From d0fbb92a57e3d9057f37e6beff9e1f4b73f15310 Mon Sep 17 00:00:00 2001 From: Amine Khaldi Date: Fri, 29 May 2015 11:03:17 +0000 Subject: [PATCH] [WIN32K] Apply Wine commit 147765a by Sam Edwards: Prevent possible buffer overflows in get_glyph_outline. svn path=/trunk/; revision=67948 --- reactos/win32ss/gdi/ntgdi/freetype.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/reactos/win32ss/gdi/ntgdi/freetype.c b/reactos/win32ss/gdi/ntgdi/freetype.c index 2486d7f4266..c1068140410 100644 --- a/reactos/win32ss/gdi/ntgdi/freetype.c +++ b/reactos/win32ss/gdi/ntgdi/freetype.c @@ -2062,8 +2062,8 @@ ftGdiGetGlyphOutline( case ft_glyph_format_bitmap: { BYTE *src = ft_face->glyph->bitmap.buffer, *dst = pvBuf; - INT w = (ft_face->glyph->bitmap.width + 7) >> 3; - INT h = ft_face->glyph->bitmap.rows; + INT w = min( pitch, (ft_face->glyph->bitmap.width + 7) >> 3 ); + INT h = min( height, ft_face->glyph->bitmap.rows ); while (h--) { RtlCopyMemory(dst, src, w); @@ -2120,7 +2120,7 @@ ftGdiGetGlyphOutline( case ft_glyph_format_bitmap: { BYTE *src = ft_face->glyph->bitmap.buffer, *dst = pvBuf; - INT h = ft_face->glyph->bitmap.rows; + INT h = min( height, ft_face->glyph->bitmap.rows ); INT x; while (h--) {