gdiplus: Prevent integer overflows when rounding text bounds.
Mono calls GdipMeasureString with a height so large that rounding and converting it to an integer gives a negative result.
This commit is contained in:
parent
6b53cb27bc
commit
68ce9e925a
|
@ -3493,7 +3493,7 @@ static GpStatus gdip_format_string(GpGraphics *graphics,
|
||||||
gdip_format_string_callback callback, void *user_data)
|
gdip_format_string_callback callback, void *user_data)
|
||||||
{
|
{
|
||||||
WCHAR* stringdup;
|
WCHAR* stringdup;
|
||||||
INT sum = 0, height = 0, fit, fitcpy, i, j, lret, nwidth,
|
int sum = 0, height = 0, fit, fitcpy, i, j, lret, nwidth,
|
||||||
nheight, lineend, lineno = 0;
|
nheight, lineend, lineno = 0;
|
||||||
RectF bounds;
|
RectF bounds;
|
||||||
StringAlignment halign;
|
StringAlignment halign;
|
||||||
|
@ -3508,8 +3508,8 @@ static GpStatus gdip_format_string(GpGraphics *graphics,
|
||||||
nwidth = roundr(rect->Width);
|
nwidth = roundr(rect->Width);
|
||||||
nheight = roundr(rect->Height);
|
nheight = roundr(rect->Height);
|
||||||
|
|
||||||
if (nwidth == 0) nwidth = INT_MAX;
|
if (nwidth == 0 || rect->Width >= INT_MAX) nwidth = INT_MAX;
|
||||||
if (nheight == 0) nheight = INT_MAX;
|
if (nheight == 0 || rect->Height >= INT_MAX) nheight = INT_MAX;
|
||||||
|
|
||||||
for(i = 0, j = 0; i < length; i++){
|
for(i = 0, j = 0; i < length; i++){
|
||||||
/* FIXME: This makes the indexes passed to callback inaccurate. */
|
/* FIXME: This makes the indexes passed to callback inaccurate. */
|
||||||
|
|
Loading…
Reference in New Issue