Index: win32ss/gdi/gdi32/objects/bitmap.c =================================================================== --- win32ss/gdi/gdi32/objects/bitmap.c (revision 56551) +++ win32ss/gdi/gdi32/objects/bitmap.c (working copy) @@ -448,39 +448,73 @@ UINT cjBmpScanSize = 0; HBITMAP hBmp; NTSTATUS Status = STATUS_SUCCESS; +//Check CreateDIBitmap params acordingly to Init param. + switch( Init ) + { + case 3: + case CBM_CREATDIB: + //CBM_CREATDIB needs Data. + if ( !Data ) + { + return 0; + } + //It just work with PAL or RGB + if( ColorUse>DIB_PAL_COLORS ) + { + GdiSetLastError(ERROR_INVALID_PARAMETER); + return 0; + } + default: + case CBM_INIT: + //No Header, No life + if (!Header) + { + GdiSetLastError(ERROR_INVALID_PARAMETER); + return 0; + } + //Let's check if the Header has an appropiate Size. + if (DIB_GetBitmapInfo(Header, &width, &height, &planes, &bpp, &compr, &dibsize) == -1) + { + GdiSetLastError(ERROR_INVALID_PARAMETER); + return NULL; + } + //Checking if the Compr is incompatible. + if(compr==BI_JPEG||compr==BI_PNG||compr==BI_BITFIELDS) return 0; + //Just DIB_RGB_COLORS(0),DIB_PAL_COLORS(1) and "2" are valid. + if(ColorUse>DIB_PAL_COLORS+1) + { + GdiSetLastError(ERROR_INVALID_PARAMETER); + return 0; + } + //Negative width?No way. + if(width<0) return 0; + //Negative height?Yes. Top-down DIBs have a negative height!So Abs it. + height= abs(height); + break; + } - if (!Header) return 0; + // For Icm support. + // GdiGetHandleUserData(hdc, GDI_OBJECT_TYPE_DC, (PVOID)&pDc_Attr)) + if(Data) + { + _SEH2_TRY + { + cjBmpScanSize = GdiGetBitmapBitsSize((BITMAPINFO *)Data); + CalculateColorTableSize(&Data->bmiHeader, &ColorUse, &InfoSize); + InfoSize += Data->bmiHeader.biSize; + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + Status = _SEH2_GetExceptionCode(); + } + _SEH2_END + } + if(!NT_SUCCESS(Status)) + { + GdiSetLastError(ERROR_INVALID_PARAMETER); + return NULL; + } - if (DIB_GetBitmapInfo(Header, &width, &height, &planes, &bpp, &compr, &dibsize) == -1) - { - GdiSetLastError(ERROR_INVALID_PARAMETER); - return NULL; - } - -// For Icm support. -// GdiGetHandleUserData(hdc, GDI_OBJECT_TYPE_DC, (PVOID)&pDc_Attr)) - - if(Data) - { - _SEH2_TRY - { - cjBmpScanSize = GdiGetBitmapBitsSize((BITMAPINFO *)Data); - CalculateColorTableSize(&Data->bmiHeader, &ColorUse, &InfoSize); - InfoSize += Data->bmiHeader.biSize; - } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) - { - Status = _SEH2_GetExceptionCode(); - } - _SEH2_END - } - - if(!NT_SUCCESS(Status)) - { - GdiSetLastError(ERROR_INVALID_PARAMETER); - return NULL; - } - DPRINT("pBMI %x, Size bpp %d, dibsize %d, Conv %d, BSS %d\n", Data,bpp,dibsize,InfoSize,cjBmpScanSize); if ( !width || !height )