[PATCH 0/1] MR7956: gdi32: Copy the null terminator in logfont_AtoW.

[Alex Henrie (＠alexhenrie)]

Fixes: 1d3bfdc3abdaaa45075f0ec04228b911ab5ab8cf

[PATCH 1/1] gdi32: Copy the null terminator in logfont_AtoW.

[Alex Henrie]

From: Alex Henrie

Fixes: 1d3bfdc3abdaaa45075f0ec04228b911ab5ab8cf
---
 dlls/gdi32/text.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/gdi32/text.c b/dlls/gdi32/text.c
index 7725e832c6b..daf58d9682e 100644
--- a/dlls/gdi32/text.c
+++ b/dlls/gdi32/text.c
@@ -781,7 +781,7 @@ static void text_metric_ex_WtoA(const NEWTEXTMETRICEXW *tmW, NEWTEXTMETRICEXA *t
 static void logfont_AtoW( const LOGFONTA *fontA, LPLOGFONTW fontW )
 {
     memcpy( fontW, fontA, sizeof(LOGFONTA) - LF_FACESIZE );
-    MultiByteToWideChar( CP_ACP, 0, fontA->lfFaceName, strnlen( fontA->lfFaceName, LF_FACESIZE ),
+    MultiByteToWideChar( CP_ACP, 0, fontA->lfFaceName, strnlen( fontA->lfFaceName, LF_FACESIZE - 1 ) + 1,
                          fontW->lfFaceName, LF_FACESIZE );
     fontW->lfFaceName[LF_FACESIZE - 1] = 0;
 }

[PATCH 0/1] MR7956: gdi32: Copy the null terminator in logfont_AtoW. - approved

[Huw Davies (＠huw)]

This merge request was approved by Huw Davies.

[Alex Henrie (＠alexhenrie)]

Alex Henrie (@alexhenrie) commented about dlls/gdi32/text.c:
> static void logfont_AtoW( const LOGFONTA *fontA, LPLOGFONTW fontW )
>  {
>      memcpy( fontW, fontA, sizeof(LOGFONTA) - LF_FACESIZE );
> - MultiByteToWideChar( CP_ACP, 0, fontA->lfFaceName, strnlen( fontA->lfFaceName, LF_FACESIZE ),
> - MultiByteToWideChar( CP_ACP, 0, fontA->lfFaceName, strnlen( fontA->lfFaceName, LF_FACESIZE - 1 ) + 1,
>                      fontW->lfFaceName, LF_FACESIZE );
> fontW->lfFaceName[LF_FACESIZE - 1] = 0;

This line actually isn't right either because if CP_ACP is a variable-length encoding such as UTF-8 and the source string is not null-terminated, the destination string could be shorter than the source string and the null terminator would not be placed in the correct location. I'll send a better fix.

[Nikolay Sivov (＠nsivov)]

On Fri May  2 19:13:55 2025 +0000, Alex Henrie wrote:
> This line actually isn't right either because if CP_ACP is a
> variable-length encoding such as UTF-8 and the source string is not
> null-terminated, the destination string could be shorter than the source
> string and the null terminator would not be placed in the correct
> location. I'll send a better fix.

We could probably always ignore last character in the source string, treating it as if it's always null. So essentially it likely enough to make a local copy of fontA, zero LF_FACESIZE-1, sit back and relax.