gdiobj.c File Reference

#include <win32k.h>
#include <debug.h>

Include dependency graph for gdiobj.c:

Go to the source code of this file.

Macros
#define	NDEBUG
#define	ASSERT_LOCK_ORDER(hobj)
#define	ASSERT_SHARED_OBJECT_TYPE(objt)
#define	ASSERT_EXCLUSIVE_OBJECT_TYPE(objt)
#define	ASSERT_TRYLOCK_OBJECT_TYPE(objt)
#define	GDIOBJ_POOL_TAG(type)   ('00hG' + (((type) & 0x1f) << 24))

Enumerations
enum	{   REF_MASK_REUSE = 0xff000000 , REF_INC_REUSE = 0x01000000 , REF_MASK_VALID = 0x00800000 , REF_MASK_COUNT = 0x007fffff ,   REF_MASK_INUSE = 0x00ffffff }

Functions
FORCEINLINE ULONG	InterlockedReadUlong (_In_ _Interlocked_operand_ ULONG volatile *Source)
FORCEINLINE void	INCREASE_THREAD_LOCK_COUNT (_In_ HANDLE hobj)
FORCEINLINE void	DECREASE_THREAD_LOCK_COUNT (_In_ HANDLE hobj)
static VOID NTAPI	GDIOBJ_vCleanup (PVOID ObjectBody)
static VOID	InitLookasideList (UCHAR objt, ULONG cjSize)
NTSTATUS NTAPI	InitGdiHandleTable (void)
FORCEINLINE VOID	IncrementCurrentProcessGdiHandleCount (void)
FORCEINLINE VOID	DecrementCurrentProcessGdiHandleCount (void)
static VOID	IncrementGdiHandleCount (ULONG ulProcessId)
static VOID	DecrementGdiHandleCount (ULONG ulProcessId)
static PENTRY	ENTRY_pentPopFreeEntry (VOID)
static VOID	ENTRY_vPushFreeEntry (PENTRY pentFree)
static PENTRY	ENTRY_ReferenceEntryByHandle (HGDIOBJ hobj, FLONG fl)
static HGDIOBJ	ENTRY_hInsertObject (PENTRY pentry, POBJ pobj, UCHAR objt, ULONG ulOwner)
POBJ NTAPI	GDIOBJ_AllocateObject (UCHAR objt, ULONG cjSize, FLONG fl)
VOID NTAPI	GDIOBJ_vFreeObject (POBJ pobj)
VOID NTAPI	GDIOBJ_vDereferenceObject (POBJ pobj)
POBJ NTAPI	GDIOBJ_ReferenceObjectByHandle (HGDIOBJ hobj, UCHAR objt)
VOID NTAPI	GDIOBJ_vReferenceObjectByPointer (POBJ pobj)
PGDIOBJ NTAPI	GDIOBJ_TryLockObject (HGDIOBJ hobj, UCHAR objt)
PGDIOBJ NTAPI	GDIOBJ_LockObject (HGDIOBJ hobj, UCHAR objt)
VOID NTAPI	GDIOBJ_vUnlockObject (POBJ pobj)
HGDIOBJ NTAPI	GDIOBJ_hInsertObject (POBJ pobj, ULONG ulOwner)
VOID NTAPI	GDIOBJ_vSetObjectOwner (POBJ pobj, ULONG ulNewOwner)
BOOL NTAPI	GDIOBJ_bLockMultipleObjects (IN ULONG ulCount, IN HGDIOBJ *ahObj, OUT PGDIOBJ *apObj, IN UCHAR objt)
PVOID NTAPI	GDIOBJ_pvGetObjectAttr (POBJ pobj)
VOID NTAPI	GDIOBJ_vSetObjectAttr (POBJ pobj, PVOID pvObjAttr)
VOID NTAPI	GDIOBJ_vDeleteObject (POBJ pobj)
BOOL NTAPI	GreIsHandleValid (HGDIOBJ hobj)
BOOL NTAPI	GreDeleteObject (HGDIOBJ hobj)
ULONG NTAPI	GreGetObjectOwner (HGDIOBJ hobj)
BOOL NTAPI	GreSetObjectOwnerEx (HGDIOBJ hobj, ULONG ulOwner, ULONG Flags)
BOOL NTAPI	GreSetObjectOwner (HGDIOBJ hobj, ULONG ulOwner)
INT NTAPI	GreGetObject (IN HGDIOBJ hobj, IN INT cbCount, OUT PVOID pvBuffer)
W32KAPI INT APIENTRY	NtGdiExtGetObjectW (IN HANDLE hobj, IN INT cjBufferSize, OUT LPVOID lpBuffer)
W32KAPI HANDLE APIENTRY	NtGdiCreateClientObj (IN ULONG ulType)
W32KAPI BOOL APIENTRY	NtGdiDeleteClientObj (IN HANDLE hobj)
PGDIOBJ NTAPI	GDIOBJ_ShareLockObj (HGDIOBJ hObj, DWORD ExpectedType)
BOOL NTAPI	GDIOBJ_ConvertToStockObj (HGDIOBJ *phObj)
BOOL NTAPI	GDIOBJ_ConvertFromStockObj (HGDIOBJ *phObj)
POBJ NTAPI	GDIOBJ_AllocObjWithHandle (ULONG ObjectType, ULONG cjSize)
PVOID NTAPI	GDI_MapHandleTable (PEPROCESS pProcess)
BOOL NTAPI	GDI_CleanupForProcess (struct _EPROCESS *Process)
PGDI_POOL	GetBrushAttrPool (VOID)
	HACK!

Variables
static PVOID	gpvGdiHdlTblSection = NULL
PENTRY	gpentHmgr
PULONG	gpaulRefCount
volatile ULONG	gulFirstFree
volatile ULONG	gulFirstUnused
static PPAGED_LOOKASIDE_LIST	gpaLookasideList
static const GDICLEANUPPROC	apfnCleanup []
static const GDIOBJDELETEPROC	apfnDelete []
PGDI_HANDLE_TABLE	GdiHandleTable = NULL

Macro Definition Documentation

ASSERT_EXCLUSIVE_OBJECT_TYPE

#define ASSERT_EXCLUSIVE_OBJECT_TYPE

(

objt

)

Definition at line 126 of file gdiobj.c.

ASSERT_LOCK_ORDER

#define ASSERT_LOCK_ORDER

(

hobj

)

Definition at line 124 of file gdiobj.c.

ASSERT_SHARED_OBJECT_TYPE

#define ASSERT_SHARED_OBJECT_TYPE

(

objt

)

Definition at line 125 of file gdiobj.c.

ASSERT_TRYLOCK_OBJECT_TYPE

#define ASSERT_TRYLOCK_OBJECT_TYPE

(

objt

)

Definition at line 127 of file gdiobj.c.

GDIOBJ_POOL_TAG

#define GDIOBJ_POOL_TAG

(

type

)

('00hG' + (((type) & 0x1f) << 24))

Definition at line 134 of file gdiobj.c.

NDEBUG

#define NDEBUG

Definition at line 50 of file gdiobj.c.

Enumeration Type Documentation

anonymous enum

anonymous enum

Enumerator
REF_MASK_REUSE
REF_INC_REUSE
REF_MASK_VALID
REF_MASK_COUNT
REF_MASK_INUSE

Definition at line 136 of file gdiobj.c.

{
    REF_MASK_REUSE = 0xff000000,
    REF_INC_REUSE  = 0x01000000,
    REF_MASK_VALID = 0x00800000,
    REF_MASK_COUNT = 0x007fffff,
    REF_MASK_INUSE = 0x00ffffff,
};

Function Documentation

DECREASE_THREAD_LOCK_COUNT()

FORCEINLINE void DECREASE_THREAD_LOCK_COUNT

(

_In_ HANDLE

hobj

)

Definition at line 79 of file gdiobj.c.

{
    PTHREADINFO pti = PsGetCurrentThreadWin32Thread();
    DBG_UNREFERENCED_PARAMETER(hobj);
    if (pti)
    {
#if DBG
        pti->acExclusiveLockCount[((ULONG_PTR)hobj >> 16) & 0x1f]--;
#endif
        pti->cExclusiveLocks--;
    }
}

Referenced by GDIOBJ_vDeleteObject(), and GDIOBJ_vUnlockObject().

DecrementCurrentProcessGdiHandleCount()

FORCEINLINE VOID DecrementCurrentProcessGdiHandleCount

(

void

)

Definition at line 340 of file gdiobj.c.

{
    PPROCESSINFO ppi = PsGetCurrentProcessWin32Process();
    if (ppi) InterlockedDecrement((LONG*)&ppi->GDIHandleCount);
}

Referenced by GDIOBJ_vDereferenceObject().

DecrementGdiHandleCount()

static VOID DecrementGdiHandleCount ( ULONG  ulProcessId )

inlinestatic

Definition at line 365 of file gdiobj.c.

{
    PEPROCESS pep;
    PPROCESSINFO ppi;
    NTSTATUS Status;
 
    Status = PsLookupProcessByProcessId(ULongToHandle(ulProcessId), &pep);
    NT_ASSERT(NT_SUCCESS(Status));
    __analysis_assume(NT_SUCCESS(Status));
 
    ppi = PsGetProcessWin32Process(pep);
    if (ppi) InterlockedDecrement((LONG*)&ppi->GDIHandleCount);
    if (NT_SUCCESS(Status)) ObDereferenceObject(pep);
}

Referenced by GDIOBJ_vSetObjectOwner().

