dwrite: Validate simulation flags and fail face/reference creation.

dlls/dwrite/dwrite_private.h

@@ -111,6 +111,12 @@ static inline FLOAT get_scaled_advance_width(INT32 advance, FLOAT emSize, const
     return (FLOAT)advance * emSize / (FLOAT)metrics->designUnitsPerEm;
 }
 
+static inline BOOL is_simulation_valid(DWRITE_FONT_SIMULATIONS simulations)
+{
+    return (simulations & ~(DWRITE_FONT_SIMULATIONS_NONE | DWRITE_FONT_SIMULATIONS_BOLD |
+        DWRITE_FONT_SIMULATIONS_OBLIQUE)) == 0;
+}
+
 struct gdiinterop
 {
     IDWriteGdiInterop1 IDWriteGdiInterop1_iface;

dlls/dwrite/font.c

@@ -5568,6 +5568,9 @@ HRESULT create_fontfacereference(IDWriteFactory3 *factory, IDWriteFontFile *file
 
     *ret = NULL;
 
+    if (!is_simulation_valid(simulations))
+        return E_INVALIDARG;
+
     ref = heap_alloc(sizeof(*ref));
     if (!ref)
         return E_OUTOFMEMORY;

dlls/dwrite/main.c

@@ -839,6 +839,9 @@ static HRESULT WINAPI dwritefactory_CreateFontFace(IDWriteFactory3 *iface,
     if (req_facetype != DWRITE_FONT_FACE_TYPE_TRUETYPE_COLLECTION && index)
         return E_INVALIDARG;
 
+    if (!is_simulation_valid(simulations))
+        return E_INVALIDARG;
+
     /* check actual file/face type */
     is_supported = FALSE;
     face_type = DWRITE_FONT_FACE_TYPE_UNKNOWN;

dlls/dwrite/tests/font.c

@@ -1524,6 +1524,13 @@ if (0) /* crashes on native */
     ok(face_type == DWRITE_FONT_FACE_TYPE_TRUETYPE, "got %i\n", face_type);
     ok(count == 1, "got %i\n", count);
 
+    /* invalid simulation flags */
+    hr = IDWriteFactory_CreateFontFace(factory, DWRITE_FONT_FACE_TYPE_CFF, 1, &file, 0, ~0u, &fontface);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+
+    hr = IDWriteFactory_CreateFontFace(factory, DWRITE_FONT_FACE_TYPE_CFF, 1, &file, 0, 0xf, &fontface);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+
     /* try mismatching face type, the one that's not supported */
     hr = IDWriteFactory_CreateFontFace(factory, DWRITE_FONT_FACE_TYPE_CFF, 1, &file, 0, DWRITE_FONT_SIMULATIONS_NONE, &fontface);
     ok(hr == DWRITE_E_FILEFORMAT, "got 0x%08x\n", hr);
@@ -5869,7 +5876,11 @@ static void test_CreateFontFaceReference(void)
     hr = IDWriteFactory3_CreateFontFaceReference(factory3, NULL, NULL, 0, DWRITE_FONT_SIMULATIONS_NONE, &ref);
     ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
 
-    /* test file is not a collection, but reference could still be created */
+    /* out of range simulation flags */
+    hr = IDWriteFactory3_CreateFontFaceReference(factory3, path, NULL, 0, ~0u, &ref);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+
+    /* test file is not a collection, but reference could still be created with non-zero face index */
     hr = IDWriteFactory3_CreateFontFaceReference(factory3, path, NULL, 1, DWRITE_FONT_SIMULATIONS_NONE, &ref);
     ok(hr == S_OK, "got 0x%08x\n", hr);