From aef61ce366e613af0ccc941d7b20c36167d205ff Mon Sep 17 00:00:00 2001 From: Vincent Povirk Date: Fri, 1 Jan 2010 17:30:30 -0600 Subject: [PATCH] gdiplus: Always treat out of range string sizes as INT_MAX. If a program uses a Width or Height that is too large, roundr() can give us a bad value. --- dlls/gdiplus/graphics.c | 30 ++++++++++++++++++++---------- 1 files changed, 20 insertions(+), 10 deletions(-) diff --git a/dlls/gdiplus/graphics.c b/dlls/gdiplus/graphics.c index b083990..f308fa4 100644 --- a/dlls/gdiplus/graphics.c +++ b/dlls/gdiplus/graphics.c @@ -2464,12 +2464,12 @@ GpStatus WINGDIPAPI GdipDrawString(GpGraphics *graphics, GDIPCONST WCHAR *string rectcpy[3].Y = rectcpy[2].Y = rect->Y + offsety + rect->Height; transform_and_round_points(graphics, corners, rectcpy, 4); - if (roundr(rect->Width) == 0) + if (rect->Width >= INT_MAX || rect->Width < 0.5) nwidth = INT_MAX; else nwidth = roundr(rel_width * rect->Width); - if (roundr(rect->Height) == 0) + if (rect->Height >= INT_MAX || rect->Height < 0.5) nheight = INT_MAX; else nheight = roundr(rel_height * rect->Height); @@ -3476,11 +3476,16 @@ GpStatus WINGDIPAPI GdipMeasureCharacterRanges(GpGraphics* graphics, if(!stringdup) return OutOfMemory; oldfont = SelectObject(graphics->hdc, CreateFontIndirectW(&font->lfw)); - nwidth = roundr(rect->Width); - nheight = roundr(rect->Height); - if((nwidth == 0) && (nheight == 0)) - nwidth = nheight = INT_MAX; + if (rect->Width >= INT_MAX || rect->Width < 0.5) + nwidth = INT_MAX; + else + nwidth = roundr(rect->Width); + + if (rect->Height >= INT_MAX || rect->Height < 0.5) + nheight = INT_MAX; + else + nheight = roundr(rect->Height); for(i = 0, j = 0; i < length; i++){ if(!isprintW(string[i]) && (string[i] != '\n')) @@ -3611,11 +3616,16 @@ GpStatus WINGDIPAPI GdipMeasureString(GpGraphics *graphics, if(!stringdup) return OutOfMemory; oldfont = SelectObject(graphics->hdc, CreateFontIndirectW(&font->lfw)); - nwidth = roundr(rect->Width); - nheight = roundr(rect->Height); - if((nwidth == 0) && (nheight == 0)) - nwidth = nheight = INT_MAX; + if (rect->Width >= INT_MAX || rect->Width < 0.5) + nwidth = INT_MAX; + else + nwidth = roundr(rect->Width); + + if (rect->Height >= INT_MAX || rect->Height < 0.5) + nheight = INT_MAX; + else + nheight = roundr(rect->Height); for(i = 0, j = 0; i < length; i++){ if(!isprintW(string[i]) && (string[i] != '\n')) -- 1.6.3.3