riched20: Don't assume that TxDraw preserves the device context's brush selection.

Today, RichEditWndProc_common assumes that ITextServices::TxDraw preserves the brush selection of the given device context. However, this invariant may be broken by misbehaving embedded OLE objects in the text document. Fix this by not assuming that the return value of the second SelectObject() call equals the brush passed to the first SelectObject() call in RichEditWndProc_common's WM_PAINT / WM_PRINTCLIENT case. (cherry picked from commit 2027be7e)

riched20: Don't assume that TxDraw preserves the device context's brush selection.
51997177 · Jinoh Kang · Alexandre Julliard · 7b360c9c · 51997177
Commit 51997177 authored Mar 04, 2023 by Jinoh Kang Committed by Alexandre Julliard Apr 19, 2023
Hide whitespace changes
Inline Side-by-side

Showing with 5 additions and 3 deletions

txthost.c dlls/riched20/txthost.c +5 -3

No files found.
--- a/dlls/riched20/txthost.c
+++ b/dlls/riched20/txthost.c
@@ -1312,7 +1312,7 @@ static LRESULT RichEditWndProc_common( HWND hwnd, UINT msg, WPARAM wparam,
        HDC hdc;
        RECT rc, client, update;
        PAINTSTRUCT ps;
-        HBRUSH brush = CreateSolidBrush( ITextHost_TxGetSysColor( &host->ITextHost_iface, COLOR_WINDOW ) );
+        HBRUSH brush, old_brush;

        ITextHost_TxGetClientRect( &host->ITextHost_iface, &client );

@@ -1327,7 +1327,8 @@ static LRESULT RichEditWndProc_common( HWND hwnd, UINT msg, WPARAM wparam,
            update = client;
        }

-        brush = SelectObject( hdc, brush );
+        brush = CreateSolidBrush( ITextHost_TxGetSysColor( &host->ITextHost_iface, COLOR_WINDOW ) );
+        old_brush = SelectObject( hdc, brush );

        /* Erase area outside of the formatting rectangle */
        if (update.top < client.top)
@@ -1361,7 +1362,8 @@ static LRESULT RichEditWndProc_common( HWND hwnd, UINT msg, WPARAM wparam,

        ITextServices_TxDraw( host->text_srv, DVASPECT_CONTENT, 0, NULL, NULL, hdc, NULL, NULL, NULL,
                              &update, NULL, 0, TXTVIEW_ACTIVE );
-        DeleteObject( SelectObject( hdc, brush ) );
+        SelectObject( hdc, old_brush );
+        DeleteObject( brush );
        if (msg == WM_PAINT) EndPaint( hwnd, &ps );
        return 0;
    }