Alexandre Julliard : gdi32: Validate the point count in Polyline and Polygon.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 117f862ce52aab6f166e918b391fac20e682befc
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=117f862ce52aab6f166e918b39...

Author: Alexandre Julliard 
Date:   Thu Jun 23 12:36:23 2016 +0900

gdi32: Validate the point count in Polyline and Polygon.

Signed-off-by: Alexandre Julliard

---

dlls/gdi32/path.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/dlls/gdi32/path.c b/dlls/gdi32/path.c
index 0d4ad59..9666ea3 100644
--- a/dlls/gdi32/path.c
+++ b/dlls/gdi32/path.c
@@ -1253,13 +1253,14 @@ static BOOL pathdrv_PolyDraw( PHYSDEV dev, const POINT *pts, const BYTE *types,
 /*************************************************************
  *           pathdrv_Polyline
  */
-static BOOL pathdrv_Polyline( PHYSDEV dev, const POINT *pts, INT cbPoints )
+static BOOL pathdrv_Polyline( PHYSDEV dev, const POINT *pts, INT count )
 {
     struct path_physdev *physdev = get_path_physdev( dev );
-    BYTE *type = add_log_points( physdev, pts, cbPoints, PT_LINETO );
+    BYTE *type;

-    if (!type) return FALSE;
-    if (cbPoints) type[0] = PT_MOVETO;
+    if (count < 2) return FALSE;
+    if (!(type = add_log_points( physdev, pts, count, PT_LINETO ))) return FALSE;
+    type[0] = PT_MOVETO;
     return TRUE;
 }

@@ -1267,25 +1268,27 @@ static BOOL pathdrv_Polyline( PHYSDEV dev, const POINT *pts, INT cbPoints )
 /*************************************************************
  *           pathdrv_PolylineTo
  */
-static BOOL pathdrv_PolylineTo( PHYSDEV dev, const POINT *pts, INT cbPoints )
+static BOOL pathdrv_PolylineTo( PHYSDEV dev, const POINT *pts, INT count )
 {
     struct path_physdev *physdev = get_path_physdev( dev );

-    return add_log_points_new_stroke( physdev, pts, cbPoints, PT_LINETO );
+    if (count < 1) return FALSE;
+    return add_log_points_new_stroke( physdev, pts, count, PT_LINETO );
 }

/*************************************************************
  *           pathdrv_Polygon
  */
-static BOOL pathdrv_Polygon( PHYSDEV dev, const POINT *pts, INT cbPoints )
+static BOOL pathdrv_Polygon( PHYSDEV dev, const POINT *pts, INT count )
 {
     struct path_physdev *physdev = get_path_physdev( dev );
-    BYTE *type = add_log_points( physdev, pts, cbPoints, PT_LINETO );
+    BYTE *type;

-    if (!type) return FALSE;
-    if (cbPoints) type[0] = PT_MOVETO;
-    if (cbPoints > 1) type[cbPoints - 1] = PT_LINETO | PT_CLOSEFIGURE;
+    if (count < 2) return FALSE;
+    if (!(type = add_log_points( physdev, pts, count, PT_LINETO ))) return FALSE;
+    type[0] = PT_MOVETO;
+    type[count - 1] = PT_LINETO | PT_CLOSEFIGURE;
     return TRUE;
 }