gdi32: Add checks for invalid color usage values.

dlls/gdi32/dib.c

@@ -169,7 +169,7 @@ static BOOL bitmapinfoheader_from_user_bitmapinfo( BITMAPINFOHEADER *dst, const
 /*******************************************************************************************
  *  Fill out a true BITMAPINFO from a variable sized BITMAPINFO / BITMAPCOREINFO.
  *
- * The resulting stanitized BITMAPINFO is guaranteed to have:
+ * The resulting sanitized BITMAPINFO is guaranteed to have:
  * - biSize set to sizeof(BITMAPINFOHEADER)
  * - biSizeImage set to the actual image size even for non-compressed DIB
  * - biClrUsed set to the size of the color table, and 0 only when there is no color table
@@ -180,6 +180,7 @@ static BOOL bitmapinfo_from_user_bitmapinfo( BITMAPINFO *dst, const BITMAPINFO *
 {
     void *src_colors;
 
+    if (coloruse > DIB_PAL_COLORS + 1) return FALSE;  /* FIXME: handle DIB_PAL_COLORS+1 format */
     if (!bitmapinfoheader_from_user_bitmapinfo( &dst->bmiHeader, &info->bmiHeader )) return FALSE;
     if (!is_valid_dib_format( &dst->bmiHeader, allow_compression )) return FALSE;
 
@@ -645,7 +646,7 @@ INT WINAPI SetDIBits( HDC hdc, HBITMAP hbitmap, UINT startscan,
     HRGN clip = 0;
     const struct gdi_dc_funcs *funcs;
 
-    if (!bitmapinfo_from_user_bitmapinfo( src_info, info, coloruse, TRUE ))
+    if (!bitmapinfo_from_user_bitmapinfo( src_info, info, coloruse, TRUE ) || coloruse > DIB_PAL_COLORS)
     {
         SetLastError( ERROR_INVALID_PARAMETER );
         return 0;
@@ -1209,6 +1210,7 @@ INT WINAPI GetDIBits(
     /* Since info may be a BITMAPCOREINFO or any of the larger BITMAPINFO structures, we'll use our
        own copy and transfer the colour info back at the end */
     if (!bitmapinfoheader_from_user_bitmapinfo( &dst_info->bmiHeader, &info->bmiHeader )) return 0;
+    if (coloruse > DIB_PAL_COLORS) return 0;
     if (bits &&
         (dst_info->bmiHeader.biCompression == BI_JPEG || dst_info->bmiHeader.biCompression == BI_PNG))
         return 0;
@@ -1426,6 +1428,7 @@ HBITMAP WINAPI CreateDIBitmap( HDC hdc, const BITMAPINFOHEADER *header,
 
     if (!bitmapinfoheader_from_user_bitmapinfo( &info, header )) return 0;
     if (info.biCompression == BI_JPEG || info.biCompression == BI_PNG) return 0;
+    if (coloruse > DIB_PAL_COLORS + 1) return 0;
     if (info.biWidth < 0) return 0;
 
     /* Top-down DIBs have a negative height */
@@ -1474,6 +1477,7 @@ HBITMAP WINAPI CreateDIBSection(HDC hdc, CONST BITMAPINFO *bmi, UINT usage,
 
     if (bits) *bits = NULL;
     if (!bitmapinfo_from_user_bitmapinfo( info, bmi, usage, FALSE )) return 0;
+    if (usage > DIB_PAL_COLORS) return 0;
     if (info->bmiHeader.biPlanes != 1)
     {
         if (info->bmiHeader.biPlanes * info->bmiHeader.biBitCount > 16) return 0;

dlls/gdi32/tests/bitmap.c

@@ -1155,6 +1155,56 @@ static void test_dib_formats(void)
     ret = GetDIBits(hdc, hbmp, 0, 2, NULL, bi, DIB_RGB_COLORS);
     ok( !ret || broken(ret), /* nt4 */ "GetDIBits succeeded with zero height\n" );
 
