gdi32: Avoid variable-length arrays.

[Thomas Faber]

From 147050facf96c2c68a1adfc1ed88da3cb84c8ca7 Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber at reactos.org>
Date: Tue, 25 Mar 2014 08:46:00 +0100
Subject: gdi32: Avoid variable-length arrays.

---
 dlls/gdi32/bidi.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/dlls/gdi32/bidi.c b/dlls/gdi32/bidi.c
index 1d6be53..aeb7400 100644
--- a/dlls/gdi32/bidi.c
+++ b/dlls/gdi32/bidi.c
@@ -596,10 +596,27 @@ BOOL BIDI_Reorder(
 
         if (lpGlyphs && doGlyphs)
         {
-            BYTE runOrder[maxItems];
-            int visOrder[maxItems];
+            BYTE *runOrder;
+            int *visOrder;
             SCRIPT_ITEM *curItem;
 
+            runOrder = HeapAlloc(GetProcessHeap(), 0, maxItems * sizeof(*runOrder));
+            visOrder = HeapAlloc(GetProcessHeap(), 0, maxItems * sizeof(*visOrder));
+            if (!runOrder || !visOrder)
+            {
+                WARN("Out of memory\n");
+                if (runOrder)
+                    HeapFree(GetProcessHeap(), 0, runOrder);
+                if (visOrder)
+                    HeapFree(GetProcessHeap(), 0, visOrder);
+                HeapFree(GetProcessHeap(), 0, chartype);
+                HeapFree(GetProcessHeap(), 0, levels);
+                HeapFree(GetProcessHeap(), 0, pItems);
+                HeapFree(GetProcessHeap(), 0, psva);
+                HeapFree(GetProcessHeap(), 0, pwLogClust);
+                return FALSE;
+            }
+
             for (j = 0; j < nItems; j++)
                 runOrder[j] = pItems[j].a.s.uBidiLevel;
 
@@ -621,6 +638,8 @@ BOOL BIDI_Reorder(
                     if (!run_glyphs)
                     {
                         WARN("Out of memory\n");
+                        HeapFree(GetProcessHeap(), 0, runOrder);
+                        HeapFree(GetProcessHeap(), 0, visOrder);
                         HeapFree(GetProcessHeap(), 0, chartype);
                         HeapFree(GetProcessHeap(), 0, levels);
                         HeapFree(GetProcessHeap(), 0, pItems);
@@ -655,6 +674,8 @@ BOOL BIDI_Reorder(
                     glyph_i += cOutGlyphs;
                 }
             }
+            HeapFree(GetProcessHeap(), 0, runOrder);
+            HeapFree(GetProcessHeap(), 0, visOrder);
         }
 
         done += i;
-- 
1.8.3.2