richedit: Prevent font or colour buffer overflow on stream out.

Static sized buffers are used for storing the colours and fonts, so there needs to be a check to prevent these buffer from overflowing.

richedit: Prevent font or colour buffer overflow on stream out.
fac8e957 · Dylan Smith · Alexandre Julliard · 3df78710 · fac8e957
Commit fac8e957 authored Sep 30, 2008 by Dylan Smith Committed by Alexandre Julliard Oct 01, 2008
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 3 deletions

writer.c dlls/riched20/writer.c +3 -3

No files found.
--- a/dlls/riched20/writer.c
+++ b/dlls/riched20/writer.c
@@ -214,7 +214,7 @@ ME_StreamOutRTFFontAndColorTbl(ME_OutStream *pStream, ME_DisplayItem *pFirstRun,
        if (table[i].bCharSet == bCharSet
            && (table[i].szFaceName == face || !lstrcmpW(table[i].szFaceName, face)))
          break;
-      if (i == pStream->nFontTblLen) {
+      if (i == pStream->nFontTblLen && i < STREAMOUT_FONTTBL_SIZE) {
        table[i].bCharSet = bCharSet;
        table[i].szFaceName = face;
        pStream->nFontTblLen++;
@@ -226,7 +226,7 @@ ME_StreamOutRTFFontAndColorTbl(ME_OutStream *pStream, ME_DisplayItem *pFirstRun,
      for (i = 1; i < pStream->nColorTblLen; i++)
        if (pStream->colortbl[i] == crColor)
          break;
-      if (i == pStream->nColorTblLen) {
+      if (i == pStream->nColorTblLen && i < STREAMOUT_COLORTBL_SIZE) {
        pStream->colortbl[i] = crColor;
        pStream->nColorTblLen++;
      }
@@ -236,7 +236,7 @@ ME_StreamOutRTFFontAndColorTbl(ME_OutStream *pStream, ME_DisplayItem *pFirstRun,
      for (i = 1; i < pStream->nColorTblLen; i++)
        if (pStream->colortbl[i] == crColor)
          break;
-      if (i == pStream->nColorTblLen) {
+      if (i == pStream->nColorTblLen && i < STREAMOUT_COLORTBL_SIZE) {
        pStream->colortbl[i] = crColor;
        pStream->nColorTblLen++;
      }