From: Zebediah Figura Subject: [PATCH 2/2] win32u: Do not free user memory when deleting dibs created with NtGdiDdDDICreateDCFromMemory(). Message-Id: <20211120003051.3192995-2-zfigura@codeweavers.com> Date: Fri, 19 Nov 2021 18:30:51 -0600 In-Reply-To: <20211120003051.3192995-1-zfigura@codeweavers.com> References: <20211120003051.3192995-1-zfigura@codeweavers.com> This fixes a test crash in ddraw:ddraw1 introduced by 7d2a7b94aad8a776a2ee3031a18bb3b53d5925cd. Signed-off-by: Zebediah Figura --- dlls/gdi32/tests/bitmap.c | 6 +++--- dlls/win32u/dib.c | 20 +++++++++++++++++++- 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/dlls/gdi32/tests/bitmap.c b/dlls/gdi32/tests/bitmap.c index a244414660b..93793ad7108 100644 --- a/dlls/gdi32/tests/bitmap.c +++ b/dlls/gdi32/tests/bitmap.c @@ -5969,11 +5969,11 @@ static void test_D3DKMTCreateDCFromMemory( void ) size = VirtualQuery( alloc_data, &memory_info, sizeof(memory_info) ); ok(size == sizeof(memory_info), "Got unexpected size %u.\n", size); - todo_wine ok(memory_info.State == MEM_COMMIT, "Got state %#x.\n", memory_info.State); - todo_wine ok(memory_info.Protect == PAGE_READWRITE, "Got protection %#x.\n", memory_info.Protect); + ok(memory_info.State == MEM_COMMIT, "Got state %#x.\n", memory_info.State); + ok(memory_info.Protect == PAGE_READWRITE, "Got protection %#x.\n", memory_info.Protect); ret = VirtualFree( alloc_data, 0, MEM_RELEASE ); - todo_wine ok(ret, "Failed to free memory, error %u.\n", GetLastError()); + ok(ret, "Failed to free memory, error %u.\n", GetLastError()); } START_TEST(bitmap) diff --git a/dlls/win32u/dib.c b/dlls/win32u/dib.c index b27b341d470..ee82d1a8ed8 100644 --- a/dlls/win32u/dib.c +++ b/dlls/win32u/dib.c @@ -1574,6 +1574,24 @@ error: } +static BOOL memory_dib_DeleteObject( HGDIOBJ handle ) +{ + BITMAPOBJ *bmp; + + if (!(bmp = free_gdi_handle( handle ))) return FALSE; + + free( bmp->color_table ); + free( bmp ); + return TRUE; +} + + +static const struct gdi_obj_funcs memory_dib_funcs = +{ + .pGetObjectW = DIB_GetObject, + .pDeleteObject = memory_dib_DeleteObject, +}; + /*********************************************************************** * NtGdiDdDDICreateDCFromMemory (win32u.@) */ @@ -1673,7 +1691,7 @@ NTSTATUS WINAPI NtGdiDdDDICreateDCFromMemory( D3DKMT_CREATEDCFROMMEMORY *desc ) } } - if (!(bitmap = alloc_gdi_handle( &bmp->obj, NTGDI_OBJ_BITMAP, &dib_funcs ))) goto error; + if (!(bitmap = alloc_gdi_handle( &bmp->obj, NTGDI_OBJ_BITMAP, &memory_dib_funcs ))) goto error; desc->hDc = dc; desc->hBitmap = bitmap; -- 2.33.0