Re: gdi32 : Correction of bug 20850 Write buffer overflow in WidenPath()

[Dan Kegel]

On Sat, Nov 28, 2009 at 5:04 PM, Laurent Vromman <laur...@vromman.org> wrote:
> -    pStrokes = HeapAlloc(GetProcessHeap(), 0, numStrokes *
> sizeof(GdiPath*));
> -    pStrokes[0] = HeapAlloc(GetProcessHeap(), 0, sizeof(GdiPath));
> -    PATH_InitGdiPath(pStrokes[0]);
> -    pStrokes[0]->pFlags = HeapAlloc(GetProcessHeap(), 0,
> pPath->numEntriesUsed * sizeof(INT));
> -    pStrokes[0]->pPoints = HeapAlloc(GetProcessHeap(), 0,
> pPath->numEntriesUsed * sizeof(POINT));
> -    pStrokes[0]->numEntriesUsed = 0;
> +    pStrokes = NULL;
...

Wait, wouldn't it be simpler to keep the initial alloc, as in the attachment?
- Dan

diff --git a/dlls/gdi32/path.c b/dlls/gdi32/path.c
index 88b7b0a..f7cd464 100644
--- a/dlls/gdi32/path.c
+++ b/dlls/gdi32/path.c
@@ -1908,11 +1908,6 @@ static BOOL PATH_WidenPath(DC *dc)
     numStrokes = 0;
 
     pStrokes = HeapAlloc(GetProcessHeap(), 0, numStrokes * sizeof(GdiPath*));
-    pStrokes[0] = HeapAlloc(GetProcessHeap(), 0, sizeof(GdiPath));
-    PATH_InitGdiPath(pStrokes[0]);
-    pStrokes[0]->pFlags = HeapAlloc(GetProcessHeap(), 0, pPath->numEntriesUsed * sizeof(INT));
-    pStrokes[0]->pPoints = HeapAlloc(GetProcessHeap(), 0, pPath->numEntriesUsed * sizeof(POINT));
-    pStrokes[0]->numEntriesUsed = 0;
 
     for(i = 0, j = 0; i < pPath->numEntriesUsed; i++, j++) {
         POINT point;