gdi32: Add a helper function to copy BITMAPINFO structures to avoid copying uninitialized data.

dlls/gdi32/bitblt.c

@@ -245,7 +245,7 @@ BOOL nulldrv_StretchBlt( PHYSDEV dst_dev, struct bitblt_coords *dst,
     if (err) return FALSE;
 
     dst_dev = GET_DC_PHYSDEV( dc_dst, pPutImage );
-    memcpy( dst_info, src_info, FIELD_OFFSET( BITMAPINFO, bmiColors[256] ));
+    copy_bitmapinfo( dst_info, src_info );
     err = dst_dev->funcs->pPutImage( dst_dev, 0, 0, dst_info, &bits, src, dst, rop );
     if (err == ERROR_BAD_FORMAT)
     {
@@ -288,7 +288,7 @@ BOOL nulldrv_StretchBlt( PHYSDEV dst_dev, struct bitblt_coords *dst,
     if (err == ERROR_TRANSFORM_NOT_SUPPORTED &&
         ((src->width != dst->width) || (src->height != dst->height)))
     {
-        memcpy( src_info, dst_info, FIELD_OFFSET( BITMAPINFO, bmiColors[256] ));
+        copy_bitmapinfo( src_info, dst_info );
         err = stretch_bits( src_info, src, dst_info, dst, &bits, GetStretchBltMode( dst_dev->hdc ));
         if (!err) err = dst_dev->funcs->pPutImage( dst_dev, 0, 0, dst_info, &bits, src, dst, rop );
     }
@@ -316,7 +316,7 @@ BOOL nulldrv_AlphaBlend( PHYSDEV dst_dev, struct bitblt_coords *dst,
     if (err) goto done;
 
     dst_dev = GET_DC_PHYSDEV( dc_dst, pBlendImage );
-    memcpy( dst_info, src_info, FIELD_OFFSET( BITMAPINFO, bmiColors[256] ));
+    copy_bitmapinfo( dst_info, src_info );
     err = dst_dev->funcs->pBlendImage( dst_dev, dst_info, &bits, src, dst, func );
     if (err == ERROR_BAD_FORMAT)
     {
@@ -341,7 +341,7 @@ BOOL nulldrv_AlphaBlend( PHYSDEV dst_dev, struct bitblt_coords *dst,
     if (err == ERROR_TRANSFORM_NOT_SUPPORTED &&
         ((src->width != dst->width) || (src->height != dst->height)))
     {
-        memcpy( src_info, dst_info, FIELD_OFFSET( BITMAPINFO, bmiColors[256] ));
+        copy_bitmapinfo( src_info, dst_info );
         err = stretch_bits( src_info, src, dst_info, dst, &bits, COLORONCOLOR );
         if (!err) err = dst_dev->funcs->pBlendImage( dst_dev, dst_info, &bits, src, dst, func );
     }

dlls/gdi32/dib.c

@@ -184,6 +184,7 @@ static BOOL bitmapinfo_from_user_bitmapinfo( BITMAPINFO *dst, const BITMAPINFO *
     {
         /* bitfields are always at bmiColors even in larger structures */
         memcpy( dst->bmiColors, info->bmiColors, 3 * sizeof(DWORD) );
+        dst->bmiHeader.biClrUsed = 0;
     }
     else if (colors)
     {
@@ -497,7 +498,7 @@ INT nulldrv_StretchDIBits( PHYSDEV dev, INT xDst, INT yDst, INT widthDst, INT he
     if (clip) OffsetRgn( clip, dst.x - src.x, dst.y - src.y );
 
     dev = GET_DC_PHYSDEV( dc, pPutImage );
-    memcpy( dst_info, src_info, FIELD_OFFSET( BITMAPINFO, bmiColors[256] ));
+    copy_bitmapinfo( dst_info, src_info );
     err = dev->funcs->pPutImage( dev, 0, clip, dst_info, &src_bits, &src, &dst, rop );
     if (err == ERROR_BAD_FORMAT)
     {
@@ -523,7 +524,7 @@ INT nulldrv_StretchDIBits( PHYSDEV dev, INT xDst, INT yDst, INT widthDst, INT he
 
     if (err == ERROR_TRANSFORM_NOT_SUPPORTED)
     {
-        memcpy( src_info, dst_info, FIELD_OFFSET( BITMAPINFO, bmiColors[256] ));
+        copy_bitmapinfo( src_info, dst_info );
         err = stretch_bits( src_info, &src, dst_info, &dst, &src_bits, GetStretchBltMode( dev->hdc ) );
         if (!err) err = dev->funcs->pPutImage( dev, 0, NULL, dst_info, &src_bits, &src, &dst, rop );
     }
@@ -678,7 +679,7 @@ INT WINAPI SetDIBits( HDC hdc, HBITMAP hbitmap, UINT startscan,
     dst.width  = dst.visrect.right - dst.visrect.left;
     dst.height = dst.visrect.bottom - dst.visrect.top;
 
-    memcpy( dst_info, src_info, FIELD_OFFSET( BITMAPINFO, bmiColors[256] ));
+    copy_bitmapinfo( dst_info, src_info );
 
     err = funcs->pPutImage( NULL, hbitmap, clip, dst_info, &src_bits, &src, &dst, 0 );
     if (err == ERROR_BAD_FORMAT)
@@ -809,7 +810,7 @@ INT nulldrv_SetDIBitsToDevice( PHYSDEV dev, INT x_dst, INT y_dst, DWORD cx, DWOR
     if (clip) OffsetRgn( clip, dst.x - src.x, dst.y - src.y );
 
     dev = GET_DC_PHYSDEV( dc, pPutImage );
-    memcpy( dst_info, src_info, FIELD_OFFSET( BITMAPINFO, bmiColors[256] ));
+    copy_bitmapinfo( dst_info, src_info );
     err = dev->funcs->pPutImage( dev, 0, clip, dst_info, &src_bits, &src, &dst, SRCCOPY );
     if (err == ERROR_BAD_FORMAT)
     {

dlls/gdi32/gdi_private.h

@@ -482,6 +482,13 @@ static inline int get_dib_num_of_colors( const BITMAPINFO *info )
     return info->bmiHeader.biBitCount > 8 ? 0 : 1 << info->bmiHeader.biBitCount;
 }
 
+static inline void copy_bitmapinfo( BITMAPINFO *dst, const BITMAPINFO *src )
+{
+    unsigned int size = FIELD_OFFSET( BITMAPINFO, bmiColors[get_dib_num_of_colors( src )] );
+    if (src->bmiHeader.biCompression == BI_BITFIELDS) size += 3 * sizeof(DWORD);
+    memcpy( dst, src, size );
+}
+
 static inline const struct gdi_dc_funcs *get_bitmap_funcs( const BITMAPOBJ *bitmap )
 {
     if( bitmap->dib ) return &dib_driver;