Re: [PATCH v4 0/3] MR10612: gdi32/uniscribe: Fix heap buffer overflow in ScriptStringAnalyse().

[Aric Stewart (＠aricstewart)]

Aric Stewart (@aricstewart) commented about dlls/gdi32/uniscribe/usp10.c:
> if ((dwFlags & SSA_LINK) && !analysis->glyphs[i].fallbackFont && !scriptInformation[analysis->pItem[i].a.eScript].props.fComplex && !analysis->pItem[i].a.fRTL)
>                  analysis->pItem[i].a.fNoGlyphIndex = TRUE;
>
> -            ScriptShape(hdc, sc, &pStr[analysis->pItem[i].iCharPos], cChar, numGlyphs,
> -                        &analysis->pItem[i].a, glyphs, pwLogClust, psva, &numGlyphsReturned);
> -            hr = ScriptPlace(hdc, sc, glyphs, numGlyphsReturned, psva, &analysis->pItem[i].a,
> -                        piAdvance, pGoffset, &analysis->glyphs[i].abc);
> +            while (TRUE)
> +            {
> +                if (numGlyphs > 8 * cChar + 16)

Why this magic number?

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10612#note_137753