gdi32: Prevent another possible buffer overflow in get_glyph_outline.

53ec9b32 · Sam Edwards · Alexandre Julliard · a180e5ed · 53ec9b32
Commit 53ec9b32 authored Apr 30, 2013 by Sam Edwards Committed by Alexandre Julliard Apr 30, 2013
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 2 deletions

freetype.c dlls/gdi32/freetype.c +3 -2

No files found.
--- a/dlls/gdi32/freetype.c
+++ b/dlls/gdi32/freetype.c
@@ -6362,9 +6362,10 @@ static DWORD get_glyph_outline(GdiFont *incoming_font, UINT glyph, UINT format,
                y_shift = height - (src_height / vmul);

            dst += x_shift + y_shift * ( pitch / 4 );
-            while ( src_height )
+            height = min( height, src_height / vmul );
+            while ( height-- )
            {
-                for ( x = 0; x < src_width / hmul; x++ )
+                for ( x = 0; x < width && x < src_width / hmul; x++ )
                {
                    if ( rgb )
                    {