From ee89ce29821834ade66d14e89428aade8d06076f Mon Sep 17 00:00:00 2001
From: Alexandre Julliard <julliard@winehq.org>
Date: Fri, 30 Dec 2011 11:02:57 +0100
Subject: [PATCH] gdi32: Add sanity checks for brush hatch styles.

---
 dlls/gdi32/brush.c       |  8 ++++++++
 dlls/gdi32/tests/brush.c | 37 +++++++++++++++++++++++++++++++++++++
 include/wingdi.h         |  1 +
 3 files changed, 46 insertions(+)

diff --git a/dlls/gdi32/brush.c b/dlls/gdi32/brush.c
index 5dc7dfebf3b..eda80a340e9 100644
--- a/dlls/gdi32/brush.c
+++ b/dlls/gdi32/brush.c
@@ -149,7 +149,15 @@ BOOL store_brush_pattern( LOGBRUSH *brush, struct brush_pattern *pattern )
     {
     case BS_SOLID:
     case BS_HOLLOW:
+        return TRUE;
+
     case BS_HATCHED:
+        if (brush->lbHatch > HS_DIAGCROSS)
+        {
+            if (brush->lbHatch >= HS_API_MAX) return FALSE;
+            brush->lbStyle = BS_SOLID;
+            brush->lbHatch = 0;
+        }
         return TRUE;
 
     case BS_PATTERN8X8:
diff --git a/dlls/gdi32/tests/brush.c b/dlls/gdi32/tests/brush.c
index b11d21cd886..76e158d926a 100644
--- a/dlls/gdi32/tests/brush.c
+++ b/dlls/gdi32/tests/brush.c
@@ -79,6 +79,42 @@ static void test_solidbrush(void)
     }
 }
 
+static void test_hatch_brush(void)
+{
+    int i, size;
+    HBRUSH brush;
+    LOGBRUSH lb;
+
+    for (i = 0; i < 20; i++)
+    {
+        SetLastError( 0xdeadbeef );
+        brush = CreateHatchBrush( i, RGB(12,34,56) );
+        if (i < HS_API_MAX)
+        {
+            ok( brush != 0, "%u: CreateHatchBrush failed err %u\n", i, GetLastError() );
+            size = GetObject( brush, sizeof(lb), &lb );
+            ok( size == sizeof(lb), "wrong size %u\n", size );
+            ok( lb.lbColor == RGB(12,34,56), "wrong color %08x\n", lb.lbColor );
+            if (i <= HS_DIAGCROSS)
+            {
+                ok( lb.lbStyle == BS_HATCHED, "wrong style %u\n", lb.lbStyle );
+                ok( lb.lbHatch == i, "wrong hatch %lu/%u\n", lb.lbHatch, i );
+            }
+            else
+            {
+                ok( lb.lbStyle == BS_SOLID, "wrong style %u\n", lb.lbStyle );
+                ok( lb.lbHatch == 0, "wrong hatch %lu\n", lb.lbHatch );
+            }
+            DeleteObject( brush );
+        }
+        else
+        {
+            ok( !brush, "%u: CreateHatchBrush succeeded\n", i );
+            ok( GetLastError() == 0xdeadbeef, "wrong error %u\n", GetLastError() );
+        }
+    }
+}
+
 static void test_pattern_brush(void)
 {
     char buffer[sizeof(BITMAPINFOHEADER) + 2 * sizeof(RGBQUAD) + 32 * 32 / 8];
@@ -310,6 +346,7 @@ static void test_palette_brush(void)
 START_TEST(brush)
 {
     test_solidbrush();
+    test_hatch_brush();
     test_pattern_brush();
     test_palette_brush();
 }
diff --git a/include/wingdi.h b/include/wingdi.h
index ab914098b6b..2f9fa08b553 100644
--- a/include/wingdi.h
+++ b/include/wingdi.h
@@ -526,6 +526,7 @@ typedef LOGBRUSH PATTERN, *PPATTERN, *LPPATTERN;
 #define HS_BDIAGONAL        3
 #define HS_CROSS            4
 #define HS_DIAGCROSS        5
+#define HS_API_MAX          12
 
   /* Fonts */