Esme Povirk (@madewokherd) commented about dlls/gdiplus/metafile.c:
+{
- EmfPlusCustomStartCapData *custom_cap_data = (EmfPlusCustomStartCapData *)record_data;
- EmfPlusCustomLineCap *line_cap;
- GpStatus status;
- UINT offset;
- *cap = NULL;
- if (data_size < FIELD_OFFSET(EmfPlusCustomStartCapData, data) + custom_cap_data->CustomStartCapSize)
return InvalidParameter;
- offset = FIELD_OFFSET(EmfPlusCustomStartCapData, data);
- line_cap = (EmfPlusCustomLineCap *)(record_data + offset);
- offset += FIELD_OFFSET(EmfPlusCustomLineCap, CustomLineCapData);
- if (line_cap->Type == CustomLineCapTypeAdjustableArrow)
This access doesn't check data_size.