ENTRY_hInsertObject()

static HGDIOBJ ENTRY_hInsertObject ( PENTRY  pentry, POBJ  pobj, UCHAR  objt, ULONG  ulOwner  )

static

Definition at line 546 of file gdiobj.c.

{
    ULONG ulIndex;
 
    /* Calculate the handle index */
    ulIndex = pentry - gpentHmgr;
 
    /* Update the fields in the ENTRY */
    pentry->einfo.pobj = pobj;
    pentry->Objt = objt & 0x1f;
    pentry->FullUnique = (pentry->FullUnique & 0xff00) | objt;
    pentry->ObjectOwner.ulObj = ulOwner;
 
    /* Make the handle valid with 1 reference */
    ASSERT((gpaulRefCount[ulIndex] & REF_MASK_INUSE) == 0);
    InterlockedOr((LONG*)&gpaulRefCount[ulIndex], REF_MASK_VALID | 1);
 
    /* Return the handle */
    return (HGDIOBJ)(((ULONG_PTR)pentry->FullUnique << 16) | ulIndex);
}

Referenced by GDIOBJ_hInsertObject().

ENTRY_pentPopFreeEntry()

static PENTRY ENTRY_pentPopFreeEntry ( VOID  )

static

Definition at line 382 of file gdiobj.c.

{
    ULONG iFirst, iNext, iPrev;
    PENTRY pentFree;
 
    DPRINT("Enter InterLockedPopFreeEntry\n");
 
    do
    {
        /* Get the index and sequence number of the first free entry */
        iFirst = InterlockedReadUlong(&gulFirstFree);
 
        /* Check if we have a free entry */
        if (!(iFirst & GDI_HANDLE_INDEX_MASK))
        {
            /* Increment FirstUnused and get the new index */
            iFirst = InterlockedIncrement((LONG*)&gulFirstUnused) - 1;
 
            /* Check if we have unused entries left */
            if (iFirst >= GDI_HANDLE_COUNT)
            {
                DPRINT1("No more GDI handles left!\n");
#if DBG_ENABLE_GDIOBJ_BACKTRACES
                DbgDumpGdiHandleTableWithBT();
#endif
                InterlockedDecrement((LONG*)&gulFirstUnused);
                return 0;
            }
 
            /* Return the old entry */
            return &gpentHmgr[iFirst];
        }
 
        /* Get a pointer to the first free entry */
        pentFree = &gpentHmgr[iFirst & GDI_HANDLE_INDEX_MASK];
 
        /* Create a new value with an increased sequence number */
        iNext = GDI_HANDLE_GET_INDEX(pentFree->einfo.hFree);
        iNext |= (iFirst & ~GDI_HANDLE_INDEX_MASK) + 0x10000;
 
        /* Try to exchange the FirstFree value */
        iPrev = InterlockedCompareExchange((LONG*)&gulFirstFree,
                                           iNext,
                                           iFirst);
    }
    while (iPrev != iFirst);
 
    /* Sanity check: is entry really free? */
    ASSERT(((ULONG_PTR)pentFree->einfo.pobj & ~GDI_HANDLE_INDEX_MASK) == 0);
 
    return pentFree;
}

Referenced by GDIOBJ_hInsertObject().

ENTRY_ReferenceEntryByHandle()

static PENTRY ENTRY_ReferenceEntryByHandle ( HGDIOBJ  hobj, FLONG  fl  )

static

Definition at line 478 of file gdiobj.c.

{
    ULONG ulIndex, cNewRefs, cOldRefs;
    PENTRY pentry;
    PTHREADINFO pti = PsGetCurrentThreadWin32Thread();
 
    /* HACK: This may be a hack but it fixes CORE-5601.
     * Allow a window that is moving or resizing to have access to all of its child
     * windows dc's even if the dc belongs to another process i.e. 3D Screensaver */
    if (pti && pti->TIF_flags & TIF_MOVESIZETRACKING)
        fl = GDIOBJFLAG_IGNOREPID;
 
    /* Get the handle index and check if its too big */
    ulIndex = GDI_HANDLE_GET_INDEX(hobj);
 
    /* Get pointer to the entry */
    pentry = &gpentHmgr[ulIndex];
 
    /* Get the current reference count */
    cOldRefs = gpaulRefCount[ulIndex];
 
    do
    {
        /* Check if the slot is deleted */
        if ((cOldRefs & REF_MASK_VALID) == 0)
        {
            DPRINT("GDIOBJ: Slot is not valid: 0x%lx, hobh=%p\n", cOldRefs, hobj);
            return NULL;
        }
 
        /* Check if the unique value matches */
        if (pentry->FullUnique != (USHORT)((ULONG_PTR)hobj >> 16))
        {
            DPRINT("GDIOBJ: Wrong unique value. Handle: 0x%4x, entry: 0x%4x\n",
                   (USHORT)((ULONG_PTR)hobj >> 16), pentry->FullUnique);
            return NULL;
        }
 
        /* Check if the object owner is this process or public */
        if (!(fl & GDIOBJFLAG_IGNOREPID) &&
            pentry->ObjectOwner.ulObj != GDI_OBJ_HMGR_PUBLIC &&
            pentry->ObjectOwner.ulObj != PtrToUlong(PsGetCurrentProcessId()))
        {
            DPRINT("GDIOBJ: Cannot reference foreign handle %p, pentry=%p:%lx.\n",
                    hobj, pentry, pentry->ObjectOwner.ulObj);
            return NULL;
        }
 
        /* Try to atomically increment the reference count */
        cNewRefs = cOldRefs + 1;
        cOldRefs = InterlockedCompareExchange((PLONG)&gpaulRefCount[ulIndex],
                                              cNewRefs,
                                              cOldRefs);
    }
    while (cNewRefs != cOldRefs + 1);
 
    /* Integrity checks */
    ASSERT((pentry->FullUnique & 0x1f) == pentry->Objt);
    ASSERT(pentry->einfo.pobj != NULL);
 
    /* Check if lower 32 bits match, the upper 32 bits are ignored */
    ASSERT(pentry->einfo.pobj->hHmgr == UlongToPtr(PtrToUlong(hobj)));
 
    return pentry;
}

Referenced by GDIOBJ_ConvertFromStockObj(), GDIOBJ_ConvertToStockObj(), GDIOBJ_LockObject(), GDIOBJ_ReferenceObjectByHandle(), GDIOBJ_TryLockObject(), GreDeleteObject(), GreIsHandleValid(), and GreSetObjectOwnerEx().

ENTRY_vPushFreeEntry()

static VOID ENTRY_vPushFreeEntry ( PENTRY  pentFree )

static

Definition at line 439 of file gdiobj.c.

{
    ULONG iToFree, iFirst, iPrev, idxToFree;
 
    DPRINT("Enter ENTRY_vPushFreeEntry\n");
 
    idxToFree = pentFree - gpentHmgr;
    ASSERT((gpaulRefCount[idxToFree] & REF_MASK_INUSE) == 0);
 
    /* Initialize entry */
    pentFree->Objt = GDIObjType_DEF_TYPE;
    pentFree->ObjectOwner.ulObj = 0;
    pentFree->pUser = NULL;
 
    /* Increase reuse counter in entry and reference counter */
    InterlockedExchangeAdd((LONG*)&gpaulRefCount[idxToFree], REF_INC_REUSE);
    pentFree->FullUnique += 0x0100;
 
    do
    {
        /* Get the current first free index and sequence number */
        iFirst = InterlockedReadUlong(&gulFirstFree);
 
        /* Set the einfo.pobj member to the index of the first free entry */
        pentFree->einfo.pobj = UlongToPtr(iFirst & GDI_HANDLE_INDEX_MASK);
 
        /* Combine new index and increased sequence number in iToFree */
        iToFree = idxToFree | ((iFirst & ~GDI_HANDLE_INDEX_MASK) + 0x10000);
 
        /* Try to atomically update the first free entry */
        iPrev = InterlockedCompareExchange((LONG*)&gulFirstFree,
                                           iToFree,
                                           iFirst);
    }
    while (iPrev != iFirst);
}

Referenced by GDIOBJ_vDereferenceObject().

GDI_CleanupForProcess()

BOOL NTAPI GDI_CleanupForProcess

(

struct _EPROCESS *

Process

)

Definition at line 1595 of file gdiobj.c.

