Re: [PATCH 0/1] MR1006: gdi32: Fix possible overflow

[Huw Davies (＠huw)]

Huw Davies (@huw) commented about dlls/gdi32/text.c:
>          WARN("Out of memory\n");
>          goto cleanup;
>      }
> -
>    psva = HeapAlloc(GetProcessHeap(),0,sizeof(SCRIPT_VISATTR) * uCount);
> -
>    psva = HeapAlloc(GetProcessHeap(),0,sizeof(SCRIPT_VISATTR) * cMaxGlyphs);

`psva` would also need to be grown in the `while (res == E_OUTOFMEMORY)` loop after the first call to `ScriptShape()`.

Btw, patches that clean up the horrible mess that is `BIDI_Reorder()` would be most welcome ;-)