Nikolay Sivov : gdiplus/metafile: Validate data size when playing back EmfPlusClear.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: b203b76190a8b68ee1cb0c64acd49e223b9a5edd
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=b203b76190a8b68ee1cb0c64acd49e223b9a5edd

Author: Nikolay Sivov <nsivov at codeweavers.com>
Date:   Tue Oct 17 15:49:11 2017 +0300

gdiplus/metafile: Validate data size when playing back EmfPlusClear.

Signed-off-by: Nikolay Sivov <nsivov at codeweavers.com>
Signed-off-by: Vincent Povirk <vincent at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/gdiplus/metafile.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dlls/gdiplus/metafile.c b/dlls/gdiplus/metafile.c
index 1fd4db2..9312a04 100644
--- a/dlls/gdiplus/metafile.c
+++ b/dlls/gdiplus/metafile.c
@@ -1823,6 +1823,9 @@ GpStatus WINGDIPAPI GdipPlayMetafileRecord(GDIPCONST GpMetafile *metafile,
         {
             EmfPlusClear *record = (EmfPlusClear*)header;
 
+            if (dataSize != sizeof(record->Color))
+                return InvalidParameter;
+
             return GdipGraphicsClear(metafile->playback_graphics, record->Color);
         }
         case EmfPlusRecordTypeFillRects: