From fd2013dc9e6ab1e716ebd9d1e1ecf8ae006e4014 Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Sat, 21 Apr 2012 16:05:24 +0000
Subject: [PATCH] [WIN32K] In NtGdiGetTextExtentExW fail when Count is
 negative.

svn path=/trunk/; revision=56384
---
 reactos/win32ss/gdi/ntgdi/text.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/reactos/win32ss/gdi/ntgdi/text.c b/reactos/win32ss/gdi/ntgdi/text.c
index cc9cfdf29ee..31dcbe2ecfa 100644
--- a/reactos/win32ss/gdi/ntgdi/text.c
+++ b/reactos/win32ss/gdi/ntgdi/text.c
@@ -278,6 +278,12 @@ NtGdiGetTextExtentExW(
     LPINT Dx;
     PTEXTOBJ TextObj;
 
+    if ((LONG)Count < 0)
+    {
+        EngSetLastError(ERROR_INVALID_PARAMETER);
+        return FALSE;
+    }
+
     /* FIXME: Handle fl */
 
     if (0 == Count)