mirror of
git://source.winehq.org/git/wine.git
synced 2024-10-06 09:34:09 +00:00
gdi32: Fix possible overflow.
According to the documentation of ScriptShape function, the psva argument should have the number of elements indicated by cMaxGlyphs.
This commit is contained in:
parent
46f307073e
commit
4312be1646
|
@ -471,7 +471,7 @@ static BOOL BIDI_Reorder( HDC hDC, /* [in] Display DC */
|
|||
WARN("Out of memory\n");
|
||||
goto cleanup;
|
||||
}
|
||||
psva = HeapAlloc(GetProcessHeap(),0,sizeof(SCRIPT_VISATTR) * uCount);
|
||||
psva = HeapAlloc(GetProcessHeap(),0,sizeof(SCRIPT_VISATTR) * cMaxGlyphs);
|
||||
if (!psva)
|
||||
{
|
||||
WARN("Out of memory\n");
|
||||
|
@ -604,16 +604,22 @@ static BOOL BIDI_Reorder( HDC hDC, /* [in] Display DC */
|
|||
while (res == E_OUTOFMEMORY)
|
||||
{
|
||||
WORD *new_run_glyphs = HeapReAlloc(GetProcessHeap(), 0, run_glyphs, sizeof(*run_glyphs) * cMaxGlyphs * 2);
|
||||
if (!new_run_glyphs)
|
||||
SCRIPT_VISATTR *new_psva = HeapReAlloc(GetProcessHeap(), 0, psva, sizeof(*psva) * cMaxGlyphs * 2);
|
||||
if (!new_run_glyphs || !new_psva)
|
||||
{
|
||||
WARN("Out of memory\n");
|
||||
HeapFree(GetProcessHeap(), 0, runOrder);
|
||||
HeapFree(GetProcessHeap(), 0, visOrder);
|
||||
HeapFree(GetProcessHeap(), 0, *lpGlyphs);
|
||||
*lpGlyphs = NULL;
|
||||
if (new_run_glyphs)
|
||||
run_glyphs = new_run_glyphs;
|
||||
if (new_psva)
|
||||
psva = new_psva;
|
||||
goto cleanup;
|
||||
}
|
||||
run_glyphs = new_run_glyphs;
|
||||
psva = new_psva;
|
||||
cMaxGlyphs *= 2;
|
||||
res = ScriptShape(hDC, &psc, lpString + done + curItem->iCharPos, cChars, cMaxGlyphs, &curItem->a, run_glyphs, pwLogClust, psva, &cOutGlyphs);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue