From ff57b1febba846fe30f420519b4aec2a1f23dc35 Mon Sep 17 00:00:00 2001 From: Nikolay Sivov Date: Sat, 13 Aug 2016 22:21:13 +0300 Subject: [PATCH] dwrite: Sanitize specified stretch value, valid range is [1, 9]. Signed-off-by: Nikolay Sivov Signed-off-by: Alexandre Julliard --- dlls/dwrite/opentype.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/dlls/dwrite/opentype.c b/dlls/dwrite/opentype.c index b35f1df28e8..7f4a208438a 100644 --- a/dlls/dwrite/opentype.c +++ b/dlls/dwrite/opentype.c @@ -1291,9 +1291,10 @@ void opentype_get_font_properties(struct file_stream_desc *stream_desc, struct d USHORT version = GET_BE_WORD(tt_os2->version); USHORT fsSelection = GET_BE_WORD(tt_os2->fsSelection); USHORT usWeightClass = GET_BE_WORD(tt_os2->usWeightClass); + USHORT usWidthClass = GET_BE_WORD(tt_os2->usWidthClass); - if (GET_BE_WORD(tt_os2->usWidthClass) <= DWRITE_FONT_STRETCH_ULTRA_EXPANDED) - props->stretch = GET_BE_WORD(tt_os2->usWidthClass); + if (usWidthClass > DWRITE_FONT_STRETCH_UNDEFINED && usWidthClass <= DWRITE_FONT_STRETCH_ULTRA_EXPANDED) + props->stretch = usWidthClass; if (usWeightClass >= 1 && usWeightClass <= 9) usWeightClass *= 100;