Nikolay Sivov : dwrite: Validate simulation flags and fail face/ reference creation.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 890312ccfd0f54ece6bd330355183cc84a3a97ec
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=890312ccfd0f54ece6bd330355...

Author: Nikolay Sivov <nsivov(a)codeweavers.com>
Date:   Thu May  5 14:35:24 2016 +0300

dwrite: Validate simulation flags and fail face/reference creation.

Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/dwrite/dwrite_private.h |  6 ++++++
 dlls/dwrite/font.c           |  3 +++
 dlls/dwrite/main.c           |  3 +++
 dlls/dwrite/tests/font.c     | 13 ++++++++++++-
 4 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/dlls/dwrite/dwrite_private.h b/dlls/dwrite/dwrite_private.h
index 05b73df..61409c8 100644
--- a/dlls/dwrite/dwrite_private.h
+++ b/dlls/dwrite/dwrite_private.h
@@ -111,6 +111,12 @@ static inline FLOAT get_scaled_advance_width(INT32 advance, FLOAT emSize, const
     return (FLOAT)advance * emSize / (FLOAT)metrics->designUnitsPerEm;
 }
 
+static inline BOOL is_simulation_valid(DWRITE_FONT_SIMULATIONS simulations)
+{
+    return (simulations & ~(DWRITE_FONT_SIMULATIONS_NONE | DWRITE_FONT_SIMULATIONS_BOLD |
+        DWRITE_FONT_SIMULATIONS_OBLIQUE)) == 0;
+}
+
 struct gdiinterop
 {
     IDWriteGdiInterop1 IDWriteGdiInterop1_iface;
diff --git a/dlls/dwrite/font.c b/dlls/dwrite/font.c
index 0edeebf..2aad837 100644
--- a/dlls/dwrite/font.c
+++ b/dlls/dwrite/font.c
@@ -5568,6 +5568,9 @@ HRESULT create_fontfacereference(IDWriteFactory3 *factory, IDWriteFontFile *file
 
     *ret = NULL;
 
+    if (!is_simulation_valid(simulations))
+        return E_INVALIDARG;
+
     ref = heap_alloc(sizeof(*ref));
     if (!ref)
         return E_OUTOFMEMORY;
diff --git a/dlls/dwrite/main.c b/dlls/dwrite/main.c
index 0ecda11..7c9f085 100644
--- a/dlls/dwrite/main.c
+++ b/dlls/dwrite/main.c
@@ -839,6 +839,9 @@ static HRESULT WINAPI dwritefactory_CreateFontFace(IDWriteFactory3 *iface,
     if (req_facetype != DWRITE_FONT_FACE_TYPE_TRUETYPE_COLLECTION && index)
         return E_INVALIDARG;
 
+    if (!is_simulation_valid(simulations))
+        return E_INVALIDARG;
+
     /* check actual file/face type */
     is_supported = FALSE;
     face_type = DWRITE_FONT_FACE_TYPE_UNKNOWN;
diff --git a/dlls/dwrite/tests/font.c b/dlls/dwrite/tests/font.c
index affdfda..5169f2a 100644
--- a/dlls/dwrite/tests/font.c
+++ b/dlls/dwrite/tests/font.c
@@ -1524,6 +1524,13 @@ if (0) /* crashes on native */
     ok(face_type == DWRITE_FONT_FACE_TYPE_TRUETYPE, "got %i\n", face_type);
     ok(count == 1, "got %i\n", count);
 
+    /* invalid simulation flags */
+    hr = IDWriteFactory_CreateFontFace(factory, DWRITE_FONT_FACE_TYPE_CFF, 1, &file, 0, ~0u, &fontface);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+
+    hr = IDWriteFactory_CreateFontFace(factory, DWRITE_FONT_FACE_TYPE_CFF, 1, &file, 0, 0xf, &fontface);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+
     /* try mismatching face type, the one that's not supported */
     hr = IDWriteFactory_CreateFontFace(factory, DWRITE_FONT_FACE_TYPE_CFF, 1, &file, 0, DWRITE_FONT_SIMULATIONS_NONE, &fontface);
     ok(hr == DWRITE_E_FILEFORMAT, "got 0x%08x\n", hr);
@@ -5869,7 +5876,11 @@ static void test_CreateFontFaceReference(void)
     hr = IDWriteFactory3_CreateFontFaceReference(factory3, NULL, NULL, 0, DWRITE_FONT_SIMULATIONS_NONE, &ref);
     ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
 
-    /* test file is not a collection, but reference could still be created */
+    /* out of range simulation flags */
+    hr = IDWriteFactory3_CreateFontFaceReference(factory3, path, NULL, 0, ~0u, &ref);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+
+    /* test file is not a collection, but reference could still be created with non-zero face index */
     hr = IDWriteFactory3_CreateFontFaceReference(factory3, path, NULL, 1, DWRITE_FONT_SIMULATIONS_NONE, &ref);
     ok(hr == S_OK, "got 0x%08x\n", hr);