{
    PENTRY pentry;
    ULONG ulIndex;
    DWORD dwProcessId;
    PPROCESSINFO ppi;
 
    DPRINT("CleanupForProcess prochandle %p Pid %p\n",
           Process, Process->UniqueProcessId);
 
    ASSERT(Process == PsGetCurrentProcess());
 
    /* Get the current process Id */
    dwProcessId = PtrToUlong(PsGetCurrentProcessId());
 
    /* Loop all handles in the handle table */
    for (ulIndex = RESERVE_ENTRIES_COUNT; ulIndex < gulFirstUnused; ulIndex++)
    {
        pentry = &gpentHmgr[ulIndex];
 
        /* Check if the object is owned by the process */
        if (pentry->ObjectOwner.ulObj == dwProcessId)
        {
            ASSERT(pentry->einfo.pobj->cExclusiveLock == 0);
 
            /* Reference the object and delete it */
            InterlockedIncrement((LONG*)&gpaulRefCount[ulIndex]);
            GDIOBJ_vDeleteObject(pentry->einfo.pobj);
        }
    }
 
#if DBG
    DbgGdiHTIntegrityCheck();
#endif
 
    ppi = PsGetCurrentProcessWin32Process();
    DPRINT("Completed cleanup for process %p\n", Process->UniqueProcessId);
    if (ppi->GDIHandleCount != 0)
    {
        DPRINT1("Leaking %d handles!\n", ppi->GDIHandleCount);
        ASSERT(FALSE);
    }
 
    /* Loop all handles in the handle table */
    for (ulIndex = RESERVE_ENTRIES_COUNT; ulIndex < gulFirstUnused; ulIndex++)
    {
        pentry = &gpentHmgr[ulIndex];
 
        /* Check if the object is owned by the process */
        if (pentry->ObjectOwner.ulObj == dwProcessId)
        {
            DPRINT1("Leaking object. Index=%lx, type=0x%x, refcount=%lx\n",
                    ulIndex, pentry->Objt, gpaulRefCount[ulIndex]);
            DBG_DUMP_EVENT_LIST(&pentry->einfo.pobj->slhLog);
            //DBG_CLEANUP_EVENT_LIST(&pentry->einfo.pobj->slhLog);
            ASSERT(FALSE);
        }
    }
 
    return TRUE;
}

Referenced by GdiProcessDestroy().

GDI_MapHandleTable()

PVOID NTAPI GDI_MapHandleTable

(

PEPROCESS

pProcess

)

Definition at line 1565 of file gdiobj.c.

{
    PVOID pvMappedView = NULL;
    NTSTATUS Status;
    LARGE_INTEGER liOffset;
    SIZE_T cjViewSize = sizeof(GDI_HANDLE_TABLE);
 
    liOffset.QuadPart = 0;
 
    ASSERT(gpvGdiHdlTblSection != NULL);
    ASSERT(pProcess != NULL);
 
    Status = MmMapViewOfSection(gpvGdiHdlTblSection,
                                pProcess,
                                &pvMappedView,
                                0,
                                0,
                                &liOffset,
                                &cjViewSize,
                                ViewUnmap,
                                SEC_NO_CHANGE,
                                PAGE_READONLY);
 
    if (!NT_SUCCESS(Status))
        return NULL;
 
    return pvMappedView;
}

Referenced by GdiProcessCreate().

GDIOBJ_AllocateObject()

POBJ NTAPI GDIOBJ_AllocateObject	(	UCHAR	objt,
		ULONG	cjSize,
		FLONG	fl
	)

Definition at line 569 of file gdiobj.c.

{
    POBJ pobj;
 
    if (fl & BASEFLAG_LOOKASIDE)
    {
        /* Allocate the object from a lookaside list */
        pobj = ExAllocateFromPagedLookasideList(&gpaLookasideList[objt & 0x1f]);
    }
    else
    {
        /* Allocate the object from paged pool */
        pobj = ExAllocatePoolWithTag(PagedPool, cjSize, GDIOBJ_POOL_TAG(objt));
    }
 
    if (!pobj) return NULL;
 
    /* Initialize the object */
    RtlZeroMemory(pobj, cjSize);
    pobj->hHmgr = (HGDIOBJ)((ULONG_PTR)objt << 16);
    pobj->cExclusiveLock = 0;
    pobj->ulShareCount = 1;
    pobj->BaseFlags = fl & 0xffff;
    DBG_INITLOG(&pobj->slhLog);
    DBG_LOGEVENT(&pobj->slhLog, EVENT_ALLOCATE, 0);
#if DBG_ENABLE_GDIOBJ_BACKTRACES
    DbgCaptureStackBackTace(pobj->apvBackTrace, 1, GDI_OBJECT_STACK_LEVELS);
#endif /* GDI_DEBUG */
 
    return pobj;
}

Referenced by DC_AllocDcWithHandle(), GDIOBJ_AllocObjWithHandle(), IntSysCreateRectpRgn(), NtGdiCreateClientObj(), PALETTE_AllocPalette(), and REGION_AllocRgnWithHandle().

GDIOBJ_AllocObjWithHandle()

POBJ NTAPI GDIOBJ_AllocObjWithHandle	(	ULONG	ObjectType,
		ULONG	cjSize
	)

Definition at line 1535 of file gdiobj.c.

{
    POBJ pobj;
    FLONG fl = 0;
    UCHAR objt = (ObjectType >> 16) & 0xFF;
 
    if ((objt == GDIObjType_DC_TYPE && cjSize == sizeof(DC)) ||
        (objt == GDIObjType_PAL_TYPE && cjSize == sizeof(PALETTE)) ||
        (objt == GDIObjType_RGN_TYPE && cjSize == sizeof(REGION)) ||
        (objt == GDIObjType_SURF_TYPE && cjSize == sizeof(SURFACE)) ||
        (objt == GDIObjType_PATH_TYPE && cjSize == sizeof(PATH)))
    {
        fl |= BASEFLAG_LOOKASIDE;
    }
 
    pobj = GDIOBJ_AllocateObject(objt, cjSize, fl);
    if (!pobj)
    {
        return NULL;
    }
 
    if (!GDIOBJ_hInsertObject(pobj, GDI_OBJ_HMGR_POWNED))
    {
        GDIOBJ_vFreeObject(pobj);
        return NULL;
    }
    return pobj;
}

Referenced by NtGdiCreateServerMetaFile(), PEN_AllocExtPenWithHandle(), PEN_AllocPenWithHandle(), and SURFACE_AllocSurface().

GDIOBJ_bLockMultipleObjects()

BOOL NTAPI GDIOBJ_bLockMultipleObjects	(	IN ULONG	ulCount,
		IN HGDIOBJ *	ahObj,
		OUT PGDIOBJ *	apObj,
		IN UCHAR	objt
	)

Definition at line 1038 of file gdiobj.c.

{
    UINT auiIndices[3] = {0, 1, 2};
    UINT i, j, tmp;
 
    ASSERT(ulCount <= 3);
 
    /* Sort the handles */
    for (i = 0; i < ulCount - 1; i++)
    {
        for (j = i + 1; j < ulCount; j++)
        {
            if ((ULONG_PTR)ahObj[auiIndices[i]] <
                (ULONG_PTR)ahObj[auiIndices[j]])
            {
                tmp = auiIndices[i];
                auiIndices[i] = auiIndices[j];
                auiIndices[j] = tmp;
            }
        }
    }
 
    /* Lock the objects in safe order */
    for (i = 0; i < ulCount; i++)
    {
        /* Skip NULL handles */
        if (ahObj[auiIndices[i]] == NULL)
        {
            apObj[auiIndices[i]] = NULL;
            continue;
        }
 
        /* Lock the object */
        apObj[auiIndices[i]] = GDIOBJ_LockObject(ahObj[auiIndices[i]], objt);
 
        /* Check for failure */
        if (apObj[auiIndices[i]] == NULL)
        {
            /* Cleanup */
            while (i--)
            {
                if (apObj[auiIndices[i]])
                    GDIOBJ_vUnlockObject(apObj[auiIndices[i]]);
            }
            return FALSE;
        }
    }
 
    return TRUE;
}

Referenced by GreStretchBltMask(), NtGdiAlphaBlend(), NtGdiCombineRgn(), NtGdiEqualRgn(), NtGdiMaskBlt(), and NtGdiTransparentBlt().

GDIOBJ_ConvertFromStockObj()

BOOL NTAPI GDIOBJ_ConvertFromStockObj

(

HGDIOBJ *

phObj

)

Definition at line 1502 of file gdiobj.c.

{
    PENTRY pentry;
    POBJ pobj;
 
    /* Reference the handle entry */
    pentry = ENTRY_ReferenceEntryByHandle(*phObj, 0);
    if (!pentry)
    {
        DPRINT1("GDIOBJ: Requested handle 0x%p is not valid.\n", *phObj);
        return FALSE;
    }
 
    /* Update the entry */
    pentry->FullUnique &= ~GDI_ENTRY_STOCK_MASK;
    pentry->ObjectOwner.ulObj = PtrToUlong(PsGetCurrentProcessId());
 
    /* Get the pointer to the BASEOBJECT */
    pobj = pentry->einfo.pobj;
 
    /* Calculate the new handle */
    pobj->hHmgr = (HGDIOBJ)((ULONG_PTR)pobj->hHmgr & ~GDI_HANDLE_STOCK_MASK);
 
    /* Return the new handle */
    *phObj = pobj->hHmgr;
 
    /* Dereference the handle */
    GDIOBJ_vDereferenceObject(pobj);
 
    return TRUE;
}

Referenced by NtGdiClearBitmapAttributes(), and NtGdiClearBrushAttributes().

