From 02df49ebd8167da3335e96af25b91048bc9ec266 Mon Sep 17 00:00:00 2001 From: Timo Kreuzer Date: Tue, 19 Sep 2023 16:33:35 +0300 Subject: [PATCH] [WINSPOOL] Properly copy the DEVMODE in IntFixUpDevModeNames Otherwise the size isn't set up correctly, leading to a crash. Fixes crash in comdl32_winetest printdlg. --- win32ss/printing/base/winspool/printers.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/win32ss/printing/base/winspool/printers.c b/win32ss/printing/base/winspool/printers.c index 285696d6a33..2faf3f91781 100644 --- a/win32ss/printing/base/winspool/printers.c +++ b/win32ss/printing/base/winspool/printers.c @@ -834,7 +834,19 @@ IntFixUpDevModeNames( PDOCUMENTPROPERTYHEADER pdphdr ) if (res) { - FIXME("IFUDMN : Get Printer Name %S\n",pi2->pPrinterName); + /* Check if the provided buffer is large enough */ + DWORD cbDevMode = pi2->pDevMode->dmSize + pi2->pDevMode->dmDriverExtra; + if (pdphdr->cbOut < cbDevMode) + { + ERR("cbOut (%lu) < cbDevMode(%u)\n", pdphdr->cbOut, cbDevMode); + res = FALSE; + goto Exit; + } + + /* Copy the devmode */ + RtlCopyMemory(pdphdr->pdmOut, pi2->pDevMode, cbDevMode); + + TRACE("IFUDMN : Get Printer Name %S\n", pi2->pPrinterName); StringCchCopyW( pdphdr->pdmOut->dmDeviceName, CCHDEVICENAME-1, pi2->pPrinterName ); pdphdr->pdmOut->dmDeviceName[CCHDEVICENAME-1] = 0; } @@ -842,6 +854,8 @@ IntFixUpDevModeNames( PDOCUMENTPROPERTYHEADER pdphdr ) { ERR("IFUDMN : GetPrinterW failed with %u\n", GetLastError()); } + +Exit: HeapFree(hProcessHeap, 0, pi2); return res; }