Great!
I'll get to work on testing out this patch, and let you know what I
come up with.
Thanks again for the help!
-Zach
On Nov 16, 2005, at 1:15 PM, Rein Klazes wrote:
On Wed, 16 Nov 2005 09:05:45 -0500, in gmane.comp.emulators.wine.user
you wrote:
The aforementioned 200 lines before the exception:
Thanks, that is enough. Here is an explanation and a patch cc 'd to
the
patches list for inclusion in Wine. It would be nice if you could test
the patch (you need to compile wine from source for that).
The programs does:
- call GetFontData with buffer size zero, to return the required
buffer
size;
- do that for a number of font tables, adding the required sizes;;
- allocate a buffer large enough to store the data from all the
GetFontData calls;
- then filling the buffer with GetFontData calls, using the return
value
of the call to calculate the remaining free size.
size=0
size = size + GetFontData(..., NULL, 0);
...
size = size + GetFontData(..., NULL, 0);
buf = VirtualAlloc( ..., size, ...);
ret = GetFontData(..., buf, size);
size = size - ret;
buf = size + ret;
ret = GetFontData(..., buf, size);
Here it goes wrong because Wine's GetFontData is not returning the
actual size of the data put in the buffer, but the buffer size it
self.
The pointer to the buffer data is now pointing beyond the boundary. It
does not go wrong immediately because size is zero now, but at the
following GetFontData call the page fault is inevitable.
Changelog:
dlls/gdi : font.c
Make GetFontData return the actual number of bytes put in the buffer.
Rein.
<getfontdata.diff>
_______________________________________________
wine-users mailing list
wine-users@xxxxxxxxxx
http://www.winehq.org/mailman/listinfo/wine-users