GDIOBJ_ConvertToStockObj()

BOOL NTAPI GDIOBJ_ConvertToStockObj

(

HGDIOBJ *

phObj

)

Definition at line 1468 of file gdiobj.c.

{
    PENTRY pentry;
    POBJ pobj;
 
    /* Reference the handle entry */
    pentry = ENTRY_ReferenceEntryByHandle(*phObj, 0);
    if (!pentry)
    {
        DPRINT1("GDIOBJ: Requested handle 0x%p is not valid.\n", *phObj);
        return FALSE;
    }
 
    /* Update the entry */
    pentry->FullUnique |= GDI_ENTRY_STOCK_MASK;
    pentry->ObjectOwner.ulObj = 0;
 
    /* Get the pointer to the BASEOBJECT */
    pobj = pentry->einfo.pobj;
 
    /* Calculate the new handle */
    pobj->hHmgr = (HGDIOBJ)((ULONG_PTR)pobj->hHmgr | GDI_HANDLE_STOCK_MASK);
 
    /* Return the new handle */
    *phObj = pobj->hHmgr;
 
    /* Dereference the handle */
    GDIOBJ_vDereferenceObject(pobj);
 
    return TRUE;
}

Referenced by CreateStockObjects(), CreateSysColorObjects(), NtGdiSetBitmapAttributes(), and NtGdiSetBrushAttributes().

GDIOBJ_hInsertObject()

HGDIOBJ NTAPI GDIOBJ_hInsertObject	(	POBJ	pobj,
		ULONG	ulOwner
	)

Definition at line 919 of file gdiobj.c.

{
    PENTRY pentry;
    UCHAR objt;
 
    /* Must have no handle and only one reference */
    ASSERT(GDI_HANDLE_GET_INDEX(pobj->hHmgr) == 0);
    ASSERT(pobj->cExclusiveLock == 0);
    ASSERT(pobj->ulShareCount == 1);
 
    /* Get a free handle entry */
    pentry = ENTRY_pentPopFreeEntry();
    if (!pentry)
    {
        DPRINT1("GDIOBJ: Could not get a free entry.\n");
        return NULL;
    }
 
    /* Make the object exclusively locked */
    ExInitializePushLock(&pobj->pushlock);
    KeEnterCriticalRegion();
    ExAcquirePushLockExclusive(&pobj->pushlock);
    pobj->cExclusiveLock = 1;
    pobj->dwThreadId = PtrToUlong(PsGetCurrentThreadId());
    INCREASE_THREAD_LOCK_COUNT(pobj->hHmgr);
 
    /* Get object type from the hHmgr field */
    objt = ((ULONG_PTR)pobj->hHmgr >> 16) & 0xff;
    ASSERT(objt != GDIObjType_DEF_TYPE);
 
    /* Check if current process is requested owner */
    if (ulOwner == GDI_OBJ_HMGR_POWNED)
    {
        /* Increment the process handle count */
        IncrementCurrentProcessGdiHandleCount();
 
        /* Use Process id */
        ulOwner = HandleToUlong(PsGetCurrentProcessId());
    }
 
    /* Insert the object into the handle table */
    pobj->hHmgr = ENTRY_hInsertObject(pentry, pobj, objt, ulOwner);
 
    /* Return the handle */
    DPRINT("GDIOBJ: Created handle: %p\n", pobj->hHmgr);
    DBG_LOGEVENT(&pobj->slhLog, EVENT_CREATE_HANDLE, 0);
    return pobj->hHmgr;
}

Referenced by DC_AllocDcWithHandle(), EngCreatePalette(), GDIOBJ_AllocObjWithHandle(), BASEOBJECT::hInsertObject(), NtGdiCreateClientObj(), PALETTE_AllocPalWithHandle(), and REGION_AllocRgnWithHandle().

GDIOBJ_LockObject()

PGDIOBJ NTAPI GDIOBJ_LockObject	(	HGDIOBJ	hobj,
		UCHAR	objt
	)

Definition at line 833 of file gdiobj.c.

{
    PENTRY pentry;
    POBJ pobj;
    DWORD dwThreadId;
 
    /* Check if the handle type matches */
    ASSERT_EXCLUSIVE_OBJECT_TYPE(objt);
    if ((((ULONG_PTR)hobj >> 16) & 0x1f) != objt)
    {
        DPRINT("Wrong object type: hobj=0x%p, objt=0x%x\n", hobj, objt);
        return NULL;
    }
 
    /* Make sure lock order is correct */
    ASSERT_LOCK_ORDER(objt);
 
    /* Reference the handle entry */
    pentry = ENTRY_ReferenceEntryByHandle(hobj, 0);
    if (!pentry)
    {
        DPRINT("GDIOBJ: Requested handle 0x%p is not valid.\n", hobj);
        return NULL;
    }
 
    /* Get the pointer to the BASEOBJECT */
    pobj = pentry->einfo.pobj;
 
    /* Check if we already own the lock */
    dwThreadId = PtrToUlong(PsGetCurrentThreadId());
    if (pobj->dwThreadId != dwThreadId)
    {
        /* Disable APCs and acquire the push lock */
        KeEnterCriticalRegion();
        ExAcquirePushLockExclusive(&pobj->pushlock);
 
        /* Set us as lock owner */
        ASSERT(pobj->dwThreadId == 0);
        pobj->dwThreadId = dwThreadId;
    }
 
    /* Increase lock count */
    pobj->cExclusiveLock++;
    INCREASE_THREAD_LOCK_COUNT(hobj);
    DBG_LOGEVENT(&pobj->slhLog, EVENT_LOCK, 0);
 
    /* Return the object */
    return pobj;
}

Referenced by DC_LockDc(), GDIOBJ_bLockMultipleObjects(), NtGdiGetServerMetaFileBits(), and REGION_LockRgn().

GDIOBJ_pvGetObjectAttr()

PVOID NTAPI GDIOBJ_pvGetObjectAttr

(

POBJ

pobj

)

Definition at line 1095 of file gdiobj.c.

{
    ULONG ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
    return gpentHmgr[ulIndex].pUser;
}

GDIOBJ_ReferenceObjectByHandle()

POBJ NTAPI GDIOBJ_ReferenceObjectByHandle	(	HGDIOBJ	hobj,
		UCHAR	objt
	)

Definition at line 698 of file gdiobj.c.

{
    PENTRY pentry;
    POBJ pobj;
 
    /* Check if the handle type matches */
    ASSERT_SHARED_OBJECT_TYPE(objt);
    if ((((ULONG_PTR)hobj >> 16) & 0x1f) != objt)
    {
        DPRINT("GDIOBJ: Wrong type. handle=%p, type=%x\n", hobj, objt);
        return NULL;
    }
 
    /* Reference the handle entry */
    pentry = ENTRY_ReferenceEntryByHandle(hobj, 0);
    if (!pentry)
    {
        DPRINT("GDIOBJ: Requested handle 0x%p is not valid.\n", hobj);
        return NULL;
    }
 
    /* Get the pointer to the BASEOBJECT */
    pobj = pentry->einfo.pobj;
 
    /* Check if the object is exclusively locked */
    if (pobj->cExclusiveLock != 0)
    {
        DPRINT1("GDIOBJ: Cannot reference object %p with exclusive lock.\n", hobj);
        GDIOBJ_vDereferenceObject(pobj);
        DBG_DUMP_EVENT_LIST(&pobj->slhLog);
        return NULL;
    }
 
    DBG_LOGEVENT(&pobj->slhLog, EVENT_REFERENCE, gpaulRefCount[pentry - gpentHmgr]);
 
    /* All is well, return the object */
    return pobj;
}

Referenced by GDIOBJ_ShareLockObj(), GreGetObject(), and PEN_ShareLockPen().

GDIOBJ_ShareLockObj()

PGDIOBJ NTAPI GDIOBJ_ShareLockObj	(	HGDIOBJ	hObj,
		DWORD	ExpectedType
	)

Definition at line 1456 of file gdiobj.c.

{
    if (ExpectedType == GDI_OBJECT_TYPE_DONTCARE)
        ExpectedType = GDI_HANDLE_GET_TYPE(hObj);
    return GDIOBJ_ReferenceObjectByHandle(hObj, (ExpectedType >> 16) & 0x1f);
}

Referenced by BASEOBJECT::LockShared().

GDIOBJ_TryLockObject()

PGDIOBJ NTAPI GDIOBJ_TryLockObject	(	HGDIOBJ	hobj,
		UCHAR	objt
	)

Definition at line 764 of file gdiobj.c.

