diff options
| author | vitalybuka@chromium.org <vitalybuka@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-02-27 06:25:11 +0000 |
|---|---|---|
| committer | vitalybuka@chromium.org <vitalybuka@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-02-27 06:25:11 +0000 |
| commit | 5c48a06eb7660d2831d16120a2baad10759acfa4 (patch) | |
| tree | e941f391ebde50b0a919e3a106fec202a45a5015 /printing | |
| parent | 00185c40e4d97dac2081389bf3784c350c92c6c2 (diff) | |
| download | chromium_src-5c48a06eb7660d2831d16120a2baad10759acfa4.zip chromium_src-5c48a06eb7660d2831d16120a2baad10759acfa4.tar.gz chromium_src-5c48a06eb7660d2831d16120a2baad10759acfa4.tar.bz2 | |
Added more checks for buffer size to crash safely in case of incorrect driver behavior.
BUG=347282
Review URL: https://codereview.chromium.org/182273003
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@253740 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'printing')
| -rw-r--r-- | printing/backend/win_helper.cc | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/printing/backend/win_helper.cc b/printing/backend/win_helper.cc index a16228b..3405114 100644 --- a/printing/backend/win_helper.cc +++ b/printing/backend/win_helper.cc @@ -469,16 +469,16 @@ scoped_ptr<DEVMODE[]> CreateDevModeWithColor(HANDLE printer, PRINTING_EXPORT scoped_ptr<DEVMODE[]> CreateDevMode(HANDLE printer, DEVMODE* in) { - DWORD flags = in ? (DM_IN_BUFFER) : 0; - LONG buffer_size = DocumentProperties(NULL, printer, L"", NULL, in, flags); + LONG buffer_size = DocumentProperties(NULL, printer, L"", NULL, NULL, 0); if (buffer_size <= 0) return scoped_ptr<DEVMODE[]>(); + CHECK_GE(buffer_size, static_cast<int>(sizeof(DEVMODE))); scoped_ptr<DEVMODE[]> out( reinterpret_cast<DEVMODE*>(new uint8[buffer_size])); - flags |= DM_OUT_BUFFER; + DWORD flags = (in ? (DM_IN_BUFFER) : 0) | DM_OUT_BUFFER; if (DocumentProperties(NULL, printer, L"", out.get(), in, flags) != IDOK) return scoped_ptr<DEVMODE[]>(); - DCHECK_EQ(buffer_size, out.get()->dmSize + out.get()->dmDriverExtra); + CHECK_GE(buffer_size, out.get()->dmSize + out.get()->dmDriverExtra); return out.Pass(); } |