gdi32: Add more parameter checks in GdiGradientFill.

dlls/gdi32/painting.c

@@ -1219,11 +1219,12 @@ POINT *GDI_Bezier( const POINT *Points, INT count, INT *nPtsOut )
  *           GdiGradientFill   (GDI32.@)
  */
 BOOL WINAPI GdiGradientFill( HDC hdc, TRIVERTEX *vert_array, ULONG nvert,
-                          void * grad_array, ULONG ngrad, ULONG mode )
+                             void *grad_array, ULONG ngrad, ULONG mode )
 {
     DC *dc;
     PHYSDEV physdev;
     BOOL ret;
+    ULONG i;
 
     TRACE("%p vert_array:%p nvert:%d grad_array:%p ngrad:%d\n", hdc, vert_array, nvert, grad_array, ngrad);
 
@@ -1232,12 +1233,14 @@ BOOL WINAPI GdiGradientFill( HDC hdc, TRIVERTEX *vert_array, ULONG nvert,
         SetLastError( ERROR_INVALID_PARAMETER );
         return FALSE;
     }
+    for (i = 0; i < ngrad * (mode == GRADIENT_FILL_TRIANGLE ? 3 : 2); i++)
+        if (((ULONG *)grad_array)[i] >= nvert) return FALSE;
+
     if (!(dc = get_dc_ptr( hdc )))
     {
         SetLastError( ERROR_INVALID_PARAMETER );
         return FALSE;
     }
-
     update_dc( dc );
     physdev = GET_DC_PHYSDEV( dc, pGradientFill );
     ret = physdev->funcs->pGradientFill( physdev, vert_array, nvert, grad_array, ngrad, mode );

dlls/gdi32/tests/bitmap.c

@@ -3417,6 +3417,17 @@ static void test_GdiGradientFill(void)
     ok( !ret, "GdiGradientFill succeeded\n" );
     ok( GetLastError() == ERROR_INVALID_PARAMETER, "wrong error %u\n", GetLastError() );
     SetLastError( 0xdeadbeef );
+    ret = pGdiGradientFill( hdc, vt, 3, rect, 3, GRADIENT_FILL_RECT_H );
+    ok( !ret, "GdiGradientFill succeeded\n" );
+    ok( GetLastError() == 0xdeadbeef, "wrong error %u\n", GetLastError() );
+    rect[2].UpperLeft = rect[2].LowerRight = 1;
+    SetLastError( 0xdeadbeef );
+    ret = pGdiGradientFill( hdc, vt, 3, rect, 3, GRADIENT_FILL_RECT_H );
+    ok( ret, "GdiGradientFill failed err %u\n", GetLastError() );
+    SetLastError( 0xdeadbeef );
+    ret = pGdiGradientFill( hdc, vt, 1, rect, 1, GRADIENT_FILL_RECT_H );
+    ok( ret, "GdiGradientFill failed err %u\n", GetLastError() );
+    SetLastError( 0xdeadbeef );
     ret = pGdiGradientFill( hdc, vt, 1, tri, 0, GRADIENT_FILL_TRIANGLE );
     ok( !ret, "GdiGradientFill succeeded\n" );
     ok( GetLastError() == ERROR_INVALID_PARAMETER, "wrong error %u\n", GetLastError() );
@@ -3429,6 +3440,24 @@ static void test_GdiGradientFill(void)
     SetLastError( 0xdeadbeef );
     ret = pGdiGradientFill( hdc, vt, 3, tri, 3, GRADIENT_FILL_TRIANGLE );
     ok( ret, "GdiGradientFill failed err %u\n", GetLastError() );
+    SetLastError( 0xdeadbeef );
+    ret = pGdiGradientFill( hdc, vt, 3, tri, 4, GRADIENT_FILL_TRIANGLE );
+    ok( !ret, "GdiGradientFill succeeded\n" );
+    ok( GetLastError() == 0xdeadbeef, "wrong error %u\n", GetLastError() );
+    tri[3].Vertex3 = 1;
+    SetLastError( 0xdeadbeef );
+    ret = pGdiGradientFill( hdc, vt, 3, tri, 4, GRADIENT_FILL_TRIANGLE );
+    ok( !ret, "GdiGradientFill succeeded\n" );
+    ok( GetLastError() == 0xdeadbeef, "wrong error %u\n", GetLastError() );
+    tri[3].Vertex3 = 0;
+    SetLastError( 0xdeadbeef );
+    ret = pGdiGradientFill( hdc, vt, 3, tri, 4, GRADIENT_FILL_TRIANGLE );
+    ok( !ret, "GdiGradientFill succeeded\n" );
+    ok( GetLastError() == 0xdeadbeef, "wrong error %u\n", GetLastError() );
+    tri[3].Vertex1 = tri[3].Vertex2 = tri[3].Vertex3 = 1;
+    SetLastError( 0xdeadbeef );
+    ret = pGdiGradientFill( hdc, vt, 3, tri, 4, GRADIENT_FILL_TRIANGLE );
+    ok( ret, "GdiGradientFill failed err %u\n", GetLastError() );
 
     DeleteDC( hdc );
     DeleteObject( bmp );