{
    PENTRY pentry;
    POBJ pobj;
    DWORD dwThreadId;
 
    /* Check if the handle type matches */
    ASSERT_TRYLOCK_OBJECT_TYPE(objt);
    if ((((ULONG_PTR)hobj >> 16) & 0x1f) != objt)
    {
        DPRINT("Wrong object type: hobj=0x%p, objt=0x%x\n", hobj, objt);
        return NULL;
    }
 
    /* Make sure lock order is correct */
    ASSERT_LOCK_ORDER(objt);
 
    /* Reference the handle entry */
    pentry = ENTRY_ReferenceEntryByHandle(hobj, 0);
    if (!pentry)
    {
        DPRINT("GDIOBJ: Requested handle 0x%p is not valid.\n", hobj);
        return NULL;
    }
 
    /* Get the pointer to the BASEOBJECT */
    pobj = pentry->einfo.pobj;
 
    /* Check if we already own the lock */
    dwThreadId = PtrToUlong(PsGetCurrentThreadId());
    if (pobj->dwThreadId != dwThreadId)
    {
        /* Disable APCs and try acquiring the push lock */
        KeEnterCriticalRegion();
        if(!ExTryAcquirePushLockExclusive(&pobj->pushlock))
        {
            ULONG cRefs, ulIndex;
            /* Already owned. Clean up and leave. */
            KeLeaveCriticalRegion();
 
            /* Calculate the index */
            ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
 
            /* Decrement reference count */
            ASSERT((gpaulRefCount[ulIndex] & REF_MASK_COUNT) > 0);
            cRefs = InterlockedDecrement((LONG*)&gpaulRefCount[ulIndex]);
            ASSERT(cRefs & REF_MASK_VALID);
 
            return NULL;
        }
 
        /* Set us as lock owner */
        ASSERT(pobj->dwThreadId == 0);
        pobj->dwThreadId = dwThreadId;
    }
 
    /* Increase lock count */
    pobj->cExclusiveLock++;
    INCREASE_THREAD_LOCK_COUNT(hobj);
    DBG_LOGEVENT(&pobj->slhLog, EVENT_LOCK, 0);
 
    /* Return the object */
    return pobj;
}

Referenced by DRIVEROBJ_TryLockObject().

GDIOBJ_vCleanup()

static VOID NTAPI GDIOBJ_vCleanup ( PVOID  ObjectBody )

static

Definition at line 238 of file gdiobj.c.

{
    /* Nothing to do */
}

GDIOBJ_vDeleteObject()

VOID NTAPI GDIOBJ_vDeleteObject

(

POBJ

pobj

)

Definition at line 1118 of file gdiobj.c.

{
    ULONG ulIndex;
 
    /* Set the object's delete flag */
    InterlockedOr16((SHORT*)&pobj->BaseFlags, BASEFLAG_READY_TO_DIE);
    DBG_LOGEVENT(&pobj->slhLog, EVENT_DELETE, 0);
 
    /* Get the handle index */
    ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
    if (ulIndex)
    {
        /* Reset the handle valid bit */
        InterlockedAnd((LONG*)&gpaulRefCount[ulIndex], ~REF_MASK_VALID);
 
        /* Check if the object is exclusively locked */
        if (pobj->cExclusiveLock != 0)
        {
            /* Reset lock owner and lock count */
            pobj->dwThreadId = 0;
            pobj->cExclusiveLock = 0;
 
            /* Release the pushlock and reenable APCs */
            ExReleasePushLockExclusive(&pobj->pushlock);
            KeLeaveCriticalRegion();
            DECREASE_THREAD_LOCK_COUNT(pobj->hHmgr);
        }
    }
 
    /* Dereference the object (will take care of deletion) */
    GDIOBJ_vDereferenceObject(pobj);
}

Referenced by EngDeleteDriverObj(), EngDeletePalette(), EngDeletePath(), EngDeleteSurface(), GDI_CleanupForProcess(), GreDeleteObject(), IntEngMaskBlt(), IntGdiExtCreatePen(), NtGdiCreateBitmap(), NtGdiCreatePaletteInternal(), NtGdiCreateServerMetaFile(), NtGdiGetPixel(), PATH_Delete(), REGION_AllocRgnWithHandle(), REGION_Delete(), SURFACE_AllocSurface(), and UserDrawIconEx().

GDIOBJ_vDereferenceObject()

VOID NTAPI GDIOBJ_vDereferenceObject

(

POBJ

pobj

)

Definition at line 638 of file gdiobj.c.

{
    ULONG cRefs, ulIndex;
 
    /* Calculate the index */
    ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
 
    /* Check if the object has a handle */
    if (ulIndex)
    {
        /* Decrement reference count */
        if ((gpaulRefCount[ulIndex] & REF_MASK_COUNT) == 0)
        {
            DBG_DUMP_EVENT_LIST(&pobj->slhLog);
        }
        ASSERT((gpaulRefCount[ulIndex] & REF_MASK_COUNT) > 0);
        cRefs = InterlockedDecrement((LONG*)&gpaulRefCount[ulIndex]);
        DBG_LOGEVENT(&pobj->slhLog, EVENT_DEREFERENCE, cRefs);
 
        /* Check if we reached 0 and handle bit is not set */
        if ((cRefs & REF_MASK_INUSE) == 0)
        {
            /* Make sure it's ok to delete the object */
            ASSERT(pobj->BaseFlags & BASEFLAG_READY_TO_DIE);
 
            /* Check if the handle was process owned */
            if (gpentHmgr[ulIndex].ObjectOwner.ulObj != GDI_OBJ_HMGR_PUBLIC &&
                gpentHmgr[ulIndex].ObjectOwner.ulObj != GDI_OBJ_HMGR_NONE)
            {
                /* Decrement the process handle count */
                ASSERT(gpentHmgr[ulIndex].ObjectOwner.ulObj ==
                       HandleToUlong(PsGetCurrentProcessId()));
                DecrementCurrentProcessGdiHandleCount();
            }
 
            /* Push entry to the free list */
            ENTRY_vPushFreeEntry(&gpentHmgr[ulIndex]);
 
            /* Free the object */
            GDIOBJ_vFreeObject(pobj);
        }
    }
    else
    {
        /* Decrement the objects reference count */
        ASSERT(pobj->ulShareCount > 0);
        cRefs = InterlockedDecrement((LONG*)&pobj->ulShareCount);
        DBG_LOGEVENT(&pobj->slhLog, EVENT_DEREFERENCE, cRefs);
 
        /* Check if we reached 0 */
        if (cRefs == 0)
        {
            /* Free the object */
            GDIOBJ_vFreeObject(pobj);
        }
    }
}

Referenced by GDIOBJ_ConvertFromStockObj(), GDIOBJ_ConvertToStockObj(), GDIOBJ_ReferenceObjectByHandle(), GDIOBJ_vDeleteObject(), GreDeleteObject(), GreGetObject(), GreIsHandleValid(), GreSetObjectOwnerEx(), NtGdiSetColorSpace(), SURFACE_vSetPalette(), and BASEOBJECT::vUnlock().

GDIOBJ_vFreeObject()

VOID NTAPI GDIOBJ_vFreeObject

(

POBJ

pobj

)

Definition at line 603 of file gdiobj.c.

{
    UCHAR objt;
 
    DBG_CLEANUP_EVENT_LIST(&pobj->slhLog);
 
    /* Get the object type */
    objt = ((ULONG_PTR)pobj->hHmgr >> 16) & 0x1f;
 
    /* Check if we have a delete procedure (for C++ based objects) */
    if (apfnDelete[objt] != NULL)
    {
        /* Invoke the delete procedure */
        apfnDelete[objt](pobj);
    }
    else
    {
        /* Call the cleanup procedure */
        NT_ASSERT(apfnCleanup[objt]);
        apfnCleanup[objt](pobj);
 
        /* Check if the object is allocated from a lookaside list */
        if (pobj->BaseFlags & BASEFLAG_LOOKASIDE)
        {
            ExFreeToPagedLookasideList(&gpaLookasideList[objt], pobj);
        }
        else
        {
            ExFreePoolWithTag(pobj, GDIOBJ_POOL_TAG(objt));
        }
    }
}

Referenced by DC_AllocDcWithHandle(), EngCreatePalette(), GDIOBJ_AllocObjWithHandle(), GDIOBJ_vDereferenceObject(), NtGdiCreateClientObj(), PALETTE_AllocPalWithHandle(), and REGION_AllocRgnWithHandle().

GDIOBJ_vReferenceObjectByPointer()

VOID NTAPI GDIOBJ_vReferenceObjectByPointer

(

POBJ

pobj

)

Definition at line 741 of file gdiobj.c.

{
    ULONG cRefs;
 
    /* Check if the object has a handle */
    if (GDI_HANDLE_GET_INDEX(pobj->hHmgr))
    {
        /* Increase the handle's reference count */
        ULONG ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
        ASSERT((gpaulRefCount[ulIndex] & REF_MASK_COUNT) > 0);
        cRefs = InterlockedIncrement((LONG*)&gpaulRefCount[ulIndex]);
    }
    else
    {
        /* Increase the object's reference count */
        cRefs = InterlockedIncrement((LONG*)&pobj->ulShareCount);
    }
 
    DBG_LOGEVENT(&pobj->slhLog, EVENT_REFERENCE, cRefs);
}

Referenced by DC_vCopyState(), DC_vSelectFillBrush(), DC_vSelectLineBrush(), DC_vSelectPalette(), DC_vSelectSurface(), EBRUSHOBJ_vInit(), InitPaletteImpl(), PDEVOBJ_pSurface(), SURFACE_ShareLockByPointer(), and SURFACE_vSetPalette().

GDIOBJ_vSetObjectAttr()

VOID NTAPI GDIOBJ_vSetObjectAttr	(	POBJ	pobj,
		PVOID	pvObjAttr
	)

Definition at line 1103 of file gdiobj.c.

