From ba15efc31267fb18d0af4ef969e76495db90fea4 Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Wed, 24 Dec 2008 15:35:40 +0000
Subject: [PATCH] - Put Dx values at start of buffer to have alignemnt of 4 -
 increase size of stack buffer to 100, results in >90% buffer hits - Handle Dy
 values when ETO_PDY is specified (patch by Alexander Potashev, aspotashev at
 gmail dot com)

See issue #3958 for more details.

svn path=/trunk/; revision=38328
---
 reactos/subsystems/win32/win32k/objects/freetype.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/reactos/subsystems/win32/win32k/objects/freetype.c b/reactos/subsystems/win32/win32k/objects/freetype.c
index 97636614a5c..9ca317e7d8e 100644
--- a/reactos/subsystems/win32/win32k/objects/freetype.c
+++ b/reactos/subsystems/win32/win32k/objects/freetype.c
@@ -3603,6 +3603,12 @@ GreExtTextOutW(
             TextLeft += Dx[i<<DxShift] << 6;
 //         DbgPrint("new TextLeft2: %d\n", TextLeft);
         }
+
+        if (DxShift)
+        {
+            TextTop -= Dx[2 * i + 1] << 6;
+        }
+
         previous = glyph_index;
 
         String++;
@@ -3651,7 +3657,7 @@ fail:
     return FALSE;
 }
 
-#define STACK_TEXT_BUFFER_SIZE 50
+#define STACK_TEXT_BUFFER_SIZE 100
 BOOL
 APIENTRY
 NtGdiExtTextOutW(
@@ -3706,17 +3712,19 @@ NtGdiExtTextOutW(
         /* Probe and copy user mode data to the buffer */
         _SEH2_TRY
         {
+            /* Put the Dx before the String to assure alignment of 4 */
+            SafeString = (LPWSTR)(((ULONG_PTR)Buffer) + DxSize);
+
             /* Probe and copy the string */
             ProbeForRead(UnsafeString, StringSize, 1);
-            SafeString = Buffer;
             memcpy((PVOID)SafeString, UnsafeString, StringSize);
 
             /* If we have Dx values... */
             if (UnsafeDx)
             {
                 /* ... probe and copy them */
+                SafeDx = Buffer;
                 ProbeForRead(UnsafeDx, DxSize, 1);
-                SafeDx = (LPINT)(((ULONG_PTR)Buffer) + StringSize);
                 memcpy(SafeDx, UnsafeDx, DxSize);
             }
         }