From 3ac3a5dcb5f03fcab06797f31c72eb50734e6ac6 Mon Sep 17 00:00:00 2001
From: Alexander Dorofeyev <alexd14@hushmail.com>
Date: Wed, 24 Oct 2007 00:05:32 -0700
Subject: [PATCH] gdi32: Fix unchecked NULL ptr in BIDI_Reorder.

---
 dlls/gdi32/bidi.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/dlls/gdi32/bidi.c b/dlls/gdi32/bidi.c
index 1b7b8569060..7505a910af8 100644
--- a/dlls/gdi32/bidi.c
+++ b/dlls/gdi32/bidi.c
@@ -831,7 +831,7 @@ static void resolveImplicit(const WORD * pcls, WORD *plevel, int cch)
     occurs after the character in pszInput[n]. Breaks before the first
     character are not allowed.
 ------------------------------------------------------------------------*/
-static int resolveLines(WCHAR * pszInput, BOOL * pbrk, int cch)
+static int resolveLines(LPCWSTR pszInput, BOOL * pbrk, int cch)
 {
     /* skip characters not of type LS */
     int ich = 0;
@@ -1012,7 +1012,8 @@ static void mirror(LPWSTR pszInput, const WORD* plevel, int cch)
              Array of levels
 
 ------------------------------------------------------------------------*/
-static void BidiLines(int baselevel, WCHAR * pszLine, WORD * pclsLine, WORD * plevelLine, int cchPara, int fMirror, BOOL * pbrk)
+static void BidiLines(int baselevel, LPWSTR pszOutLine, LPCWSTR pszLine, WORD * pclsLine,
+                      WORD * plevelLine, int cchPara, int fMirror, BOOL * pbrk)
 {
     int cchLine = 0;
 
@@ -1024,11 +1025,14 @@ static void BidiLines(int baselevel, WCHAR * pszLine, WORD * pclsLine, WORD * pl
         /* resolve whitespace */
         resolveWhitespace(baselevel, pclsLine, plevelLine, cchLine);
 
-        if (fMirror)
-            mirror(pszLine, plevelLine, cchLine);
+        if (pszOutLine)
+        {
+            if (fMirror)
+                mirror(pszOutLine, plevelLine, cchLine);
 
-        /* reorder each line in place */
-        reorder(baselevel, pszLine, plevelLine, cchLine);
+            /* reorder each line in place */
+            reorder(baselevel, pszOutLine, plevelLine, cchLine);
+        }
 
         pszLine += cchLine;
         plevelLine += cchLine;
@@ -1079,7 +1083,8 @@ BOOL BIDI_Reorder(
         return FALSE;
     }
 
-    memcpy(lpOutString, lpString, uCount * sizeof(WCHAR));
+    if (lpOutString)
+        memcpy(lpOutString, lpString, uCount * sizeof(WCHAR));
 
     if (WINE_GCPW_FORCE_RTL == (dwWineGCP_Flags&WINE_GCPW_DIR_MASK))
         baselevel = 1;
@@ -1088,7 +1093,7 @@ BOOL BIDI_Reorder(
     while (done < uCount)
     {
         unsigned j;
-        classify(lpOutString + done, chartype, uCount - done);
+        classify(lpString + done, chartype, uCount - done);
         /* limit text to first block */
         i = resolveParagraphs(chartype, uCount - done);
         for (j = 0; j < i; ++j)
@@ -1134,9 +1139,10 @@ BOOL BIDI_Reorder(
         resolveImplicit(chartype, levels, i);
 
         /* assign directional types again, but for WS, S this time */
-        classify(lpOutString + done, chartype, i);
+        classify(lpString + done, chartype, i);
 
-        BidiLines(baselevel, lpOutString + done, chartype, levels, i, !(dwFlags & GCP_SYMSWAPOFF), 0);
+        BidiLines(baselevel, lpOutString ? lpOutString + done : NULL, lpString + done,
+                    chartype, levels, i, !(dwFlags & GCP_SYMSWAPOFF), 0);
 
         if (lpOrder)
         {
-- 
2.11.4.GIT