richedit: Prevent font or colour buffer overflow on stream out.
Static sized buffers are used for storing the colours and fonts, so there needs to be a check to prevent these buffer from overflowing.
This commit is contained in:
parent
3df78710a9
commit
fac8e957c5
|
@ -214,7 +214,7 @@ ME_StreamOutRTFFontAndColorTbl(ME_OutStream *pStream, ME_DisplayItem *pFirstRun,
|
||||||
if (table[i].bCharSet == bCharSet
|
if (table[i].bCharSet == bCharSet
|
||||||
&& (table[i].szFaceName == face || !lstrcmpW(table[i].szFaceName, face)))
|
&& (table[i].szFaceName == face || !lstrcmpW(table[i].szFaceName, face)))
|
||||||
break;
|
break;
|
||||||
if (i == pStream->nFontTblLen) {
|
if (i == pStream->nFontTblLen && i < STREAMOUT_FONTTBL_SIZE) {
|
||||||
table[i].bCharSet = bCharSet;
|
table[i].bCharSet = bCharSet;
|
||||||
table[i].szFaceName = face;
|
table[i].szFaceName = face;
|
||||||
pStream->nFontTblLen++;
|
pStream->nFontTblLen++;
|
||||||
|
@ -226,7 +226,7 @@ ME_StreamOutRTFFontAndColorTbl(ME_OutStream *pStream, ME_DisplayItem *pFirstRun,
|
||||||
for (i = 1; i < pStream->nColorTblLen; i++)
|
for (i = 1; i < pStream->nColorTblLen; i++)
|
||||||
if (pStream->colortbl[i] == crColor)
|
if (pStream->colortbl[i] == crColor)
|
||||||
break;
|
break;
|
||||||
if (i == pStream->nColorTblLen) {
|
if (i == pStream->nColorTblLen && i < STREAMOUT_COLORTBL_SIZE) {
|
||||||
pStream->colortbl[i] = crColor;
|
pStream->colortbl[i] = crColor;
|
||||||
pStream->nColorTblLen++;
|
pStream->nColorTblLen++;
|
||||||
}
|
}
|
||||||
|
@ -236,7 +236,7 @@ ME_StreamOutRTFFontAndColorTbl(ME_OutStream *pStream, ME_DisplayItem *pFirstRun,
|
||||||
for (i = 1; i < pStream->nColorTblLen; i++)
|
for (i = 1; i < pStream->nColorTblLen; i++)
|
||||||
if (pStream->colortbl[i] == crColor)
|
if (pStream->colortbl[i] == crColor)
|
||||||
break;
|
break;
|
||||||
if (i == pStream->nColorTblLen) {
|
if (i == pStream->nColorTblLen && i < STREAMOUT_COLORTBL_SIZE) {
|
||||||
pStream->colortbl[i] = crColor;
|
pStream->colortbl[i] = crColor;
|
||||||
pStream->nColorTblLen++;
|
pStream->nColorTblLen++;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue