From c23fd826c4dcaec744e90095c552d3d5fdce8b1e Mon Sep 17 00:00:00 2001
From: Kamil Hornicek <kamil.hornicek@reactos.org>
Date: Thu, 11 Mar 2010 23:11:00 +0000
Subject: [PATCH] [WIN32K] Prevent a possible memory leak. Use
 SURFACE_FreeSurfaceByHandle so we don't hit the "Object must not have a
 handle!" assert in GDIOBJ_FreeObj.

svn path=/trunk/; revision=46123
---
 reactos/subsystems/win32/win32k/eng/surface.c | 21 ++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/reactos/subsystems/win32/win32k/eng/surface.c b/reactos/subsystems/win32/win32k/eng/surface.c
index 1fcf4cc6b85..126347bff98 100644
--- a/reactos/subsystems/win32/win32k/eng/surface.c
+++ b/reactos/subsystems/win32/win32k/eng/surface.c
@@ -466,6 +466,7 @@ SURFMEM_bCreateDib(IN PDEVBITMAPINFO BitmapInfo,
     SURFOBJ *pso;
     PSURFACE psurf;
     SIZEL LocalSize;
+    BOOLEAN AllocatedLocally = FALSE;
 
     /*
      * First, check the format so we can get the aligned scanline width.
@@ -526,7 +527,7 @@ SURFMEM_bCreateDib(IN PDEVBITMAPINFO BitmapInfo,
             Size = BitmapInfo->Height * ScanLine;
         }
         
-        if (Size) 
+        if (Size)
         {
             /* Check for allocation flag */
             if (BitmapInfo->Flags & BMF_USERMEM)
@@ -541,7 +542,7 @@ SURFMEM_bCreateDib(IN PDEVBITMAPINFO BitmapInfo,
                                    Size,
                                    TAG_DIB);
             }
-            
+            AllocatedLocally = TRUE;
             /* Bail out if that failed */
             if (!Bits) return NULL;
         }
@@ -554,14 +555,24 @@ SURFMEM_bCreateDib(IN PDEVBITMAPINFO BitmapInfo,
 
     /* Allocate the actual surface object structure */
     psurf = SURFACE_AllocSurfaceWithHandle();
-    if (!psurf) return NULL;
-    
+    if (!psurf)
+    {
+        if(Bits && AllocatedLocally)
+        {
+            if(BitmapInfo->Flags & BMF_USERMEM)
+                EngFreeUserMem(Bits);
+            else
+                EngFreeMem(Bits);
+        }
+        return NULL;
+    }
+
     /* Lock down the surface */
     if (!SURFACE_InitBitsLock(psurf))
     {
         /* Bail out if that failed */
         SURFACE_UnlockSurface(psurf);
-        SURFACE_FreeSurface(psurf);
+        SURFACE_FreeSurfaceByHandle(psurf->BaseObject.hHmgr);
         return NULL;
     }