Re: [PATCH v4 0/1] MR5727: riched20: In EM_SETPARAFORMAT protect against out of bound cTabStop values

28 May 2024

      Huw Davies (@huw) commented about dlls/riched20/para.c:
...
COPY_FIELD(PFM_ALIGNMENT, wAlignment);
   if (dwMask & PFM_TABSTOPS)
   {
-    para->fmt.cTabCount = pFmt->cTabCount;
-    memcpy(para->fmt.rgxTabs, pFmt->rgxTabs, pFmt->cTabCount*sizeof(LONG));
+    para->fmt.cTabCount = max(0, min(pFmt->cTabCount, MAX_TAB_STOPS)); /* Clamp between 0 and MAX_TAB_STOPS */
+    memcpy(para->fmt.rgxTabs, pFmt->rgxTabs, para->fmt.cTabCount*sizeof(LONG));
    /* Clamp between 0 and MAX_TAB_STOPS */
    para->fmt.cTabCount = max(0, min(pFmt->cTabCount, MAX_TAB_STOPS));
    memcpy(para->fmt.rgxTabs, pFmt->rgxTabs, para->fmt.cTabCount * sizeof(LONG));

Otherwise, looks fine.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/5727#note_71529

Huw Davies (＠huw)

tags

participants (1)