From 49df0467b12567da86155b8e9e7a7d337fbc6ed7 Mon Sep 17 00:00:00 2001
From: Mike McCormack <mike@codeweavers.com>
Date: Sun, 5 Nov 2006 17:12:35 +0900
Subject: [PATCH] comctl32: Check if GetObject fails on bitmaps passed to us.

---
 dlls/comctl32/imagelist.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/dlls/comctl32/imagelist.c b/dlls/comctl32/imagelist.c
index e8654e10c4b..3f8b49face0 100644
--- a/dlls/comctl32/imagelist.c
+++ b/dlls/comctl32/imagelist.c
@@ -212,7 +212,9 @@ ImageList_Add (HIMAGELIST himl,	HBITMAP hbmImage, HBITMAP hbmMask)
     if (!is_valid(himl))
         return -1;
 
-    GetObjectA (hbmImage, sizeof(BITMAP), (LPVOID)&bmp);
+    if (!GetObjectW(hbmImage, sizeof(BITMAP), (LPVOID)&bmp))
+        return -1;
+
     nImageCount = bmp.bmWidth / himl->cx;
 
     IMAGELIST_InternalExpandBitmaps (himl, nImageCount, bmp.bmWidth, bmp.bmHeight);
@@ -309,7 +311,7 @@ ImageList_AddMasked (HIMAGELIST himl, HBITMAP hBitmap, COLORREF clrMask)
     if (!is_valid(himl))
         return -1;
 
-    if (!GetObjectA (hBitmap, sizeof(BITMAP), &bmp))
+    if (!GetObjectW(hBitmap, sizeof(BITMAP), &bmp))
         return -1;
 
     if (himl->cx > 0)
@@ -2218,8 +2220,10 @@ ImageList_Replace (HIMAGELIST himl, INT i, HBITMAP hbmImage,
         return FALSE;
     }
 
+    if (!GetObjectW(hbmImage, sizeof(BITMAP), (LPVOID)&bmp))
+        return FALSE;
+
     hdcImage = CreateCompatibleDC (0);
-    GetObjectA (hbmImage, sizeof(BITMAP), (LPVOID)&bmp);
 
     /* Replace Image */
     hOldBitmap = SelectObject (hdcImage, hbmImage);
@@ -2691,7 +2695,7 @@ _write_bitmap(HBITMAP hBitmap, LPSTREAM pstm, int cx, int cy)
 {
     LPBITMAPFILEHEADER bmfh;
     LPBITMAPINFOHEADER bmih;
-    LPBYTE data, lpBits, lpBitsOrg;
+    LPBYTE data = NULL, lpBits = NULL, lpBitsOrg = NULL;
     BITMAP bm;
     INT bitCount, sizeImage, offBits, totalSize;
     INT nwidth, nheight, nsizeImage, icount;
@@ -2700,7 +2704,8 @@ _write_bitmap(HBITMAP hBitmap, LPSTREAM pstm, int cx, int cy)
 
 
     xdc = GetDC(0);
-    GetObjectA(hBitmap, sizeof(BITMAP), (LPVOID)&bm);
+    if (!GetObjectW(hBitmap, sizeof(BITMAP), (LPVOID)&bm))
+        goto failed;
 
     /* XXX is this always correct? */
     icount = bm.bmWidth / cx;
-- 
GitLab