Re: [PATCH v5 0/1] MR2262: winspool: Check dmSize in IsValidDevmodeW

[Piotr Caban (＠piotr)]

Piotr Caban (@piotr) commented about dlls/winspool.drv/info.c:
> #undef F_SIZE
>      };
>      int i;
> +    const DWORD offFields = FIELD_OFFSET(DEVMODEW, dmFields) + sizeof(dm->dmFields);
>
> if (!dm) return FALSE;
> -    if (size < FIELD_OFFSET(DEVMODEW, dmFields) + sizeof(dm->dmFields)) return FALSE;
> +    if (size < offFields) return FALSE;
> +    if (dm->dmSize < offFields || size < dm->dmSize + dm->dmDriverExtra) return FALSE;
> +    if (((dm->dmSize - offFields) % 4) && dm->dmDriverExtra) return FALSE;
>
> for (i = 0; i < ARRAY_SIZE(map); i++)
>          if ((dm->dmFields & map[i].flag) && size < map[i].size)
> This line should be changed to:
if ((dm->dmFields & map[i].flag) && dm->dmSize &lt; map[i].size)

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/2262#note_25390