Skip to content
Snippets Groups Projects

gdi32: Prevent out of bounds array access

Open Fabian Maurer requested to merge DarkShadow44/wine:gdi32-heap-fix into master
2 unresolved threads

This fixes some heap corruption observed in ReactOS

Signed-off-by: Fabian Maurer dark.shadow4@web.de

Merge request reports

Members who can merge are allowed to add commits.

Merge request pipeline #2848 failed

Merge request pipeline failed for 50bbefe1

Loading
Loading

Activity

Filter activity
  • Approvals
  • Assignees & reviewers
  • Comments (from bots)
  • Comments (from users)
  • Commits & branches
  • Edits
  • Labels
  • Lock status
  • Mentions
  • Merge request status
  • Tracking
3159 3159 /* Do not allow justification between marks and their base */
3160 3160 for (i = 0; i < cGlyphs; i++)
3161 3161 {
3162 if (!pGlyphProp[i].sva.fClusterStart)
3162 if (!pGlyphProp[i].sva.fClusterStart && (i-dirL) >= 0)
3163 3163 pGlyphProp[i-dirL].sva.uJustification = SCRIPT_JUSTIFY_NONE;
  • Comment on lines -3162 to 3163

    I think it's more concerning that pGlyphProp[i].sva.fClusterStart is 0 for i == 0, assuming that's a case this is meant to catch.

  • Author Contributor

    Sorry, I don't think I understand what you mean. Wasn't that part of the original code?

  • What I mean is that (i-dirL) is negative only when i == 0 and dirL == 1, which would matter only if pGlyphProp[0].sva.fClusterStart == 0, which I think is strange. So if you're really getting -1 index there, it's better to check why fClusterStart is 0 for a first glyph.

  • Author Contributor

    Ah, I understand. Good point, I'll look into that!

  • Author Contributor

    It happens because in OpenType_GDEF_UpdateGlyphProps we go into case MarkGlyph, which sets fClusterStart to 0. Guess that is not tested against single characters. How do we continue here?

  • I'd continue by testing shaping with this font and this text on Windows, to see how properties are set.

  • Author Contributor

    What exactly would I test for that? I know basically nothing about font shaping..

  • You'll need to know which font triggers this. Then you'll use same font and same text, pass them to ScriptShape(), and see what comes out for glyph properties, and fClusterStart in particular.

  • Author Contributor

    The font is not part of your normal Wine/Linux install though, how to we handle this? Ship the font (license allows it), find another affected font or something different?

  • No need to bundle anything, I'm only asking to test on Windows and see if we can fix properties accordingly. Bundling some minimal fonts that test corner case would be ideal, but we don't do that, and I don't expect you to .

  • Please register or sign in to reply
    • Contributor

      Marvin replied on the mailing list:

      Hi,
      
      It looks like your patch introduced the new failures shown below.
      Please investigate and fix them before resubmitting your patch.
      If they are not new, fixing them anyway would help a lot. Otherwise
      please ask for the known failures list to be updated.
      
      The tests also ran into some preexisting test failures. If you know how
      to fix them that would be helpful. See the TestBot job for the details:
      
      The full results can be found at:
      https://testbot.winehq.org/JobDetails.pl?Key=124965
      
      Your paranoid android.
      
      
      === debian11 (32 bit report) ===
      
      quartz:
      filtergraph.c:524: Test marked flaky: didn't get EOS
      filtergraph.c:529: Test marked flaky: expected 1243c8, got 0
      
      === debian11 (build log) ===
      
      Use of uninitialized value $Flaky in addition (+) at /home/testbot/lib/WineTestBot/LogUtils.pm line 720, <$LogFile> line 24728.
      Use of uninitialized value $Flaky in addition (+) at /home/testbot/lib/WineTestBot/LogUtils.pm line 720, <$LogFile> line 24728.
      Use of uninitialized value $Flaky in addition (+) at /home/testbot/lib/WineTestBot/LogUtils.pm line 720, <$LogFile> line 24728.
  • Please register or sign in to reply
    Loading