From d8b6b1be593879b60b7e4037a2b236725a1e2084 Mon Sep 17 00:00:00 2001 From: Vincent Povirk Date: Sat, 17 Apr 2010 12:04:03 -0500 Subject: [PATCH] gdiplus: Prevent integer overflows when rounding text bounds. Mono calls GdipMeasureString with a height so large that rounding and converting it to an integer gives a negative result. --- dlls/gdiplus/graphics.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dlls/gdiplus/graphics.c b/dlls/gdiplus/graphics.c index 7a6fad3..eb24008 100644 --- a/dlls/gdiplus/graphics.c +++ b/dlls/gdiplus/graphics.c @@ -3493,7 +3493,7 @@ static GpStatus gdip_format_string(GpGraphics *graphics, gdip_format_string_callback callback, void *user_data) { WCHAR* stringdup; - INT sum = 0, height = 0, fit, fitcpy, i, j, lret, nwidth, + int sum = 0, height = 0, fit, fitcpy, i, j, lret, nwidth, nheight, lineend, lineno = 0; RectF bounds; StringAlignment halign; @@ -3508,8 +3508,8 @@ static GpStatus gdip_format_string(GpGraphics *graphics, nwidth = roundr(rect->Width); nheight = roundr(rect->Height); - if (nwidth == 0) nwidth = INT_MAX; - if (nheight == 0) nheight = INT_MAX; + if (nwidth == 0 || rect->Width >= INT_MAX) nwidth = INT_MAX; + if (nheight == 0 || rect->Height >= INT_MAX) nheight = INT_MAX; for(i = 0, j = 0; i < length; i++){ /* FIXME: This makes the indexes passed to callback inaccurate. */ -- 1.6.3.3