Re: [PATCH v8 0/2] MR10612: gdi32/uniscribe: Fix heap buffer overflow in ScriptStringAnalyse().

[Aric Stewart (＠aricstewart)]

Aric Stewart (@aricstewart) commented about dlls/gdi32/uniscribe/usp10.c:
> +                glyphs = calloc(numGlyphs, sizeof(*glyphs));
> +                piAdvance = calloc(numGlyphs, sizeof(*piAdvance));
> +                psva = calloc(numGlyphs, sizeof(*psva));
> +                pGoffset = calloc(numGlyphs, sizeof(*pGoffset));
> +
> +                if (!glyphs || !piAdvance || !psva || !pGoffset)
> +                {
> +                    hr = E_OUTOFMEMORY;
> +                    break;
> +                }
> +
> +                hr = ScriptShape(hdc, sc, &pStr[analysis->pItem[i].iCharPos], cChar, numGlyphs,
> +                                 &analysis->pItem[i].a, glyphs, pwLogClust, psva, &numGlyphsReturned);
> +                if (hr == E_OUTOFMEMORY)
> +                {
> +                    multiplier *= 2;
> I do not think this needs to be multiplier *=2   just multiplier ++ would be more fine grained.

With *2 you start at 2, then get 4 then get 8, so at most 3 passes and seems excessive.  But again that is just my opinion.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10612#note_139215