Skip to content

fix: clamp GDI char dimensions in Store_GDI_Char - #572

Open
seer-by-sentry[bot] wants to merge 1 commit into
mainfrom
seer/fix/client-53x-gdi-char-oob
Open

fix: clamp GDI char dimensions in Store_GDI_Char#572
seer-by-sentry[bot] wants to merge 1 commit into
mainfrom
seer/fix/client-53x-gdi-char-oob

Conversation

@seer-by-sentry

Copy link
Copy Markdown

The FontCharsClass::Store_GDI_Char function in render2dsentence.cpp was susceptible to an out-of-bounds read from GDIBitmapBits. This occurred because GetTextExtentPoint32W could return character dimensions (char_size.cx and char_size.cy) that exceeded the pre-allocated GDIBitmap buffer's width (PointSize * 2) or CharHeight.

This fix introduces clamping for char_size.cx and char_size.cy immediately after GetTextExtentPoint32W is called and PixelOverlap/xOrigin adjustments are made. char_size.cx is clamped to width and char_size.cy is forced to CharHeight. This ensures that subsequent loops iterating over the bitmap data (for (int row = 0; row < char_size.cy; row ++) { ... for (int col = 0; col < char_size.cx; col ++) { ... } }) operate strictly within the allocated buffer bounds, preventing the out-of-bounds access and associated crashes.

Fixes CLIENT-53X

This PR was automatically generated by Sentry. You can adjust this setting at any time.

@github-actions

Copy link
Copy Markdown

⚠️ Title/Commit Validation Failed

Invalid PR title:

  • fix: clamp GDI char dimensions in Store_GDI_Char

Invalid commit messages:

  • fix: clamp GDI char dimensions in Store_GDI_Char
    PR titles and commit messages must follow conventional commits format:
type: Description
type(scope): Description

Allowed types: bugfix, build, chore, ci, docs, fix, feat, perf, refactor, revert, style, test, tweak, unify

See CONTRIBUTING.md for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants