wineps: Fix buffer overflow in PSDRV_WriteDIBPatternDict function.

5d68939d · Piotr Caban · Alexandre Julliard · 576827d8 · 5d68939d
Commit 5d68939d authored Mar 10, 2023 by Piotr Caban Committed by Alexandre Julliard Mar 10, 2023
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

ps.c dlls/wineps.drv/ps.c +1 -1

No files found.
--- a/dlls/wineps.drv/ps.c
+++ b/dlls/wineps.drv/ps.c
@@ -974,7 +974,7 @@ BOOL PSDRV_WriteDIBPatternDict(PHYSDEV dev, const BITMAPINFO *bmi, BYTE *bits, U
    w = bmi->bmiHeader.biWidth & ~0x7;
    h = abs_height & ~0x7;

-    buf = HeapAlloc( GetProcessHeap(), 0, sizeof(do_pattern) + 100 );
+    buf = HeapAlloc( GetProcessHeap(), 0, max(sizeof(do_pattern) + 100, 2 * w/8 * h + 1) );
    ptr = buf;
    for(y = h-1; y >= 0; y--) {
        for(x = 0; x < w/8; x++) {