[ros-diffs] [reactos] 01/02: [WINSPOOL] Properly copy the DEVMODE in IntFixUpDevModeNames

[Timo Kreuzer]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=02df49ebd8167da3335e9…

commit 02df49ebd8167da3335e96af25b91048bc9ec266
Author:     Timo Kreuzer <timo.kreuzer(a)reactos.org>
AuthorDate: Tue Sep 19 16:33:35 2023 +0300
Commit:     Timo Kreuzer <timo.kreuzer(a)reactos.org>
CommitDate: Sun Oct 1 13:05:51 2023 +0300

    [WINSPOOL] Properly copy the DEVMODE in IntFixUpDevModeNames
    
    Otherwise the size isn't set up correctly, leading to a crash.
    Fixes crash in comdl32_winetest printdlg.
---
 win32ss/printing/base/winspool/printers.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/win32ss/printing/base/winspool/printers.c
b/win32ss/printing/base/winspool/printers.c
index 285696d6a33..2faf3f91781 100644
--- a/win32ss/printing/base/winspool/printers.c
+++ b/win32ss/printing/base/winspool/printers.c
@@ -834,7 +834,19 @@ IntFixUpDevModeNames( PDOCUMENTPROPERTYHEADER pdphdr )
 
     if (res)
     {
-        FIXME("IFUDMN : Get Printer Name %S\n",pi2->pPrinterName);
+        /* Check if the provided buffer is large enough */
+        DWORD cbDevMode = pi2->pDevMode->dmSize +
pi2->pDevMode->dmDriverExtra;
+        if (pdphdr->cbOut < cbDevMode)
+        {
+            ERR("cbOut (%lu) < cbDevMode(%u)\n", pdphdr->cbOut,
cbDevMode);
+            res = FALSE;
+            goto Exit;
+        }
+
+        /* Copy the devmode */
+        RtlCopyMemory(pdphdr->pdmOut, pi2->pDevMode, cbDevMode);
+
+        TRACE("IFUDMN : Get Printer Name %S\n", pi2->pPrinterName);
         StringCchCopyW( pdphdr->pdmOut->dmDeviceName, CCHDEVICENAME-1,
pi2->pPrinterName );
         pdphdr->pdmOut->dmDeviceName[CCHDEVICENAME-1] = 0;
     }
@@ -842,6 +854,8 @@ IntFixUpDevModeNames( PDOCUMENTPROPERTYHEADER pdphdr )
     {
         ERR("IFUDMN : GetPrinterW failed with %u\n", GetLastError());
     }
+
+Exit:
     HeapFree(hProcessHeap, 0, pi2);
     return res;
 }