From ff3d728d7421fa898da9b78aedb4ddfdf8dc5e84 Mon Sep 17 00:00:00 2001 From: Thomas Faber Date: Tue, 25 Mar 2014 08:46:00 +0100 Subject: [PATCH] gdi32: Avoid variable-length arrays. --- dlls/gdi32/bidi.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/dlls/gdi32/bidi.c b/dlls/gdi32/bidi.c index 1d6be5360ef..066eec3f90c 100644 --- a/dlls/gdi32/bidi.c +++ b/dlls/gdi32/bidi.c @@ -596,10 +596,25 @@ BOOL BIDI_Reorder( if (lpGlyphs && doGlyphs) { - BYTE runOrder[maxItems]; - int visOrder[maxItems]; + BYTE *runOrder; + int *visOrder; SCRIPT_ITEM *curItem; + runOrder = HeapAlloc(GetProcessHeap(), 0, maxItems * sizeof(*runOrder)); + visOrder = HeapAlloc(GetProcessHeap(), 0, maxItems * sizeof(*visOrder)); + if (!runOrder || !visOrder) + { + WARN("Out of memory\n"); + HeapFree(GetProcessHeap(), 0, runOrder); + HeapFree(GetProcessHeap(), 0, visOrder); + HeapFree(GetProcessHeap(), 0, chartype); + HeapFree(GetProcessHeap(), 0, levels); + HeapFree(GetProcessHeap(), 0, pItems); + HeapFree(GetProcessHeap(), 0, psva); + HeapFree(GetProcessHeap(), 0, pwLogClust); + return FALSE; + } + for (j = 0; j < nItems; j++) runOrder[j] = pItems[j].a.s.uBidiLevel; @@ -621,6 +636,8 @@ BOOL BIDI_Reorder( if (!run_glyphs) { WARN("Out of memory\n"); + HeapFree(GetProcessHeap(), 0, runOrder); + HeapFree(GetProcessHeap(), 0, visOrder); HeapFree(GetProcessHeap(), 0, chartype); HeapFree(GetProcessHeap(), 0, levels); HeapFree(GetProcessHeap(), 0, pItems); @@ -655,6 +672,8 @@ BOOL BIDI_Reorder( glyph_i += cOutGlyphs; } } + HeapFree(GetProcessHeap(), 0, runOrder); + HeapFree(GetProcessHeap(), 0, visOrder); } done += i; -- 2.11.4.GIT