[akhaldi] 67948: [WIN32K] Apply Wine commit 147765a by Sam Edwards: Prevent possible buffer overflows in get_glyph_outline.

Author: akhaldi
Date: Fri May 29 11:03:17 2015
New Revision: 67948

URL: http://svn.reactos.org/svn/reactos?rev=67948&view=rev
Log:
[WIN32K] Apply Wine commit 147765a by Sam Edwards: Prevent possible buffer overflows in
get_glyph_outline.

Modified:
    trunk/reactos/win32ss/gdi/ntgdi/freetype.c

Modified: trunk/reactos/win32ss/gdi/ntgdi/freetype.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/freetype…
==============================================================================
--- trunk/reactos/win32ss/gdi/ntgdi/freetype.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/gdi/ntgdi/freetype.c	[iso-8859-1] Fri May 29 11:03:17 2015
@@ -2062,8 +2062,8 @@
         case ft_glyph_format_bitmap:
         {
             BYTE *src = ft_face->glyph->bitmap.buffer, *dst = pvBuf;
-            INT w = (ft_face->glyph->bitmap.width + 7) >> 3;
-            INT h = ft_face->glyph->bitmap.rows;
+            INT w = min( pitch, (ft_face->glyph->bitmap.width + 7) >> 3 );
+            INT h = min( height, ft_face->glyph->bitmap.rows );
             while (h--)
             {
                 RtlCopyMemory(dst, src, w);
@@ -2120,7 +2120,7 @@
         case ft_glyph_format_bitmap:
         {
             BYTE *src = ft_face->glyph->bitmap.buffer, *dst = pvBuf;
-            INT h = ft_face->glyph->bitmap.rows;
+            INT h = min( height, ft_face->glyph->bitmap.rows );
             INT x;
             while (h--)
             {