Re: [PATCH 0/1] MR1006: gdi32: Fix possible overflow

[Huw Davies (＠huw)]

Huw Davies (@huw) commented about dlls/gdi32/text.c:
> WARN("Out of memory\n");
>              goto cleanup;
>          }
> -        psva = HeapAlloc(GetProcessHeap(),0,sizeof(SCRIPT_VISATTR) * uCount);
> +        psva = HeapAlloc(GetProcessHeap(),0,sizeof(SCRIPT_VISATTR) * cMaxGlyphs);

`psva` would also need to be grown in the `while (res == E_OUTOFMEMORY)` loop after the first call to `ScriptShape()`.

Btw, patches that clean up the horrible mess that is `BIDI_Reorder()` would be most welcome ;-)

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/1006#note_10217