From 007c73c7ceabc21d6e17ce9c0718fd1f90d0ee0d Mon Sep 17 00:00:00 2001 From: Dmitry Timoshkov Date: Tue, 11 Oct 2005 19:55:24 +0000 Subject: [PATCH] Add a safety check for number of control points in PolyBezierTo. --- dlls/gdi/painting.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/dlls/gdi/painting.c b/dlls/gdi/painting.c index 7222ba13f4..61643c1945 100644 --- a/dlls/gdi/painting.c +++ b/dlls/gdi/painting.c @@ -736,9 +736,13 @@ BOOL WINAPI PolyBezier( HDC hdc, const POINT* lppt, DWORD cPoints ) */ BOOL WINAPI PolyBezierTo( HDC hdc, const POINT* lppt, DWORD cPoints ) { - DC * dc = DC_GetDCUpdate( hdc ); + DC * dc; BOOL ret; + /* cbPoints must be 3 * n (where n>=1) */ + if (!cPoints || (cPoints % 3) != 0) return FALSE; + + dc = DC_GetDCUpdate( hdc ); if(!dc) return FALSE; if(PATH_IsPathOpen(dc->path)) @@ -1110,8 +1114,8 @@ POINT *GDI_Bezier( const POINT *Points, INT count, INT *nPtsOut ) POINT *out; INT Bezier, dwOut = BEZIER_INITBUFSIZE, i; - if((count - 1) % 3 != 0) { - ERR("Invalid no. of points\n"); + if (count == 1 || (count - 1) % 3 != 0) { + ERR("Invalid no. of points %d\n", count); return NULL; } *nPtsOut = 0; -- 2.32.0.93.g670b81a890