system/wine
system/wine
1
0
Fork 0
mirror of git://source.winehq.org/git/wine.git synced 2024-09-28 22:52:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

riched20: In para_set_fmt protect against out of bound cTabStop values.

Browse source 
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=56730
This commit is contained in:
Fabian Maurer 2024-05-26 19:20:07 +02:00 committed by Alexandre Julliard
parent a3b22d3bf7
commit 7b2ff97773
2 changed files with 32 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
dlls/riched20/para.c
View file

@ -486,8 +486,9 @@ static BOOL para_set_fmt( ME_TextEditor *editor, ME_Paragraph *para, const PARAF
COPY_FIELD(PFM_ALIGNMENT, wAlignment);
if (dwMask & PFM_TABSTOPS)
{
para->fmt.cTabCount = pFmt->cTabCount;
memcpy(para->fmt.rgxTabs, pFmt->rgxTabs, pFmt->cTabCount*sizeof(LONG));
/* Clamp between 0 and MAX_TAB_STOPS */
para->fmt.cTabCount = max(0, min(pFmt->cTabCount, MAX_TAB_STOPS));
memcpy(para->fmt.rgxTabs, pFmt->rgxTabs, para->fmt.cTabCount * sizeof(LONG));
}
#define EFFECTS_MASK (PFM_RTLPARA|PFM_KEEP|PFM_KEEPNEXT|PFM_PAGEBREAKBEFORE| \

29
dlls/riched20/tests/editor.c
View file

@ -8802,6 +8802,35 @@ static void test_alignment_style(void)
SendMessageW(richedit, EM_GETPARAFORMAT, 0, (LPARAM)&pf);
ok(pf.wAlignment == align_mask[i], "got %d expect %ld\n", pf.wAlignment, align_mask[i]);
/* Test out of bounds tab count */
pf.dwMask = PFM_TABSTOPS;
pf.cTabCount = -25000;
SendMessageW(richedit, EM_SETPARAFORMAT, 0, (LPARAM)&pf);
ok(pf.cTabCount == -25000, "Got %d\n", pf.cTabCount);
SendMessageW(richedit, EM_GETPARAFORMAT, 0, (LPARAM)&pf);
ok(pf.cTabCount == 0, "Got %d\n", pf.cTabCount);
pf.dwMask = PFM_TABSTOPS;
pf.cTabCount = 25000;
SendMessageW(richedit, EM_SETPARAFORMAT, 0, (LPARAM)&pf);
ok(pf.cTabCount == 25000, "Got %d\n", pf.cTabCount);
SendMessageW(richedit, EM_GETPARAFORMAT, 0, (LPARAM)&pf);
ok(pf.cTabCount == 32, "Got %d\n", pf.cTabCount);
pf.dwMask = PFM_TABSTOPS;
pf.cTabCount = 32;
SendMessageW(richedit, EM_SETPARAFORMAT, 0, (LPARAM)&pf);
SendMessageW(richedit, EM_GETPARAFORMAT, 0, (LPARAM)&pf);
ok(pf.cTabCount == 32, "Got %d\n", pf.cTabCount);
pf.dwMask = PFM_TABSTOPS;
pf.cTabCount = 33;
SendMessageW(richedit, EM_SETPARAFORMAT, 0, (LPARAM)&pf);
SendMessageW(richedit, EM_GETPARAFORMAT, 0, (LPARAM)&pf);
ok(pf.cTabCount == 32, "Got %d\n", pf.cTabCount);
pf.dwMask = PFM_TABSTOPS;
pf.cTabCount = 1;
SendMessageW(richedit, EM_SETPARAFORMAT, 0, (LPARAM)&pf);
SendMessageW(richedit, EM_GETPARAFORMAT, 0, (LPARAM)&pf);
ok(pf.cTabCount == 1, "Got %d\n", pf.cTabCount);
DestroyWindow(richedit);
}