[WIN32K] Apply Wine commit 147765a by Sam Edwards: Prevent possible buffer overflows...

[reactos.git] / reactos / win32ss / gdi / ntgdi / freetype.c

diff --git a/reactos/win32ss/gdi/ntgdi/freetype.c b/reactos/win32ss/gdi/ntgdi/freetype.c
index 2486d7f..c106814 100644 (file)
--- a/reactos/win32ss/gdi/ntgdi/freetype.c
+++ b/reactos/win32ss/gdi/ntgdi/freetype.c
@@ -2062,8 +2062,8 @@ ftGdiGetGlyphOutline(
         case ft_glyph_format_bitmap:
         {
             BYTE *src = ft_face->glyph->bitmap.buffer, *dst = pvBuf;
-            INT w = (ft_face->glyph->bitmap.width + 7) >> 3;
-            INT h = ft_face->glyph->bitmap.rows;
+            INT w = min( pitch, (ft_face->glyph->bitmap.width + 7) >> 3 );
+            INT h = min( height, ft_face->glyph->bitmap.rows );
             while (h--)
             {
                 RtlCopyMemory(dst, src, w);
@@ -2120,7 +2120,7 @@ ftGdiGetGlyphOutline(
         case ft_glyph_format_bitmap:
         {
             BYTE *src = ft_face->glyph->bitmap.buffer, *dst = pvBuf;
-            INT h = ft_face->glyph->bitmap.rows;
+            INT h = min( height, ft_face->glyph->bitmap.rows );
             INT x;
             while (h--)
             {