{
    ULONG ulIndex;
 
    ASSERT(pobj->hHmgr);
 
    /* Get the handle index */
    ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
 
    /* Set pointer to the usermode attribute */
    gpentHmgr[ulIndex].pUser = pvObjAttr;
}

Referenced by DC_bAllocDcAttr(), DC_vFreeDcAttr(), IntGdiSetRegionOwner(), REGION_bAllocRgnAttr(), and BASEOBJECT::vSetObjectAttr().

GDIOBJ_vSetObjectOwner()

VOID NTAPI GDIOBJ_vSetObjectOwner	(	POBJ	pobj,
		ULONG	ulNewOwner
	)

Definition at line 972 of file gdiobj.c.

{
    PENTRY pentry;
    ULONG ulOldOwner;
 
    /* This is a ugly HACK, needed to fix IntGdiSetDCOwnerEx */
    if (GDI_HANDLE_IS_STOCKOBJ(pobj->hHmgr))
    {
        DPRINT("Trying to set ownership of stock object %p to %lx\n", pobj->hHmgr, ulNewOwner);
        return;
    }
 
    /* Get the handle entry */
    NT_ASSERT(GDI_HANDLE_GET_INDEX(pobj->hHmgr));
    pentry = &gpentHmgr[GDI_HANDLE_GET_INDEX(pobj->hHmgr)];
 
    /* Check if the new owner is the same as the old one */
    ulOldOwner = pentry->ObjectOwner.ulObj;
    if (ulOldOwner == ulNewOwner)
    {
        /* Nothing to do */
        return;
    }
 
    /* Is the current process requested? */
    if (ulNewOwner == GDI_OBJ_HMGR_POWNED)
    {
        /* Use process id */
        ulNewOwner = HandleToUlong(PsGetCurrentProcessId());
    }
 
    // HACK
    if (ulNewOwner == GDI_OBJ_HMGR_NONE)
        ulNewOwner = GDI_OBJ_HMGR_PUBLIC;
 
    /* Was the object process owned? */
    if ((ulOldOwner != GDI_OBJ_HMGR_PUBLIC) &&
        (ulOldOwner != GDI_OBJ_HMGR_NONE))
    {
        /* Decrement the previous owners handle count */
        DecrementGdiHandleCount(ulOldOwner);
    }
 
    /* Is the new owner a process? */
    if ((ulNewOwner != GDI_OBJ_HMGR_PUBLIC) &&
        (ulNewOwner != GDI_OBJ_HMGR_NONE))
    {
        /* Increment the new owners handle count */
        IncrementGdiHandleCount(ulNewOwner);
    }
    else
    {
        /* Make sure we don't leak user mode memory */
        NT_ASSERT(pentry->pUser == NULL);
    }
 
    /* Set new owner */
    pentry->ObjectOwner.ulObj = ulNewOwner;
    DBG_LOGEVENT(&pobj->slhLog, EVENT_SET_OWNER, 0);
}

Referenced by DC_vSetOwner(), EngCreateBitmap(), EngCreateDeviceBitmap(), EngCreateDeviceSurface(), GreSetObjectOwnerEx(), NtGdiCreateServerMetaFile(), and NtGdiSaveDC().

GDIOBJ_vUnlockObject()

VOID NTAPI GDIOBJ_vUnlockObject

(

POBJ

pobj

)

Definition at line 887 of file gdiobj.c.

{
    ULONG cRefs, ulIndex;
    ASSERT(pobj->cExclusiveLock > 0);
 
    /* Decrease lock count */
    pobj->cExclusiveLock--;
    DECREASE_THREAD_LOCK_COUNT(pobj->hHmgr);
    DBG_LOGEVENT(&pobj->slhLog, EVENT_UNLOCK, 0);
 
    /* Check if this was the last lock */
    if (pobj->cExclusiveLock == 0)
    {
        /* Reset lock owner */
        pobj->dwThreadId = 0;
 
        /* Release the pushlock and reenable APCs */
        ExReleasePushLockExclusive(&pobj->pushlock);
        KeLeaveCriticalRegion();
    }
 
    /* Calculate the index */
    ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
 
    /* Decrement reference count */
    ASSERT((gpaulRefCount[ulIndex] & REF_MASK_COUNT) > 0);
    cRefs = InterlockedDecrement((LONG*)&gpaulRefCount[ulIndex]);
    ASSERT(cRefs & REF_MASK_VALID);
}

Referenced by DC_UnlockDc(), GDIOBJ_bLockMultipleObjects(), GreStretchBltMask(), NtGdiAlphaBlend(), NtGdiCreateClientObj(), NtGdiCreateServerMetaFile(), NtGdiGetServerMetaFileBits(), NtGdiTransparentBlt(), PATH_CreatePath(), REGION_UnlockRgn(), and BASEOBJECT::vUnlock().

GetBrushAttrPool()

PGDI_POOL GetBrushAttrPool

(

VOID

)

HACK!

Definition at line 1659 of file gdiobj.c.

{
    PPROCESSINFO ppi;
 
    ppi = PsGetCurrentProcessWin32Process();
    NT_ASSERT(ppi != NULL);
 
    return ppi->pPoolBrushAttr;
}

GreDeleteObject()

BOOL NTAPI GreDeleteObject

(

HGDIOBJ

hobj

)

Definition at line 1165 of file gdiobj.c.

{
    PENTRY pentry;
 
    /* Check for stock objects */
    if (GDI_HANDLE_IS_STOCKOBJ(hobj))
    {
        DPRINT1("GreDeleteObject: Cannot delete stock object %p.\n", hobj);
        return FALSE;
    }
 
    /* Reference the handle entry */
    pentry = ENTRY_ReferenceEntryByHandle(hobj, 0);
    if (!pentry)
    {
        DPRINT1("GreDeleteObject: Trying to delete invalid object %p\n", hobj);
        return FALSE;
    }
 
    /* Check for public owner */
    if (pentry->ObjectOwner.ulObj == GDI_OBJ_HMGR_PUBLIC)
    {
        DPRINT1("GreDeleteObject: Trying to delete global object %p\n", hobj);
        GDIOBJ_vDereferenceObject(pentry->einfo.pobj);
        return FALSE;
    }
 
    /* Delete the object */
    GDIOBJ_vDeleteObject(pentry->einfo.pobj);
    return TRUE;
}

Referenced by BITMAP_CopyBitmap(), co_IntDrawCaret(), co_IntPaintWindows(), co_UserExcludeUpdateRgn(), co_UserFreeWindow(), co_UserGetUpdateRgn(), co_WinPosSetWindowPos(), CreateBrushInternal(), DC_vRestoreDC(), DceDeleteClipRgn(), DceFreeDCE(), DefWndDoSizeMove(), DIB_CreateDIBSection(), DrawTextExWorker(), ForceNCPaintErase(), FreeCurIconObject(), GdiFlushUserBatch(), GreGetDIBitsInternal(), IntBeginPaint(), IntCreateDIBitmap(), IntDefWindowProc(), IntDestroyMonitorObject(), IntEndDesktopGraphics(), IntForceMinimizeWindow(), IntFreeElementData(), IntGdiCreateMaskFromRLE(), IntGdiDeleteColorSpace(), IntGdiDeleteDC(), IntGetNCUpdateRgn(), IntInvalidateWindows(), IntPaintDesktop(), IntSetDIBits(), IntUpdateLayeredWindowI(), MENU_DrawPopupGlyph(), MenuInit(), NC_HandleNCActivate(), NtGdiDeleteClientObj(), NtGdiDeleteObjectApp(), NtGdiExtCreateRegion(), NtGdiFrameRgn(), NtGdiStretchDIBitsInternal(), PaintSuspendedWindow(), REGION_XorRegion(), SelectWindowRgn(), SnapWindow(), SpiSetWallpaper(), TEXT_DrawUnderscore(), UITOOLS95_DFC_ButtonCheckRadio(), UITOOLS95_DrawFrameCaption(), UITOOLS95_DrawFrameMenu(), UITOOLS95_DrawFrameScroll(), UserDrawCaptionText(), UserGetDCEx(), UserUpdateMonitorSize(), and BRUSH::~BRUSH().

GreGetObject()

INT NTAPI GreGetObject	(	IN HGDIOBJ	hobj,
		IN INT	cbCount,
		OUT PVOID	pvBuffer
	)

Definition at line 1277 of file gdiobj.c.

