Alex Henrie : win32u: Handle memory allocation failures in nulldrv_PolyBezierTo (cppcheck).

[Alexandre Julliard]

Module: wine
Branch: master
Commit: b498f38e1c41759a2bbe4f1f7bcfd63e302adcd0
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=b498f38e1c41759a2bbe4f1f7bcfd63e302adcd0

Author: Alex Henrie <alexhenrie24 at gmail.com>
Date:   Wed Dec 22 13:35:36 2021 +0000

win32u: Handle memory allocation failures in nulldrv_PolyBezierTo (cppcheck).

Signed-off-by: Alex Henrie <alexhenrie24 at gmail.com>
Signed-off-by: Huw Davies <huw at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/win32u/painting.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/dlls/win32u/painting.c b/dlls/win32u/painting.c
index 7939ea878da..648630cf2c0 100644
--- a/dlls/win32u/painting.c
+++ b/dlls/win32u/painting.c
@@ -156,7 +156,7 @@ BOOL CDECL nulldrv_PolyBezierTo( PHYSDEV dev, const POINT *points, DWORD count )
 BOOL CDECL nulldrv_PolyDraw( PHYSDEV dev, const POINT *points, const BYTE *types, DWORD count )
 {
     DC *dc = get_nulldrv_dc( dev );
-    POINT *line_pts = NULL, *bzr_pts = NULL, bzr[4];
+    POINT *line_pts = NULL, *new_line_pts, *bzr_pts = NULL, bzr[4];
     DWORD i;
     INT num_pts, num_bzr_pts, space, size;
 
@@ -182,6 +182,7 @@ BOOL CDECL nulldrv_PolyDraw( PHYSDEV dev, const POINT *points, const BYTE *types
 
     space = count + 300;
     line_pts = malloc( space * sizeof(POINT) );
+    if (!line_pts) return FALSE;
     num_pts = 1;
 
     line_pts[0] = dc->attr->cur_pos;
@@ -209,7 +210,14 @@ BOOL CDECL nulldrv_PolyDraw( PHYSDEV dev, const POINT *points, const BYTE *types
                 if (space < size)
                 {
                     space = size * 2;
-                    line_pts = realloc( line_pts, space * sizeof(POINT) );
+                    new_line_pts = realloc( line_pts, space * sizeof(POINT) );
+                    if (!new_line_pts)
+                    {
+                        free( bzr_pts );
+                        free( line_pts );
+                        return FALSE;
+                    }
+                    line_pts = new_line_pts;
                 }
                 memcpy( &line_pts[num_pts], &bzr_pts[1], (num_bzr_pts - 1) * sizeof(POINT) );
                 num_pts += num_bzr_pts - 1;