gdi32: ExtTextOut should fail if count is larger than INT_MAX.

dlls/gdi32/font.c

@@ -5823,6 +5823,8 @@ BOOL WINAPI ExtTextOutA( HDC hdc, INT x, INT y, UINT flags,
     BOOL ret;
     LPINT lpDxW = NULL;
 
+    if (count > INT_MAX) return FALSE;
+
     if (flags & ETO_GLYPH_INDEX)
         return ExtTextOutW( hdc, x, y, flags, lprect, (LPCWSTR)str, count, lpDx );
 
@@ -5932,6 +5934,7 @@ BOOL WINAPI ExtTextOutW( HDC hdc, INT x, INT y, UINT flags,
     static int quietfixme = 0;
 
     if (!dc) return FALSE;
+    if (count > INT_MAX) return FALSE;
 
     align = dc->textAlign;
     breakRem = dc->breakRem;

dlls/gdi32/tests/dib.c

@@ -3020,8 +3020,9 @@ static void draw_text_2( HDC hdc, const BITMAPINFO *bmi, BYTE *bits, BOOL aa )
     static const char str[] = "Hello Wine";
     POINT origin, g_org;
     static const BYTE vals[4] = { 0x00, 0x00, 0x00, 0x00 };
+    COLORREF bk_color, text_color;
     TEXTMETRICA tm;
-    COLORREF text_color;
+    RECT rect;
 
     for(i = 0; i < dib_size; i++)
         bits[i] = vals[i % 4];
@@ -3116,6 +3117,18 @@ static void draw_text_2( HDC hdc, const BITMAPINFO *bmi, BYTE *bits, BOOL aa )
     diy_hash = hash_dib( hdc, bmi, bits );
     ok( !strcmp( eto_hash, diy_hash ), "hash mismatch - aa %d\n", aa );
 
+    bk_color = GetBkColor( hdc );
+    SetBkColor( hdc, RGB(128,64,32) );
+
+    SetRect( &rect, 0, 0, bmi->bmiHeader.biWidth, bmi->bmiHeader.biHeight );
+    ret = ExtTextOutA( hdc, 10, 100, ETO_OPAQUE, &rect, str, -1, NULL );
+    ok( !ret, "ExtTextOutA succeeded\n" );
+
+    diy_hash = hash_dib( hdc, bmi, bits );
+    ok( !strcmp( eto_hash, diy_hash ), "hash mismatch - aa %d\n", aa );
+
+    SetBkColor( hdc, bk_color );
+
     HeapFree( GetProcessHeap(), 0, diy_hash );
     HeapFree( GetProcessHeap(), 0, eto_hash );
 

dlls/gdi32/tests/metafile.c

@@ -2394,6 +2394,26 @@ static void test_mf_ExtTextOut_on_path(void)
     ok(ret, "DeleteMetaFile(%p) error %d\n", hMetafile, GetLastError());
 }
 
+static const unsigned char EMF_EMPTY_BITS[] =
+{
+    0x01, 0x00, 0x00, 0x00, 0x6c, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0xdd, 0xff, 0xff, 0xff, 0xdd, 0xff, 0xff, 0xff,
+    0x20, 0x45, 0x4d, 0x46, 0x00, 0x00, 0x01, 0x00,
+    0x80, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
+    0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x90, 0x06, 0x00, 0x00, 0xba, 0x03, 0x00, 0x00,
+    0x4e, 0x02, 0x00, 0x00, 0x4a, 0x01, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0xb0, 0x00, 0x09, 0x00,
+    0x10, 0x09, 0x05, 0x00, 0x0e, 0x00, 0x00, 0x00,
+    0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x10, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00
+};
+
 static void test_emf_ExtTextOut_on_path(void)
 {
     HWND hwnd;
@@ -2403,6 +2423,7 @@ static void test_emf_ExtTextOut_on_path(void)
     LOGFONTA lf;
     HFONT hFont;
     static const INT dx[4] = { 3, 5, 8, 12 };
+    RECT rect = { 10, 20, 30, 40 };
 
     /* Win9x doesn't play EMFs on invisible windows */
     hwnd = CreateWindowExA(0, "static", NULL, WS_POPUP | WS_VISIBLE,
@@ -2515,6 +2536,26 @@ static void test_emf_ExtTextOut_on_path(void)
     ret = DeleteEnhMetaFile(hMetafile);
     ok(ret, "DeleteEnhMetaFile error %d\n", GetLastError());
 
+    /* test ExtTextOut with count == -1 doesn't get written */
+    hdcMetafile = CreateEnhMetaFileA(hdcDisplay, NULL, NULL, NULL);
+    ok(hdcMetafile != 0, "CreateEnhMetaFileA error %d\n", GetLastError());
+
+    ret = ExtTextOutA(hdcMetafile, 11, 22, ETO_OPAQUE, &rect, "Test", -1, dx);
+    ok(!ret, "ExtTextOut error %d\n", GetLastError());
+
+    hMetafile = CloseEnhMetaFile(hdcMetafile);
+    ok(hMetafile != 0, "CloseEnhMetaFile error %d\n", GetLastError());
+
+    if (compare_emf_bits(hMetafile, EMF_EMPTY_BITS, sizeof(EMF_EMPTY_BITS),
+        "emf_TextOut_negative_count", FALSE) != 0)
+    {
+        dump_emf_bits(hMetafile, "emf_TextOut_negative_count");
+        dump_emf_records(hMetafile, "emf_TextOut_negative_count");
+    }
+
+    ret = DeleteEnhMetaFile(hMetafile);
+    ok(ret, "DeleteEnhMetaFile error %d\n", GetLastError());
+
     ret = ReleaseDC(hwnd, hdcDisplay);
     ok(ret, "ReleaseDC error %d\n", GetLastError());
     DestroyWindow(hwnd);