[PATCH] win32u: Handle memory allocation failures in nulldrv_PolyBezierTo (cppcheck)

[Alex Henrie]

Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com>
---
 dlls/win32u/painting.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/dlls/win32u/painting.c b/dlls/win32u/painting.c
index 7939ea878da..ca914a3a294 100644
--- a/dlls/win32u/painting.c
+++ b/dlls/win32u/painting.c
@@ -156,7 +156,7 @@ BOOL CDECL nulldrv_PolyBezierTo( PHYSDEV dev, const POINT *points, DWORD count )
 BOOL CDECL nulldrv_PolyDraw( PHYSDEV dev, const POINT *points, const BYTE *types, DWORD count )
 {
     DC *dc = get_nulldrv_dc( dev );
-    POINT *line_pts = NULL, *bzr_pts = NULL, bzr[4];
+    POINT *line_pts = NULL, *new_line_pts, *bzr_pts = NULL, bzr[4];
     DWORD i;
     INT num_pts, num_bzr_pts, space, size;
 
@@ -182,6 +182,7 @@ BOOL CDECL nulldrv_PolyDraw( PHYSDEV dev, const POINT *points, const BYTE *types
 
     space = count + 300;
     line_pts = malloc( space * sizeof(POINT) );
+    if (!line_pts) return FALSE;
     num_pts = 1;
 
     line_pts[0] = dc->attr->cur_pos;
@@ -209,7 +210,13 @@ BOOL CDECL nulldrv_PolyDraw( PHYSDEV dev, const POINT *points, const BYTE *types
                 if (space < size)
                 {
                     space = size * 2;
-                    line_pts = realloc( line_pts, space * sizeof(POINT) );
+                    new_line_pts = realloc( line_pts, space * sizeof(POINT) );
+                    if (!new_line_pts)
+                    {
+                        free( line_pts );
+                        return FALSE;
+                    }
+                    line_pts = new_line_pts;
                 }
                 memcpy( &line_pts[num_pts], &bzr_pts[1], (num_bzr_pts - 1) * sizeof(POINT) );
                 num_pts += num_bzr_pts - 1;
-- 
2.34.1

[Huw Davies]

On Wed, Dec 22, 2021 at 12:58:21AM -0700, Alex Henrie wrote:
> Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com>
> ---
>  dlls/win32u/painting.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/dlls/win32u/painting.c b/dlls/win32u/painting.c
> index 7939ea878da..ca914a3a294 100644
> --- a/dlls/win32u/painting.c
> +++ b/dlls/win32u/painting.c
> @@ -156,7 +156,7 @@ BOOL CDECL nulldrv_PolyBezierTo( PHYSDEV dev, const POINT *points, DWORD count )
>  BOOL CDECL nulldrv_PolyDraw( PHYSDEV dev, const POINT *points, const BYTE *types, DWORD count )
>  {
>      DC *dc = get_nulldrv_dc( dev );
> -    POINT *line_pts = NULL, *bzr_pts = NULL, bzr[4];
> +    POINT *line_pts = NULL, *new_line_pts, *bzr_pts = NULL, bzr[4];
>      DWORD i;
>      INT num_pts, num_bzr_pts, space, size;
>
> @@ -182,6 +182,7 @@ BOOL CDECL nulldrv_PolyDraw( PHYSDEV dev, const POINT *points, const BYTE *types
>
> space = count + 300;
>      line_pts = malloc( space * sizeof(POINT) );
> +    if (!line_pts) return FALSE;
>      num_pts = 1;
>
> line_pts[0] = dc->attr->cur_pos;
> @@ -209,7 +210,13 @@ BOOL CDECL nulldrv_PolyDraw( PHYSDEV dev, const POINT *points, const BYTE *types
>                  if (space < size)
>                  {
>                      space = size * 2;
> -                    line_pts = realloc( line_pts, space * sizeof(POINT) );
> +                    new_line_pts = realloc( line_pts, space * sizeof(POINT) );
> +                    if (!new_line_pts)
> +                    {
> +                        free( line_pts );
> +                        return FALSE;

If we're going to bother doing this, we may as well free bzr_pts too.
I've sent in v2.

Huw.