On Fri, Nov 06, 2015 at 09:25:09PM +0900, Akihiro Sagawa wrote:
@@ -6970,7 +6971,16 @@ static DWORD get_glyph_outline(GdiFont *incoming_font, UINT glyph, UINT format, INT w = min( pitch, (ft_face->glyph->bitmap.width + 7) >> 3 ); INT h = min( height, ft_face->glyph->bitmap.rows ); while(h--) {
memcpy(dst, src, w);
if (!font->fake_bold)
memcpy(dst, src, w);
else {
INT x;
dst[0] = 0;
for (x = 0; x < w; x++) {
dst[x ] = (dst[x] & 0x80) | (src[x] >> 1) | src[x];
dst[x+1] = (src[x] & 0x01) << 7;
This could write past the end of dst (and similarly for ones below).
Huw.