From e07232f6736708ed004fa92d83307226f410a922 Mon Sep 17 00:00:00 2001 From: Timo Kreuzer Date: Sun, 15 Feb 2015 00:05:50 +0000 Subject: [PATCH] [WIN32K] In NtGdiGetDIBitsInternal limit the size of what is being copied back to to usermode to the cjMaxInfo parameter. Fixes crash of Firefox when downloading files. CORE-8895 #resolve svn path=/trunk/; revision=66273 --- reactos/win32ss/gdi/ntgdi/dibobj.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/reactos/win32ss/gdi/ntgdi/dibobj.c b/reactos/win32ss/gdi/ntgdi/dibobj.c index d91d8e44423..c2b2926fbfe 100644 --- a/reactos/win32ss/gdi/ntgdi/dibobj.c +++ b/reactos/win32ss/gdi/ntgdi/dibobj.c @@ -674,7 +674,7 @@ GreGetDIBitsInternal( RGBQUAD* rgbQuads; VOID* colorPtr; - DPRINT("Entered NtGdiGetDIBitsInternal()\n"); + DPRINT("Entered GreGetDIBitsInternal()\n"); if ((Usage && Usage != DIB_PAL_COLORS) || !Info || !hBitmap) return 0; @@ -1090,7 +1090,7 @@ NtGdiGetDIBitsInternal( _SEH2_TRY { /* Copy the data back */ - cjMaxInfo = DIB_BitmapInfoSize(pbmi, (WORD)iUsage); + cjMaxInfo = min(cjMaxInfo, DIB_BitmapInfoSize(pbmi, (WORD)iUsage)); ProbeForWrite(pbmiUser, cjMaxInfo, 1); RtlCopyMemory(pbmiUser, pbmi, cjMaxInfo); }