From 23be696d40981f7eeee60a49a2e31435d259d9ff Mon Sep 17 00:00:00 2001
From: Yoshiro Takeno <taro-x@justsystem.co.jp>
Date: Fri, 23 Jan 2004 22:48:28 +0000
Subject: [PATCH] PolyBezier: the point count must be 3n+1.

---
 graphics/painting.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/graphics/painting.c b/graphics/painting.c
index 5ee1a1ca246..cd37f90eeab 100644
--- a/graphics/painting.c
+++ b/graphics/painting.c
@@ -695,8 +695,12 @@ BOOL WINAPI FloodFill( HDC hdc, INT x, INT y, COLORREF color )
 BOOL WINAPI PolyBezier( HDC hdc, const POINT* lppt, DWORD cPoints )
 {
     BOOL ret = FALSE;
-    DC * dc = DC_GetDCUpdate( hdc );
+    DC * dc;
+
+    /* cPoints must be 3 * n + 1 (where n>=1) */
+    if (cPoints == 1 || (cPoints % 3) != 1) return FALSE;
 
+    dc = DC_GetDCUpdate( hdc );
     if(!dc) return FALSE;
 
     if(PATH_IsPathOpen(dc->path))
-- 
2.11.4.GIT