ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

oleaut32: Cope with invalid icon data in OLEPictureImpl_LoadIcon. 

Signed-off-by: Bruno Jesus <00cpxxx@gmail.com>
This commit is contained in:
Bruno Jesus 2015-09-29 22:15:45 +08:00 committed by Alexandre Julliard
parent dfa73ca626
commit 2f9987fd04
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
dlls/oleaut32/olepicture.c
View File

@ -1210,6 +1210,8 @@ static HRESULT OLEPictureImpl_LoadIcon(OLEPictureImpl *This, BYTE *xbuf, ULONG x
HDC hdcRef; HDC hdcRef;
int i; int i;
TRACE("(this %p, xbuf %p, xread %u)\n", This, xbuf, xread);
/* /*
FIXME("icon.idReserved=%d\n",cifd->idReserved); FIXME("icon.idReserved=%d\n",cifd->idReserved);
FIXME("icon.idType=%d\n",cifd->idType); FIXME("icon.idType=%d\n",cifd->idType);
@ -1226,6 +1228,13 @@ static HRESULT OLEPictureImpl_LoadIcon(OLEPictureImpl *This, BYTE *xbuf, ULONG x
FIXME("[%d] dwDIBOffset %d\n",i,cifd->idEntries[i].dwDIBOffset); FIXME("[%d] dwDIBOffset %d\n",i,cifd->idEntries[i].dwDIBOffset);
} }
*/ */
/* Need at least one icon to do something. */
if (!cifd->idCount)
{
ERR("Invalid icon count of zero.\n");
return E_FAIL;
}
i=0; i=0;
/* If we have more than one icon, try to find the best. /* If we have more than one icon, try to find the best.
* this currently means '32 pixel wide'. * this currently means '32 pixel wide'.
@ -1237,6 +1246,12 @@ static HRESULT OLEPictureImpl_LoadIcon(OLEPictureImpl *This, BYTE *xbuf, ULONG x
} }
if (i==cifd->idCount) i=0; if (i==cifd->idCount) i=0;
} }
if (xread < cifd->idEntries[i].dwDIBOffset + cifd->idEntries[i].dwDIBSize)
{
ERR("Icon data address %u is over %u bytes available.\n",
cifd->idEntries[i].dwDIBOffset + cifd->idEntries[i].dwDIBSize, xread);
return E_FAIL;
}
if (cifd->idType == 2) if (cifd->idType == 2)
{ {
LPBYTE buf = HeapAlloc(GetProcessHeap(), 0, cifd->idEntries[i].dwDIBSize + 4); LPBYTE buf = HeapAlloc(GetProcessHeap(), 0, cifd->idEntries[i].dwDIBSize + 4);