Module: wine Branch: master Commit: b367e902c9cafb1dfa5f35e52bf89377dd608ac6 URL: http://source.winehq.org/git/wine.git/?a=commit;h=b367e902c9cafb1dfa5f35e52b...
Author: Jeff Latimer lats@yless4u.com.au Date: Tue Apr 27 22:43:34 2010 +1000
usp10: Check that there are sufficient script_items before setting the last pointer.
---
dlls/usp10/tests/usp10.c | 10 ++++++++++ dlls/usp10/usp10.c | 11 ++++++----- 2 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/dlls/usp10/tests/usp10.c b/dlls/usp10/tests/usp10.c index 124526b..5ba4315 100644 --- a/dlls/usp10/tests/usp10.c +++ b/dlls/usp10/tests/usp10.c @@ -673,6 +673,7 @@ static void test_ScriptItemIzeShapePlace(HDC hdc, unsigned short pwOutGlyphs[256 WCHAR TestItem3[] = {'T', 'e', 's', 't', 'c',' ','1','2','3',' ',' ','e','n','d',0}; WCHAR TestItem4[] = {'T', 'e', 's', 't', 'd',' ',0x0684,0x0694,0x06a4,' ',' ','\r','\n','e','n','d',0}; WCHAR TestItem5[] = {0x0684,'T','e','s','t','e',' ',0x0684,0x0694,0x06a4,' ',' ','e','n','d',0}; + WCHAR TestItem6[] = {'T', 'e', 's', 't', 'f',' ',' ',' ','\r','\n','e','n','d',0};
SCRIPT_CACHE psc; int cChars; @@ -848,6 +849,15 @@ static void test_ScriptItemIzeShapePlace(HDC hdc, unsigned short pwOutGlyphs[256 ok (pcItems == 4, "There should have been 4 items, found %d\n", pcItems); ok (pItem[0].a.s.uBidiLevel == 1, "The first character should have been bidi=1 not %d\n", pItem[0].a.s.uBidiLevel); + + /* This test checks to make sure that the test to see if there are sufficient buffers to store * + * the pointer to the last char works. Note that windows often needs a greater number of * + * SCRIPT_ITEMS to process a string than is returned in pcItems. */ + cInChars = (sizeof(TestItem6)/2)-1; + cMaxItems = 4; + hr = ScriptItemize(TestItem6, cInChars, cMaxItems, NULL, NULL, pItem, &pcItems); + ok (hr == E_OUTOFMEMORY, "ScriptItemize should return E_OUTOFMEMORY, returned %08x\n", hr); + }
static void test_ScriptGetCMap(HDC hdc, unsigned short pwOutGlyphs[256]) diff --git a/dlls/usp10/usp10.c b/dlls/usp10/usp10.c index 201a74a..eebc8ab 100644 --- a/dlls/usp10/usp10.c +++ b/dlls/usp10/usp10.c @@ -669,16 +669,17 @@ HRESULT WINAPI ScriptItemize(const WCHAR *pwcInChars, int cInChars, int cMaxItem /* While not strictly necessary according to the spec, make sure the n+1 * item is set up to prevent random behaviour if the caller erroneously * checks the n+1 structure */ - memset(&pItems[index+1].a, 0, sizeof(SCRIPT_ANALYSIS)); + index++; + memset(&pItems[index].a, 0, sizeof(SCRIPT_ANALYSIS));
- TRACE("index=%d cnt=%d iCharPos=%d\n", index+1, cnt, pItems[index+1].iCharPos); + TRACE("index=%d cnt=%d iCharPos=%d\n", index, cnt, pItems[index].iCharPos);
/* Set one SCRIPT_STATE item being returned */ - if (pcItems) *pcItems = index + 1; + if (index + 1 > cMaxItems) return E_OUTOFMEMORY; + if (pcItems) *pcItems = index;
/* Set SCRIPT_ITEM */ - pItems[index+1].iCharPos = cnt; /* the last + 1 item - contains the ptr to the lastchar */ + pItems[index].iCharPos = cnt; /* the last item contains the ptr to the lastchar */ heap_free(levels); return S_OK; }