{
    PVOID pvObj;
    UCHAR objt;
    INT iResult = 0;
 
    /* Verify object type */
    objt = ((ULONG_PTR)hobj >> 16) & 0x1f;
    if (objt != GDIObjType_BRUSH_TYPE &&
        objt != GDIObjType_SURF_TYPE &&
        objt != GDIObjType_LFONT_TYPE &&
        objt != GDIObjType_PAL_TYPE)
    {
        DPRINT1("GreGetObject: Invalid object type\n");
        return 0;
    }
 
    pvObj = GDIOBJ_ReferenceObjectByHandle(hobj, objt);
    if (!pvObj)
    {
        DPRINT("GreGetObject: Could not lock object\n");
        return 0;
    }
 
    switch (GDI_HANDLE_GET_TYPE(hobj))
    {
        case GDILoObjType_LO_PEN_TYPE:
        case GDILoObjType_LO_EXTPEN_TYPE:
            iResult = PEN_GetObject(pvObj, cbCount, pvBuffer);
            break;
 
        case GDILoObjType_LO_BRUSH_TYPE:
            iResult = BRUSH_GetObject(pvObj, cbCount, pvBuffer);
            break;
 
        case GDILoObjType_LO_BITMAP_TYPE:
            iResult = BITMAP_GetObject(pvObj, cbCount, pvBuffer);
            break;
 
        case GDILoObjType_LO_FONT_TYPE:
            iResult = FontGetObject(pvObj, cbCount, pvBuffer);
            break;
 
        case GDILoObjType_LO_PALETTE_TYPE:
            iResult = PALETTE_GetObject(pvObj, cbCount, pvBuffer);
            break;
 
        default:
            DPRINT1("GDI object type of 0x%p not implemented\n", hobj);
            break;
    }
 
    GDIOBJ_vDereferenceObject(pvObj);
    return iResult;
}

Referenced by IntTMWFixUp(), IntUpdateLayeredWindowI(), MENU_DrawBitmapItem(), MENU_GetBitmapItemSize(), NtGdiExtGetObjectW(), and PATH_WidenPathEx().

GreGetObjectOwner()

ULONG NTAPI GreGetObjectOwner

(

HGDIOBJ

hobj

)

Definition at line 1199 of file gdiobj.c.

{
    ULONG ulIndex, ulOwner;
 
    if (hobj == NULL)
    {
        DPRINT("GreGetObjectOwner: invalid NULL handle\n");
        return GDI_OBJ_HMGR_RESTRICTED;
    }
 
    /* Get the handle index */
    ulIndex = GDI_HANDLE_GET_INDEX(hobj);
 
    /* Check if the handle is valid */
    if (ulIndex >= GDI_HANDLE_COUNT ||
        gpentHmgr[ulIndex].Objt == GDIObjType_DEF_TYPE ||
        ((ULONG_PTR)hobj >> 16) != gpentHmgr[ulIndex].FullUnique)
    {
        DPRINT1("GreGetObjectOwner: invalid handle 0x%p.\n", hobj);
        return GDI_OBJ_HMGR_RESTRICTED;
    }
 
    /* Get the object owner */
    ulOwner = gpentHmgr[ulIndex].ObjectOwner.ulObj;
 
    if (ulOwner == HandleToUlong(PsGetCurrentProcessId()))
        return GDI_OBJ_HMGR_POWNED;
 
    if (ulOwner == GDI_OBJ_HMGR_PUBLIC)
        return GDI_OBJ_HMGR_PUBLIC;
 
    return GDI_OBJ_HMGR_RESTRICTED;
}

Referenced by DceFreeDCE(), GreSetBitmapOwner(), NtGdiDeleteObjectApp(), REGION_UnlockRgn(), and REGION_vSyncRegion().

GreIsHandleValid()

BOOL NTAPI GreIsHandleValid

(

HGDIOBJ

hobj

)

Definition at line 1153 of file gdiobj.c.

{
    PENTRY pentry;
 
    pentry = ENTRY_ReferenceEntryByHandle(hobj, 0);
    if (!pentry) return FALSE;
    GDIOBJ_vDereferenceObject(pentry->einfo.pobj);
    return TRUE;
}

Referenced by co_IntPaintWindows(), co_UserFreeWindow(), DceFreeDCE(), DceResetActiveDCEs(), GetControlColor(), IntBeginPaint(), IntGdiDeleteDC(), NC_HandleNCActivate(), NtGdiEqualRgn(), NtGdiFlushUserBatch(), NtUserSetWindowRgn(), PaintSuspendedWindow(), UserGetDCEx(), and BRUSH::~BRUSH().

GreSetObjectOwner()

BOOL NTAPI GreSetObjectOwner	(	HGDIOBJ	hobj,
		ULONG	ulOwner
	)

Definition at line 1268 of file gdiobj.c.

{
    return GreSetObjectOwnerEx(hobj, ulOwner, 0);
}

Referenced by _Success_(), DC_vRestoreDC(), DC_vSetOwner(), FreeCurIconObject(), GreSetBitmapOwner(), IntDdePostMessageHook(), IntDestroyMenu(), IntDestroyMonitorObject(), IntFreeElementData(), IntGdiSetRegionOwner(), IntSynthesizeBitmap(), MenuInit(), SpiSetWallpaper(), UserSetClipboardData(), and UserUpdateMonitorSize().

GreSetObjectOwnerEx()

BOOL NTAPI GreSetObjectOwnerEx	(	HGDIOBJ	hobj,
		ULONG	ulOwner,
		ULONG	Flags
	)

Definition at line 1235 of file gdiobj.c.

{
    PENTRY pentry;
 
    /* Check for stock objects */
    if (GDI_HANDLE_IS_STOCKOBJ(hobj))
    {
        DPRINT("GreSetObjectOwner: Got stock object %p\n", hobj);
        return FALSE;
    }
 
    /* Reference the handle entry */
    pentry = ENTRY_ReferenceEntryByHandle(hobj, Flags);
    if (!pentry)
    {
        DPRINT("GreSetObjectOwner: Invalid handle 0x%p.\n", hobj);
        return FALSE;
    }
 
    /* Call internal function */
    GDIOBJ_vSetObjectOwner(pentry->einfo.pobj, ulOwner);
 
    /* Dereference the object */
    GDIOBJ_vDereferenceObject(pentry->einfo.pobj);
 
    return TRUE;
}

Referenced by GreSetObjectOwner(), and NtUserConsoleControl().

INCREASE_THREAD_LOCK_COUNT()

FORCEINLINE void INCREASE_THREAD_LOCK_COUNT

(

_In_ HANDLE

hobj

)

Definition at line 63 of file gdiobj.c.

{
    PTHREADINFO pti = PsGetCurrentThreadWin32Thread();
    DBG_UNREFERENCED_PARAMETER(hobj);
    if (pti)
    {
#if DBG
        pti->acExclusiveLockCount[((ULONG_PTR)hobj >> 16) & 0x1f]++;
#endif
        pti->cExclusiveLocks++;
    }
}

Referenced by GDIOBJ_hInsertObject(), GDIOBJ_LockObject(), and GDIOBJ_TryLockObject().

IncrementCurrentProcessGdiHandleCount()

FORCEINLINE VOID IncrementCurrentProcessGdiHandleCount

(

void

)

Definition at line 332 of file gdiobj.c.

{
    PPROCESSINFO ppi = PsGetCurrentProcessWin32Process();
    if (ppi) InterlockedIncrement((LONG*)&ppi->GDIHandleCount);
}

Referenced by GDIOBJ_hInsertObject().

IncrementGdiHandleCount()

static VOID IncrementGdiHandleCount ( ULONG  ulProcessId )

inlinestatic

Definition at line 348 of file gdiobj.c.

{
    PEPROCESS pep;
    PPROCESSINFO ppi;
    NTSTATUS Status;
 
    Status = PsLookupProcessByProcessId(ULongToHandle(ulProcessId), &pep);
    NT_ASSERT(NT_SUCCESS(Status));
    __analysis_assume(NT_SUCCESS(Status));
 
    ppi = PsGetProcessWin32Process(pep);
    if (ppi) InterlockedIncrement((LONG*)&ppi->GDIHandleCount);
    if (NT_SUCCESS(Status)) ObDereferenceObject(pep);
}

Referenced by GDIOBJ_vSetObjectOwner().

InitGdiHandleTable()

NTSTATUS NTAPI InitGdiHandleTable

(

void

)

Definition at line 259 of file gdiobj.c.

{
    NTSTATUS status;
    LARGE_INTEGER liSize;
    PVOID pvSection;
    SIZE_T cjViewSize = 0;
 
    /* Create a section for the shared handle table */
    liSize.QuadPart = sizeof(GDI_HANDLE_TABLE); // GDI_HANDLE_COUNT * sizeof(ENTRY);
    status = MmCreateSection(&gpvGdiHdlTblSection,
                             SECTION_ALL_ACCESS,
                             NULL,
                             &liSize,
                             PAGE_READWRITE,
                             SEC_COMMIT | 0x1,
                             NULL,
                             NULL);
    if (!NT_SUCCESS(status))
    {
        DPRINT1("INITGDI: Could not allocate a GDI handle table.\n");
        return status;
    }
 
    /* Map the section in session space */
    status = MmMapViewInSessionSpace(gpvGdiHdlTblSection,
                                     (PVOID*)&gpentHmgr,
                                     &cjViewSize);
    if (!NT_SUCCESS(status))
    {
        DPRINT1("INITGDI: Failed to map handle table section\n");
        ObDereferenceObject(gpvGdiHdlTblSection);
        return status;
    }
 
    /* Allocate memory for the reference counter table */
    gpaulRefCount = EngAllocSectionMem(&pvSection,
                                     FL_ZERO_MEMORY,
                                     GDI_HANDLE_COUNT * sizeof(ULONG),
                                     'frHG');
    if (!gpaulRefCount)
    {
        DPRINT1("INITGDI: Failed to allocate reference table.\n");
        ObDereferenceObject(gpvGdiHdlTblSection);
        return STATUS_INSUFFICIENT_RESOURCES;
    }
 
    gulFirstFree = 0;
    gulFirstUnused = RESERVE_ENTRIES_COUNT;
 