+    /* some functions accept DIB_PAL_COLORS+1, but not beyond */
+
+    bi->bmiHeader.biWidth = 2;
+    bi->bmiHeader.biHeight = 2;
+    bi->bmiHeader.biBitCount = 1;
+    bi->bmiHeader.biCompression = BI_RGB;
+    hdib = CreateDIBSection(hdc, bi, DIB_PAL_COLORS+1, &bits, NULL, 0);
+    ok( hdib == NULL, "CreateDIBSection succeeded with DIB_PAL_COLORS+1\n" );
+    hdib = CreateDIBitmap( hdc, &bi->bmiHeader, 0, bits, bi, DIB_PAL_COLORS+1 );
+    ok( hdib != NULL, "CreateDIBitmap failed with DIB_PAL_COLORS+1\n" );
+    DeleteObject( hdib );
+    ret = SetDIBits(hdc, hbmp, 0, 1, data, bi, DIB_PAL_COLORS+1);
+    ok( !ret, "SetDIBits succeeded with DIB_PAL_COLORS+1\n" );
+    ret = SetDIBitsToDevice( memdc, 0, 0, 1, 1, 0, 0, 0, 1, data, bi, DIB_PAL_COLORS+1 );
+    ok( ret, "SetDIBitsToDevice failed with DIB_PAL_COLORS+1\n" );
+    ret = StretchDIBits( memdc, 0, 0, 1, 1, 0, 0, 1, 1, data, bi, DIB_PAL_COLORS+1, SRCCOPY );
+    ok( ret, "StretchDIBits failed with DIB_PAL_COLORS+1\n" );
+    ret = GetDIBits(hdc, hbmp, 0, 2, data, bi, DIB_PAL_COLORS+1);
+    ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+1\n" );
+    bi->bmiHeader.biWidth = 2;
+    bi->bmiHeader.biHeight = 2;
+    bi->bmiHeader.biBitCount = 1;
+    bi->bmiHeader.biCompression = BI_RGB;
+    ret = GetDIBits(hdc, hbmp, 0, 0, NULL, bi, DIB_PAL_COLORS+1);
+    ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+1\n" );
+
+    bi->bmiHeader.biWidth = 2;
+    bi->bmiHeader.biHeight = 2;
+    bi->bmiHeader.biBitCount = 1;
+    bi->bmiHeader.biCompression = BI_RGB;
+    hdib = CreateDIBSection(hdc, bi, DIB_PAL_COLORS+2, &bits, NULL, 0);
+    ok( hdib == NULL, "CreateDIBSection succeeded with DIB_PAL_COLORS+2\n" );
+    hdib = CreateDIBitmap( hdc, &bi->bmiHeader, 0, bits, bi, DIB_PAL_COLORS+2 );
+    ok( hdib == NULL, "CreateDIBitmap succeeded with DIB_PAL_COLORS+2\n" );
+    DeleteObject( hdib );
+    ret = SetDIBits(hdc, hbmp, 0, 1, data, bi, DIB_PAL_COLORS+2);
+    ok( !ret, "SetDIBits succeeded with DIB_PAL_COLORS+2\n" );
+    ret = SetDIBitsToDevice( memdc, 0, 0, 1, 1, 0, 0, 0, 1, data, bi, DIB_PAL_COLORS+2 );
+    ok( !ret, "SetDIBitsToDevice succeeded with DIB_PAL_COLORS+2\n" );
+    ret = StretchDIBits( memdc, 0, 0, 1, 1, 0, 0, 1, 1, data, bi, DIB_PAL_COLORS+2, SRCCOPY );
+    ok( !ret, "StretchDIBits succeeded with DIB_PAL_COLORS+2\n" );
+    ret = GetDIBits(hdc, hbmp, 0, 2, data, bi, DIB_PAL_COLORS+2);
+    ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+2\n" );
+    bi->bmiHeader.biWidth = 2;
+    bi->bmiHeader.biHeight = 2;
+    bi->bmiHeader.biBitCount = 1;
+    bi->bmiHeader.biCompression = BI_RGB;
+    ret = GetDIBits(hdc, hbmp, 0, 0, NULL, bi, DIB_PAL_COLORS+2);
+    ok( !ret, "GetDIBits succeeded with DIB_PAL_COLORS+2\n" );
+
     DeleteDC( memdc );
     DeleteObject( hbmp );
     ReleaseDC( 0, hdc );

dlls/gdi32/tests/brush.c

@@ -192,6 +192,17 @@ static void test_pattern_brush(void)
     ret = GlobalFlags( mem );
     ok( ret == 2, "wrong flags %x\n", ret );
 
+    brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS );
+    ok( brush != 0, "CreateDIBPatternBrushPt failed\n" );
+    DeleteObject( brush );
+    brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 1 );
+    ok( brush != 0, "CreateDIBPatternBrushPt failed\n" );
+    DeleteObject( brush );
+    brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 2 );
+    ok( !brush, "CreateDIBPatternBrushPt succeeded\n" );
+    brush = CreateDIBPatternBrushPt( info, DIB_PAL_COLORS + 3 );
+    ok( !brush, "CreateDIBPatternBrushPt succeeded\n" );
+
     info->bmiHeader.biBitCount = 8;
     info->bmiHeader.biCompression = BI_RLE8;
     brush = CreateDIBPatternBrushPt( info, DIB_RGB_COLORS );