Jeffrey Smith (@whydoubt) commented about dlls/gdiplus/image.c:
if ((paramsize-size > 0) || (((size-paramsize)%sizeof(RECT)) != 0))
return InvalidParameter;
- }
- else
- {
if (paramsize != size)
return InvalidParameter;
- }
- effect->params = realloc(effect->params, size);
- if (effect->type == RedEyeCorrectionEffect)
- {
num = (size-paramsize)/sizeof(RECT);
((struct RedEyeCorrectionParams *)effect->params)->numberOfAreas = num;
((struct RedEyeCorrectionParams *)effect->params)->areas = malloc(num*sizeof(RECT));
memcpy(((struct RedEyeCorrectionParams *)params)->areas, ((struct RedEyeCorrectionParams *)effect->params)->areas, num*sizeof(RECT));
Another. Need check for NULL result (out of memory).