Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-09-28 21:44:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

[WIN32SS] Avoid an user-after-free in FontFamilyFillInfo().

Browse source 
CID 1441367
This commit is contained in:
Pierre Schweitzer 2018-11-16 21:28:42 +01:00
parent 3fddd3157c
commit 2255d5f5b6
No known key found for this signature in database
GPG key ID: 7545556C3D585B0B
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
win32ss/gdi/ntgdi/freetype.c
View file

@ -2605,14 +2605,13 @@ FontFamilyFillInfo(PFONTFAMILYINFO Info, LPCWSTR FaceName,
sizeof(Info->EnumLogFontEx.elfFullName),
FullName);
ExFreePoolWithTag(Otm, GDITAG_TEXT);
RtlInitAnsiString(&StyleA, Face->style_name);
StyleW.Buffer = Info->EnumLogFontEx.elfStyle;
StyleW.MaximumLength = sizeof(Info->EnumLogFontEx.elfStyle);
status = RtlAnsiStringToUnicodeString(&StyleW, &StyleA, FALSE);
if (!NT_SUCCESS(status))
{
ExFreePoolWithTag(Otm, GDITAG_TEXT);
return;
}
Info->EnumLogFontEx.elfScript[0] = UNICODE_NULL;
@ -2623,6 +2622,7 @@ FontFamilyFillInfo(PFONTFAMILYINFO Info, LPCWSTR FaceName,
if (!pOS2)
{
IntUnLockFreeType();
ExFreePoolWithTag(Otm, GDITAG_TEXT);
return;
}
@ -2630,6 +2630,8 @@ FontFamilyFillInfo(PFONTFAMILYINFO Info, LPCWSTR FaceName,
Ntm->ntmCellHeight = pOS2->usWinAscent + pOS2->usWinDescent;
Ntm->ntmAvgWidth = 0;
ExFreePoolWithTag(Otm, GDITAG_TEXT);
fs.fsCsb[0] = pOS2->ulCodePageRange1;
fs.fsCsb[1] = pOS2->ulCodePageRange2;
fs.fsUsb[0] = pOS2->ulUnicodeRange1;