From c0f18d059af375fe6bdcf01c0387268323ee907d Mon Sep 17 00:00:00 2001 From: Ahmed Arif Date: Sat, 27 Jun 2026 17:03:48 +0200 Subject: [PATCH] [WIN32SS:GDI] Fix an off-by-one error in the StretchBlt mask bounds check (#9136) The mask bounds check in `DIB_XXBPP_StretchBlt` allowed `sx == cx` (and similar for `sy`), reading one pixel past the end of the mask bitmap. On the contrary, the source-surface check a few lines below already does it right. --- win32ss/gdi/dib/stretchblt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/win32ss/gdi/dib/stretchblt.c b/win32ss/gdi/dib/stretchblt.c index 718d8183f7a..696c1aa31b9 100644 --- a/win32ss/gdi/dib/stretchblt.c +++ b/win32ss/gdi/dib/stretchblt.c @@ -174,7 +174,7 @@ BOOLEAN DIB_XXBPP_StretchBlt(SURFOBJ *DestSurf, SURFOBJ *SourceSurf, SURFOBJ *Ma sx = SourceRect->left+(DesX - DestRect->left) * SrcWidth / DstWidth; } if (sx < 0 || sy < 0 || - MaskSurf->sizlBitmap.cx < sx || MaskCy < sy || + MaskSurf->sizlBitmap.cx <= sx || MaskCy <= sy || fnMask_GetPixel(MaskSurf, sx, sy) != 0) { CanDraw = FALSE;