Skip to content

W
wine-winehq
Commit 43837ed2 authored by Gerald Pfeifer's avatar Gerald Pfeifer Committed by Alexandre Julliard
Browse files
Options

gdi32: Tighten range checking in PlayEnhMetaFileRecord() and remove four useless checks.

parent ad92cdcf
Hide whitespace changes
Inline Side-by-side
Showing with 7 additions and 5 deletions
dlls/gdi32/enhmetafile.c
View file @ 43837ed2
......@@ -1669,11 +1669,13 @@ BOOL WINAPI PlayEnhMetaFileRecord(
const EMRCREATEDIBPATTERNBRUSHPT *lpCreate = (const EMRCREATEDIBPATTERNBRUSHPT *)mr;
LPVOID lpPackedStruct;
/* check that offsets and data are contained within the record */
if ( !( (lpCreate->cbBmi>=0) && (lpCreate->cbBits>=0) &&
(lpCreate->offBmi>=0) && (lpCreate->offBits>=0) &&
((lpCreate->offBmi +lpCreate->cbBmi ) <= mr->nSize) &&
((lpCreate->offBits+lpCreate->cbBits) <= mr->nSize) ) )
/* Check that offsets and data are contained within the record
* (including checking for wrap arounds).
*/
if ( lpCreate->offBmi + lpCreate->cbBmi > mr->nSize
|| lpCreate->offBits + lpCreate->cbBits > mr->nSize
|| lpCreate->offBmi + lpCreate->cbBmi < lpCreate->offBmi
|| lpCreate->offBits + lpCreate->cbBits < lpCreate->offBits )
{
ERR("Invalid EMR_CREATEDIBPATTERNBRUSHPT record\n");
break;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment