From 77eb553987ec40e2e534148d5fc18b7fae7cb386 Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Sun, 5 Apr 2015 08:40:52 +0000
Subject: [PATCH] [WIN32K] Check in BltMask if the masking operation would
 exceed the mask bitmap. Should fix crash when running gdi32_apitest MaskBlt.
 CORE-9483

svn path=/trunk/; revision=67058
---
 reactos/win32ss/gdi/eng/bitblt.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/reactos/win32ss/gdi/eng/bitblt.c b/reactos/win32ss/gdi/eng/bitblt.c
index 8d40b4ec795..bd4a599599b 100644
--- a/reactos/win32ss/gdi/eng/bitblt.c
+++ b/reactos/win32ss/gdi/eng/bitblt.c
@@ -51,7 +51,7 @@ BltMask(SURFOBJ* psoDest,
         POINTL* pptlBrush,
         ROP4 Rop4)
 {
-    LONG x, y;
+    LONG x, y, cx, cy;
     BYTE *pjMskLine, *pjMskCurrent;
     BYTE fjMaskBit0, fjMaskBit;
     /* Pattern brushes */
@@ -88,6 +88,14 @@ BltMask(SURFOBJ* psoDest,
     else
         psoPattern = NULL;
 
+    cx = prclDest->right - prclDest->left;
+    cy = prclDest->bottom - prclDest->top;
+    if ((pptlMask->x + cx > psoMask->sizlBitmap.cx) ||
+        (pptlMask->y + cy > psoMask->sizlBitmap.cy))
+    {
+        return FALSE;
+    }
+
     pjMskLine = (PBYTE)psoMask->pvScan0 + pptlMask->y * psoMask->lDelta + (pptlMask->x >> 3);
     fjMaskBit0 = 0x80 >> (pptlMask->x & 0x07);