    GdiHandleTable = (PVOID)gpentHmgr;
 
    /* Initialize the lookaside lists */
    gpaLookasideList = ExAllocatePoolWithTag(NonPagedPool,
                           GDIObjTypeTotal * sizeof(PAGED_LOOKASIDE_LIST),
                           TAG_GDIHNDTBLE);
    if(!gpaLookasideList)
        return STATUS_NO_MEMORY;
 
    InitLookasideList(GDIObjType_DC_TYPE, sizeof(DC));
    InitLookasideList(GDIObjType_RGN_TYPE, sizeof(REGION));
    InitLookasideList(GDIObjType_SURF_TYPE, sizeof(SURFACE));
    InitLookasideList(GDIObjType_CLIENTOBJ_TYPE, sizeof(CLIENTOBJ));
    InitLookasideList(GDIObjType_PATH_TYPE, sizeof(PATH));
    InitLookasideList(GDIObjType_PAL_TYPE, sizeof(PALETTE));
    InitLookasideList(GDIObjType_ICMLCS_TYPE, sizeof(COLORSPACE));
    InitLookasideList(GDIObjType_LFONT_TYPE, sizeof(TEXTOBJ));
    InitLookasideList(GDIObjType_BRUSH_TYPE, sizeof(BRUSH));
 
    return STATUS_SUCCESS;
}

Referenced by DriverEntry().

InitLookasideList()

static VOID InitLookasideList ( UCHAR  objt, ULONG  cjSize  )

static

Definition at line 245 of file gdiobj.c.

{
    ExInitializePagedLookasideList(&gpaLookasideList[objt],
                                   NULL,
                                   NULL,
                                   0,
                                   cjSize,
                                   GDITAG_HMGR_LOOKASIDE_START + (objt << 24),
                                   0);
}

Referenced by InitGdiHandleTable().

InterlockedReadUlong()

FORCEINLINE ULONG InterlockedReadUlong

(

_In_ _Interlocked_operand_ ULONG volatile *

Source

)

Definition at line 55 of file gdiobj.c.

{
    return *Source;
}

Referenced by ENTRY_pentPopFreeEntry(), and ENTRY_vPushFreeEntry().

NtGdiCreateClientObj()

W32KAPI HANDLE APIENTRY NtGdiCreateClientObj

(

IN ULONG

ulType

)

Definition at line 1389 of file gdiobj.c.

{
    POBJ pObject;
    HANDLE handle;
 
    /* Check if ulType is valid */
    if ((ulType != GDILoObjType_LO_METAFILE16_TYPE) &&
        (ulType != GDILoObjType_LO_METAFILE_TYPE) &&
        (ulType != GDILoObjType_LO_METADC16_TYPE))
    {
        DPRINT1("NtGdiCreateClientObj: Invalid object type 0x%lx.\n", ulType);
        return NULL;
    }
 
    /* Allocate a new object */
    pObject = GDIOBJ_AllocateObject(GDIObjType_CLIENTOBJ_TYPE,
                                    sizeof(CLIENTOBJ),
                                    BASEFLAG_LOOKASIDE);
    if (!pObject)
    {
        DPRINT1("NtGdiCreateClientObj: Could not allocate a clientobj.\n");
        return NULL;
    }
 
    /* Set the real object type */
    pObject->hHmgr = UlongToHandle(ulType | GDILoObjType_LO_CLIENTOBJ_TYPE);
 
    /* Create a handle */
    handle = GDIOBJ_hInsertObject(pObject, GDI_OBJ_HMGR_POWNED);
    if (!handle)
    {
        DPRINT1("NtGdiCreateClientObj: Could not create a handle.\n");
        GDIOBJ_vFreeObject(pObject);
        return NULL;
    }
 
    /* Unlock it */
    GDIOBJ_vUnlockObject(pObject);
 
    return handle;
}

NtGdiDeleteClientObj()

W32KAPI BOOL APIENTRY NtGdiDeleteClientObj

(

IN HANDLE

hobj

)

Definition at line 1435 of file gdiobj.c.

{
    /* We first need to get the real type from the handle */
    ULONG ulType = GDI_HANDLE_GET_TYPE(hobj);
 
    /* Check if it's really a CLIENTOBJ */
    if ((ulType & GDI_HANDLE_BASETYPE_MASK) != GDILoObjType_LO_CLIENTOBJ_TYPE)
    {
        /* FIXME: SetLastError? */
        return FALSE;
    }
 
    return GreDeleteObject(hobj);
}

NtGdiExtGetObjectW()

W32KAPI INT APIENTRY NtGdiExtGetObjectW	(	IN HANDLE	hobj,
		IN INT	cjBufferSize,
		OUT LPVOID	lpBuffer
	)

Definition at line 1339 of file gdiobj.c.

{
    UINT iResult, cjMaxSize;
    union
    {
        BITMAP bitmap;
        DIBSECTION dibsection;
        LOGPEN logpen;
        LOGBRUSH logbrush;
        LOGFONTW logfontw;
        EXTLOGFONTW extlogfontw;
        ENUMLOGFONTEXDVW enumlogfontexdvw;
    } object;
 
    /* Normalize to the largest supported object size */
    cjMaxSize = min((UINT)cjBufferSize, sizeof(object));
 
    /* Now do the actual call */
    iResult = GreGetObject(hobj, cjMaxSize, lpBuffer ? &object : NULL);
 
    /* Check if we have a buffer and data */
    if ((lpBuffer != NULL) && (iResult != 0))
    {
        /* Enter SEH for buffer transfer */
        _SEH2_TRY
        {
            /* Probe the buffer and copy it */
            cjMaxSize = min(cjMaxSize, iResult);
            ProbeForWrite(lpBuffer, cjMaxSize, sizeof(WORD));
            RtlCopyMemory(lpBuffer, &object, cjMaxSize);
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Clear the return value.
             * Do *NOT* set last error here! */
            iResult = 0;
        }
        _SEH2_END;
    }
 
    /* Return the count */
    return iResult;
}

Referenced by GetFontObjectA(), and GetObjectW().

Variable Documentation

apfnCleanup

const GDICLEANUPPROC apfnCleanup[]

static

Definition at line 159 of file gdiobj.c.

Referenced by GDIOBJ_vFreeObject().

apfnDelete

const GDIOBJDELETEPROC apfnDelete[]

static

Definition at line 197 of file gdiobj.c.

Referenced by GDIOBJ_vFreeObject().

GdiHandleTable

PGDI_HANDLE_TABLE GdiHandleTable = NULL

Definition at line 1453 of file gdiobj.c.

Referenced by InitGdiHandleTable().

gpaLookasideList

PPAGED_LOOKASIDE_LIST gpaLookasideList

static

Definition at line 153 of file gdiobj.c.

Referenced by GDIOBJ_AllocateObject(), GDIOBJ_vFreeObject(), InitGdiHandleTable(), and InitLookasideList().

gpaulRefCount

PULONG gpaulRefCount

Definition at line 150 of file gdiobj.c.

Referenced by ENTRY_hInsertObject(), ENTRY_ReferenceEntryByHandle(), ENTRY_vPushFreeEntry(), GDI_CleanupForProcess(), GDIOBJ_ReferenceObjectByHandle(), GDIOBJ_TryLockObject(), GDIOBJ_vDeleteObject(), GDIOBJ_vDereferenceObject(), GDIOBJ_vReferenceObjectByPointer(), GDIOBJ_vUnlockObject(), InitGdiHandleTable(), KdbCommand_Gdi_dumpht(), and KdbCommand_Gdi_handle().

gpentHmgr

PENTRY gpentHmgr

Definition at line 149 of file gdiobj.c.

Referenced by ENTRY_hInsertObject(), ENTRY_pentPopFreeEntry(), ENTRY_ReferenceEntryByHandle(), ENTRY_vPushFreeEntry(), GDI_CleanupForProcess(), GDIOBJ_pvGetObjectAttr(), GDIOBJ_ReferenceObjectByHandle(), GDIOBJ_vDereferenceObject(), GDIOBJ_vSetObjectAttr(), GDIOBJ_vSetObjectOwner(), GreGetObjectOwner(), InitGdiHandleTable(), KdbCommand_Gdi_dumpht(), KdbCommand_Gdi_entry(), and KdbCommand_Gdi_handle().

gpvGdiHdlTblSection

PVOID gpvGdiHdlTblSection = NULL

static

Definition at line 148 of file gdiobj.c.

Referenced by GDI_MapHandleTable(), and InitGdiHandleTable().

gulFirstFree

volatile ULONG gulFirstFree

Definition at line 151 of file gdiobj.c.

Referenced by ENTRY_pentPopFreeEntry(), ENTRY_vPushFreeEntry(), and InitGdiHandleTable().

gulFirstUnused

volatile ULONG gulFirstUnused

Definition at line 152 of file gdiobj.c.

Referenced by ENTRY_pentPopFreeEntry(), GDI_CleanupForProcess(), InitGdiHandleTable(), and KdbCommand_Gdi_dumpht().