[PATCH 0/1] MR8014: gdi32/uniscribe: Do not limit the number of items in ScriptStringAnalyse().

[Nikolay Sivov (＠nsivov)]

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=58207
Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8014

[PATCH 1/1] gdi32/uniscribe: Do not limit the number of items in ScriptStringAnalyse().

[Nikolay Sivov]

From: Nikolay Sivov <nsivov(a)codeweavers.com>

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=58207
Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>
---
 dlls/gdi32/uniscribe/usp10.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/dlls/gdi32/uniscribe/usp10.c b/dlls/gdi32/uniscribe/usp10.c
index 1fda1841533..f49e0759084 100644
--- a/dlls/gdi32/uniscribe/usp10.c
+++ b/dlls/gdi32/uniscribe/usp10.c
@@ -1905,9 +1905,10 @@ HRESULT WINAPI ScriptStringAnalyse(HDC hdc, const void *pString, int cString,
     StringAnalysis *analysis = NULL;
     SCRIPT_CONTROL sControl;
     SCRIPT_STATE sState;
-    int i, num_items = 255;
+    int i, num_items = cString + 1;
     BYTE   *BidiLevel;
     WCHAR *iString = NULL;
+    SCRIPT_ITEM *items;
 
     TRACE("(%p,%p,%d,%d,%d,0x%lx,%d,%p,%p,%p,%p,%p,%p)\n",
           hdc, pString, cString, cGlyphs, iCharset, dwFlags, iReqWidth,
@@ -1923,7 +1924,7 @@ HRESULT WINAPI ScriptStringAnalyse(HDC hdc, const void *pString, int cString,
 
     if (!(analysis = heap_alloc_zero(sizeof(*analysis))))
         return E_OUTOFMEMORY;
-    if (!(analysis->pItem = heap_calloc(num_items + 1, sizeof(*analysis->pItem))))
+    if (!(analysis->pItem = heap_calloc(num_items, sizeof(*analysis->pItem))))
         goto error;
 
     /* FIXME: handle clipping */
@@ -1955,13 +1956,12 @@ HRESULT WINAPI ScriptStringAnalyse(HDC hdc, const void *pString, int cString,
 
     hr = ScriptItemize(pString, cString, num_items, &sControl, &sState, analysis->pItem,
                        &analysis->numItems);
-
     if (FAILED(hr))
-    {
-        if (hr == E_OUTOFMEMORY)
-            hr = E_INVALIDARG;
         goto error;
-    }
+
+    /* Having as many items as codepoints is the worst case scenario, try to reclaim some memory. */
+    if ((items = heap_realloc(analysis->pItem, (analysis->numItems + 1) * sizeof(*analysis->pItem))))
+        analysis->pItem = items;
 
     /* set back to out of memory for default goto error behaviour */
     hr = E_OUTOFMEMORY;
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/8014

[PATCH 0/1] MR8014: gdi32/uniscribe: Do not limit the number of items in ScriptStringAnalyse(). - approved

[Aric Stewart (＠aricstewart)]

This merge request was approved by Aric Stewart.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8014

[PATCH 0/1] MR8014: gdi32/uniscribe: Do not limit the number of items in ScriptStringAnalyse(). - approved

[Huw Davies (＠huw)]

This merge request was approved by Huw Davies.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8014