From d85b700df9667e00c1408297da605097ea628d82 Mon Sep 17 00:00:00 2001
From: Francisco Casas <fcasas@codeweavers.com>
Date: Wed, 27 Oct 2021 09:47:06 -0300
Subject: [PATCH] gdi32: Avoid integer overflow in the obj map compare fn.

Signed-off-by: Francisco Casas <fcasas@codeweavers.com>
Signed-off-by: Huw Davies <huw@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
---
 dlls/gdi32/objects.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/dlls/gdi32/objects.c b/dlls/gdi32/objects.c
index 4b390aa0160..196cea9ba92 100644
--- a/dlls/gdi32/objects.c
+++ b/dlls/gdi32/objects.c
@@ -178,7 +178,11 @@ DWORD WINAPI GetObjectType( HGDIOBJ handle )
 static int obj_map_cmp( const void *key, const struct wine_rb_entry *entry )
 {
     struct obj_map_entry *obj_entry = WINE_RB_ENTRY_VALUE( entry, struct obj_map_entry, entry );
-    return HandleToLong( key ) - HandleToLong( obj_entry->obj );
+    UINT_PTR a = (UINT_PTR)key;
+    UINT_PTR b = (UINT_PTR)obj_entry->obj;
+    if (a > b) return 1;
+    if (a < b) return -1;
+    return 0;
 };
 
 struct wine_rb_tree obj_map = { obj_map_cmp };
-- 
GitLab