Alexandre Julliard : gdi32: Fix bitmap glyph allocation size in ExtTextOut fallback implementation.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 4c3cc50104a193dcffa988116b52b9ff3042a5f8
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=4c3cc50104a193dcffa988116b...

Author: Alexandre Julliard 
Date:   Mon Jul  2 10:58:23 2012 +0200

gdi32: Fix bitmap glyph allocation size in ExtTextOut fallback implementation.

---

dlls/gdi32/font.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/dlls/gdi32/font.c b/dlls/gdi32/font.c
index bb97902..5fefa2f 100644
--- a/dlls/gdi32/font.c
+++ b/dlls/gdi32/font.c
@@ -1799,7 +1799,7 @@ static void draw_glyph( HDC hdc, INT origin_x, INT origin_y, const GLYPHMETRICS
                         const struct gdi_image_bits *image, const RECT *clip )
 {
     static const BYTE masks[8] = {0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x01};
-    UINT x, y, i, count;
+    UINT x, y, i, count, max_count;
     BYTE *ptr = image->ptr;
     int stride = get_dib_stride( metrics->gmBlackBoxX, 1 );
     POINT *pts;
@@ -1812,8 +1812,8 @@ static void draw_glyph( HDC hdc, INT origin_x, INT origin_y, const GLYPHMETRICS
     if (!clip) clipped_rect = rect;
     else if (!intersect_rect( &clipped_rect, &rect, clip )) return;

-    pts = HeapAlloc( GetProcessHeap(), 0,
-                     max(2,metrics->gmBlackBoxX) * metrics->gmBlackBoxY * sizeof(*pts) );
+    max_count = (metrics->gmBlackBoxX + 1) * metrics->gmBlackBoxY;
+    pts = HeapAlloc( GetProcessHeap(), 0, max_count * sizeof(*pts) );
     if (!pts) return;

count = 0;
@@ -1833,6 +1833,7 @@ static void draw_glyph( HDC hdc, INT origin_x, INT origin_y, const GLYPHMETRICS
             }
         }
     }
+    assert( count <= max_count );
     DPtoLP( hdc, pts, count );
     for (i = 0; i < count; i += 2) Polyline( hdc, pts + i, 2 );
     HeapFree( GetProcessHeap(), 0, pts );