100644
--- a/reactos/win32ss/gdi/ntgdi/bitblt.c
+++ b/reactos/win32ss/gdi/ntgdi/bitblt.c
@@ -1150,7 +1150,7 @@ IntGdiFillRgn(
                            &prgnClip->rdh.rcBound );
 
     /* Get the FG rop and create a MIX based on the BK mode */
-    rop2Fg = pdc->pdcattr->jROP2;
+    rop2Fg = FIXUP_ROP2(pdc->pdcattr->jROP2);
     mix = rop2Fg | (pdc->pdcattr->jBkMode == OPAQUE ? rop2Fg : R2_NOP) << 8;
 
     /* Prepare DC for blit */
diff --git a/reactos/win32ss/gdi/ntgdi/intgdi.h b/reactos/win32ss/gdi/ntgdi/intgdi.h
index 9ca7e7c564a..09cc538c94d 100644
--- a/reactos/win32ss/gdi/ntgdi/intgdi.h
+++ b/reactos/win32ss/gdi/ntgdi/intgdi.h
@@ -5,6 +5,9 @@
 #define FIXUP_ROP(Rop) if(((Rop) & 0xFF000000) == 0) Rop = MAKEROP4((Rop), (Rop))
 #define ROP_TO_ROP4(Rop) ((Rop) >> 16)
 
+/* The range of valid ROP2 values is 1 .. 16 */
+#define FIXUP_ROP2(rop2) ((((rop2) - 1) & 0xF) + 1)
+
 /* Brush functions */
 
 extern HDC hSystemBM;