[PATCH 0/2] MR5206: gdiplus: Implement font linking in GdipAddPathString.

[PATCH 1/2] gdiplus: Fix use after free in GdipAddPathString.

[Esme Povirk]

From: Esme Povirk

---
 dlls/gdiplus/graphicspath.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/gdiplus/graphicspath.c b/dlls/gdiplus/graphicspath.c
index 23a9be25055..ea9c247b38c 100644
--- a/dlls/gdiplus/graphicspath.c
+++ b/dlls/gdiplus/graphicspath.c
@@ -1141,7 +1141,6 @@ GpStatus WINGDIPAPI GdipAddPathString(GpPath* path, GDIPCONST WCHAR* string, INT
     }

get_log_fontW(font, graphics, &lfw);
-    GdipDeleteGraphics(graphics);

hfont = CreateFontIndirectW(&lfw);
     if (!hfont)
@@ -1167,6 +1166,7 @@ GpStatus WINGDIPAPI GdipAddPathString(GpPath* path, GDIPCONST WCHAR* string, INT
     DeleteDC(dc);
     DeleteObject(hfont);
     GdipDeleteFont(font);
+    GdipDeleteGraphics(graphics);

if (status != Ok) /* free backup */
     {

[PATCH 2/2] gdiplus: Implement font linking in GdipAddPathString.

[Esme Povirk]

From: Esme Povirk

---
 dlls/gdiplus/gdiplus_private.h |  4 ++++
 dlls/gdiplus/graphics.c        |  2 +-
 dlls/gdiplus/graphicspath.c    | 25 +++++++++++++++++++++++++
 3 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/dlls/gdiplus/gdiplus_private.h b/dlls/gdiplus/gdiplus_private.h
index 1ae03d7126e..0b302a405ea 100644
--- a/dlls/gdiplus/gdiplus_private.h
+++ b/dlls/gdiplus/gdiplus_private.h
@@ -127,6 +127,10 @@ extern void calc_curve_bezier(const GpPointF *pts, REAL tension, REAL *x1,
 extern void calc_curve_bezier_endp(REAL xend, REAL yend, REAL xadj, REAL yadj,
     REAL tension, REAL *x, REAL *y);

+extern void get_font_hfont(GpGraphics *graphics, GDIPCONST GpFont *font,
+                           GDIPCONST GpStringFormat *format, HFONT *hfont,
+                           LOGFONTW *lfw_return, GDIPCONST GpMatrix *matrix);
+
 extern void free_installed_fonts(void);

extern BOOL lengthen_path(GpPath *path, INT len);
diff --git a/dlls/gdiplus/graphics.c b/dlls/gdiplus/graphics.c
index 85b25e1ac24..0727b63ed4f 100644
--- a/dlls/gdiplus/graphics.c
+++ b/dlls/gdiplus/graphics.c
@@ -2296,7 +2296,7 @@ void get_log_fontW(const GpFont *font, GpGraphics *graphics, LOGFONTW *lf)
     lstrcpyW(lf->lfFaceName, font->family->FamilyName);
 }

-static void get_font_hfont(GpGraphics *graphics, GDIPCONST GpFont *font,
+void get_font_hfont(GpGraphics *graphics, GDIPCONST GpFont *font,
                            GDIPCONST GpStringFormat *format, HFONT *hfont,
                            LOGFONTW *lfw_return, GDIPCONST GpMatrix *matrix)
 {
diff --git a/dlls/gdiplus/graphicspath.c b/dlls/gdiplus/graphicspath.c
index ea9c247b38c..662e20071aa 100644
--- a/dlls/gdiplus/graphicspath.c
+++ b/dlls/gdiplus/graphicspath.c
@@ -1001,6 +1001,9 @@ static GpStatus format_string_callback(struct gdip_format_string_info* info)
 {
     static const MAT2 identity = { {0,1}, {0,0}, {0,0}, {0,1} };
     struct format_string_args *args = info->user_data;
+    struct gdip_font_link_section *section = LIST_ENTRY(list_head(&info->font_link_info.sections), struct gdip_font_link_section, entry);
+    HFONT hfont = NULL, oldhfont = NULL;
+    int section_start = -1;
     GpPath *path = args->path;
     GpStatus status = Ok;
     float x = info->rect->X + (info->bounds->X - info->rect->X) * args->scale;
@@ -1019,6 +1022,22 @@ static GpStatus format_string_callback(struct gdip_format_string_info* info)
         TTPOLYGONHEADER *ph = NULL, *origph;
         char *start;
         DWORD len, ofs = 0;
+
+        while (i >= section->end)
+            section = LIST_ENTRY(list_next(&info->font_link_info.sections, &section->entry), struct gdip_font_link_section, entry);
+
+        if (section_start != section->start)
+        {
+            if (hfont)
+            {
+                SelectObject(info->hdc, oldhfont);
+                DeleteObject(hfont);
+            }
+            get_font_hfont(info->graphics, section->font, NULL, &hfont, NULL, NULL);
+            oldhfont = SelectObject(info->hdc, hfont);
+            section_start = section->start;
+        }
+
         len = GetGlyphOutlineW(info->hdc, info->string[i], GGO_BEZIER, &gm, 0, NULL, &identity);
         if (len == GDI_ERROR)
         {
@@ -1085,6 +1104,12 @@ static GpStatus format_string_callback(struct gdip_format_string_info* info)
             break;
     }

+    if (hfont)
+    {
+        SelectObject(info->hdc, oldhfont);
+        DeleteObject(hfont);
+    }
+
     return status;
 }