From 761391f156e67404d3c4db801f28da51d06d3654 Mon Sep 17 00:00:00 2001
From: Dmitry Timoshkov <dmitry@baikal.ru>
Date: Wed, 13 Nov 2013 14:00:26 +0900
Subject: [PATCH] gdiplus: Add a check for passed buffer size to
 GdipGetRegionData.

---
 dlls/gdiplus/region.c       | 12 +++++++++++-
 dlls/gdiplus/tests/region.c |  3 ---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/dlls/gdiplus/region.c b/dlls/gdiplus/region.c
index aef2ac79c9..0295e627b4 100644
--- a/dlls/gdiplus/region.c
+++ b/dlls/gdiplus/region.c
@@ -828,12 +828,22 @@ GpStatus WINGDIPAPI GdipGetRegionData(GpRegion *region, BYTE *buffer, UINT size,
         DWORD num_children;
     } *region_header;
     INT filled = 0;
+    UINT required;
+    GpStatus status;
 
     TRACE("%p, %p, %d, %p\n", region, buffer, size, needed);
 
-    if (!(region && buffer && size))
+    if (!region || !buffer || !size)
         return InvalidParameter;
 
+    status = GdipGetRegionDataSize(region, &required);
+    if (status != Ok) return status;
+    if (size < required)
+    {
+        if (needed) *needed = size;
+        return InsufficientBuffer;
+    }
+
     region_header = (struct _region_header *)buffer;
     region_header->size = sizeheader_size + get_element_size(&region->node);
     region_header->checksum = 0;
diff --git a/dlls/gdiplus/tests/region.c b/dlls/gdiplus/tests/region.c
index dcf5092024..77fb4feb09 100644
--- a/dlls/gdiplus/tests/region.c
+++ b/dlls/gdiplus/tests/region.c
@@ -133,11 +133,8 @@ static void test_getregiondata(void)
     memset(buf, 0xee, sizeof(buf));
     needed = 0;
     status = GdipGetRegionData(region, (BYTE*)buf, 4, &needed);
-todo_wine
     ok(status == InsufficientBuffer, "status %08x\n", status);
-todo_wine
     expect(4, needed);
-todo_wine
     expect_dword(buf, 0xeeeeeeee);
 
     memset(buf, 0xee, sizeof(buf));