From 872097ccd4ad4887a2903204e14a333c45b423c7 Mon Sep 17 00:00:00 2001 From: Marcus Meissner Date: Mon, 20 Aug 2001 17:59:10 +0000 Subject: [PATCH] We need to make a copy of the fontname and the HFONT handle in IFont_Clone, otherwise we get memory corruption and bad GDI handles. --- dlls/oleaut32/olefont.c | 36 ++++++++++++++++++++++++++++++++++-- 1 file changed, 34 insertions(+), 2 deletions(-) diff --git a/dlls/oleaut32/olefont.c b/dlls/oleaut32/olefont.c index 1e552537bc1..556db6cc6fc 100644 --- a/dlls/oleaut32/olefont.c +++ b/dlls/oleaut32/olefont.c @@ -951,6 +951,9 @@ static HRESULT WINAPI OLEFontImpl_Clone( IFont** ppfont) { OLEFontImpl* newObject = 0; + LOGFONTW logFont; + INT fontHeight; + CY cySize; _ICOM_THIS(OLEFontImpl, iface); TRACE("(%p)->(%p)\n", this, ppfont); @@ -969,9 +972,38 @@ static HRESULT WINAPI OLEFontImpl_Clone( *newObject = *this; - /* - * That new object starts with a reference count of 1 + /* We need to alloc new memory for the string, otherwise + * we free memory twice. */ + newObject->description.lpstrName = HeapAlloc( + GetProcessHeap(),0, + (1+strlenW(this->description.lpstrName))*2 + ); + /* We need to clone the HFONT too. This is just cut & paste from above */ + IFont_get_Size(iface, &cySize); + + fontHeight = MulDiv(cySize.s.Lo, 2540L, 72L); + fontHeight = MulDiv(fontHeight, this->cyLogical,this->cyHimetric); + + memset(&logFont, 0, sizeof(LOGFONTW)); + + logFont.lfHeight = ((fontHeight%10000L)>5000L) ? (-fontHeight/10000L)-1 : + (-fontHeight/10000L); + logFont.lfItalic = this->description.fItalic; + logFont.lfUnderline = this->description.fUnderline; + logFont.lfStrikeOut = this->description.fStrikethrough; + logFont.lfWeight = this->description.sWeight; + logFont.lfCharSet = this->description.sCharset; + logFont.lfOutPrecision = OUT_CHARACTER_PRECIS; + logFont.lfClipPrecision = CLIP_DEFAULT_PRECIS; + logFont.lfQuality = DEFAULT_QUALITY; + logFont.lfPitchAndFamily = DEFAULT_PITCH; + strcpyW(logFont.lfFaceName,this->description.lpstrName); + + newObject->gdiFont = CreateFontIndirectW(&logFont); + + + /* The cloned object starts with a reference count of 1 */ newObject->ref = 1; *ppfont = (IFont*)newObject;